Prompt injection, poisoned training data and over-privileged AI agents are now part of a security job, and CompTIA has a certification for it. SecAI+ (exam code CY0-001) launched in February 2026, and most of the books written before it cover only one slice of the field.
This list picks seven books that cover the whole range, from the Sybex SecAI+ study guide to hands-on attack labs and the governance side. Every edition, page count and Amazon listing was checked on October 20 and 21, 2026, and all seven product pages showed Amazon.com as the seller and shipper, so the seller risk stays low. If you are new to security itself, start with our cybersecurity book list first.
The seven picks at a glance
| Book | Best for | Published | Pages | Hands-on code |
|---|---|---|---|---|
| CompTIA SecAI+ Study Guide | Passing CY0-001 | Apr 2026 | 304 | No; practice exams online |
| The Developer’s Playbook for LLM Security | Teams shipping LLM features | Oct 2024 | 200 | No |
| Practical AI Security | Running the attacks yourself | Jun 2026 | 392 | Yes, 30+ Python demos |
| AI-Native LLM Security | Each OWASP LLM risk in depth | Dec 2025 | 416 | Limited |
| Adversarial AI Attacks, Mitigations, and Defense Strategies | Adversarial ML and MLSecOps | Jul 2024 | 586 | Yes, Python repo |
| AI Security Engineering | Securing AI in production | Aug 2026 | 368 | No |
| Agentic AI for Cybersecurity | Building security agents | May 2026 | 368 | Yes, chapter projects |
Prices ran from about $27 to $51 on October 20, and they change often, so check the current price on each listing. The dates and page counts are the print editions that the links point to.
What the SecAI+ objectives cover
CompTIA’s SecAI+ page lists four domains, and the weighting tells you where to spend your reading time. Securing AI systems is 40% of CY0-001 on its own, so most of the picks below sit there:
| SecAI+ domain | Weight | Best picks for it |
|---|---|---|
| 1.0 Basic AI concepts | 17% | Sybex guide, Practical AI Security part I |
| 2.0 Securing AI systems | 40% | Sybex guide, Wilson, AI-Native LLM Security, Practical AI Security, Adversarial AI, AI Security Engineering |
| 3.0 AI-assisted security | 24% | Sybex guide, Agentic AI for Cybersecurity |
| 4.0 Governance, risk and compliance | 19% | Sybex guide, AI Security Engineering, AI-Native LLM Security |
The SecAI+ exam is 60 minutes with up to 60 questions, including performance-based ones, and CompTIA recommends three to four years in IT, two of them hands-on in security, plus Security+, CySA+, PenTest+ or equivalent knowledge. CompTIA still labels its download as draft objectives, so check the current version before you book. The objectives name these frameworks and topics by title:
- The OWASP LLM and ML Top 10.
- MITRE ATLAS.
- MCP servers and AI agents.
- The EU AI Act and the NIST AI RMF.
The SecAI+ study guide
One pick here is written for CY0-001, and none of the big certification publishers besides Sybex had a SecAI+ title on October 20. Every other SecAI+ title we found on Amazon was self-published or from a smaller press.
CompTIA SecAI+ Study Guide: Exam CY0-001
Mike Chapple, who writes the Sybex Security+, CySA+ and CISSP guides, wrote it with Fred Nwanganga, and its eight chapters follow the objectives in order. The table of contents linked from the Wiley page lists prompt injection, the OWASP LLM Top 10, MITRE ATLAS, agent access, MCP servers, the EU AI Act and the NIST AI RMF. It comes with online practice questions, flashcards and a glossary.
The limit is depth. At 304 pages, each objective gets a few pages, and the book has no labs. For the performance-based questions, CompTIA sells CertMaster Labs with live virtual lab environments and the SecAI+ page gives free practice questions after a short email form. Wiley’s own copy also disagrees with itself on whether there are two or three full practice exams. If you hold Security+ already, our Security+ book guide is the natural place to start before this one.
Books for teams that ship LLM features
These two books are for the people who build LLM applications and have to stop them leaking data or following injected instructions. Both are built around the OWASP Top 10 for LLM Applications.
The Developer’s Playbook for Large Language Model Security
Steve Wilson led the OWASP Top 10 for LLM Applications project, and his 12 short chapters move from the OWASP list and trust boundaries to prompt injection, data leakage, hallucination and supply-chain weak links. It is written for development teams first, with enough risk framing for the CISO who funds the work.
It was written on the 2023 version of the OWASP list, before the 2025 revision, which is a mixed blessing. The SecAI+ objectives still use names from that 2023 list, such as insecure plug-in design and overreliance, so the vocabulary lines up. It has no chapter on MCP or agent tool protocols, and no code repo, so treat it as a playbook rather than a lab manual.
AI-Native LLM Security
The listing describes Vaibhav Malik, Ken Huang and Ads Dawson as pioneers of the OWASP Top 10 for LLM Applications, where Dawson was the founding technical lead. Their book profiles each of the top 10 risks with a matching set of mitigations. It adds trust boundaries, threat modelling and the regulatory side, which makes it a better fit for security architects than for developers.
The Amazon listing shows only the first eight chapters, and the Packt site blocked our checks, so we could not confirm the rest of the table of contents. It had 9 ratings on October 20. Pick it over Wilson if you want each risk in more depth and do not mind a framework-heavy read.
Books where you run the attacks
Reading about model evasion and data poisoning is not the same as running it. These two books come with code, and both reward an afternoon in a notebook.
Practical AI Security
Harriet Farlow, who has a PhD in adversarial machine learning and runs Mileva Security Labs, wrote the most hands-on book here. The No Starch page promises over 30 Python demos, and the companion repo has notebooks for adversarial patches, backdoors, data poisoning, agent attacks and red teaming that run in Google Colab. Part I maps attacks to MITRE ATLAS and the OWASP lists, Part II moves on to prompt injection and agent risks, and chapter 9 covers governance.
A large share of the demos are classic attacks on image classifiers, so if you only ship LLM features, Wilson is more direct. The Amazon listing also showed different sellers through the API and the product page on October 20, so check who sells your copy before you order.
Adversarial AI Attacks, Mitigations, and Defense Strategies
John Sotiropoulos was a co-lead of the OWASP Top 10 for LLM Applications and now chairs OWASP’s Top 10 for Agentic Applications. His 586 pages cover poisoning, evasion, privacy attacks, deepfakes, prompt injection and poisoning through RAG and fine-tuning. The code repo uses Python with TensorFlow and Keras, and the last part covers MLSecOps with CI pipelines and SBOMs. It was the cheapest pick at about $27.
It came out in July 2024, so the LLM half predates agentic AI and MCP, and the code is from the TensorFlow era. The repo also warns that its SageMaker notebooks cost $1 to $2 an hour to run, so stop them when you finish. Pair it with our MLOps book list if you also run the training pipeline.
Books for securing AI in production
The last two picks are about running AI safely at company scale: the pipeline, the agents and the controls around them. Both are 2026 titles with only a few Amazon ratings so far.
AI Security Engineering
Ashish Rajan, a CISO and host of the Cloud Security Podcast, covers securing AI in the cloud, the AI pipeline, models in production, monitoring and response, and agentic systems. Wiley aims it at CISOs, security architects and the engineers who operate AI in production. That makes it the closest match to the controls and monitoring objectives in SecAI+ domain 2, and its pipeline chapters pair well with our DevSecOps book list.
It reads as an architecture and operating-model book, not an exploit lab. It came out in August 2026 and had only 2 Amazon ratings, so reader feedback is thin.
Agentic AI for Cybersecurity
Omar Santos covers building agents for security work: RAG, MCP, LangChain and LangGraph, coding agents, an autonomous SOC analyst and agentic penetration testing, with hands-on projects in several chapters, per InformIT. It is the best match on this list for SecAI+ domain 3, AI-assisted security, which is 24% of CY0-001.
Most of the book is about using agents for security rather than securing AI, and only the final chapter is defensive. The framework chapters will date quickly. For the tooling side, see our AI pentesting tools guide and the AI agents book list.
One more is worth reading if you need to explain these risks to managers: Not with a Bug, But with a Sticker by the founders of Microsoft’s AI Red Team. The hardcover was only available from third-party sellers on October 20, so we left it off the picks.
Checklist before you book CY0-001
Work through this list with the study guide open. The middle items map to the domains, and the books above fill the gaps:
- Read the current CompTIA objectives and confirm they are no longer marked draft.
- Finish one full pass of the Sybex guide, chapter by chapter.
- Explain each OWASP LLM Top 10 risk and one mitigation for it, using Wilson or AI-Native LLM Security. The objectives use the 2023 risk names, and current OWASP pages use the 2025 ones.
- Run at least three attack notebooks from Practical AI Security, including prompt injection and data poisoning.
- Map one system you know to MITRE ATLAS tactics.
- Describe how you would limit an AI agent’s tool access, including MCP servers.
- Summarise what the EU AI Act and NIST AI RMF ask of an AI system owner.
- Score above your target on the Sybex practice exams twice before you book.
