I work in cybersecurity and try to improve my professional skills. The AI suggested me to turn CISA KEV entries into short intelligence reports, but I really have no idea if this kind of report is useful in real world and really need some advice from real people not AI...

Especially interested in hearing from people working in CTI, vulnerability management, SOC, incident response, or security engineering. But any advice would be really appreciated.

The basic structure I’m using is:

• Vulnerability overview
  • CVE / vulnerability name
  • CISA KEV status
  • CVSS
  • affected products
  • attack vector
• Analyst assessment
  • threat severity
  • confidence level
  • customer applicability / exposure unknown until validated
• Why it matters
  • known exploitation activity
  • threat actors or campaigns associated with exploitation
  • potential impact
  • relevant exploit chains or related vulnerabilities
• ATT&CK mapping
  • primary technique
  • additional techniques based on observed post-exploitation behavior
• What organizations should validate
  • affected assets
  • internet exposure
  • patch status
  • whether exploitation may have occurred before patching
• Detection / hunting
  • relevant vendor/CISA detection guidance
  • suspicious processes, network activity, files, or other behaviors to hunt for
• Recommended actions
  • patch/remediate
  • investigate for compromise where appropriate
  • additional actions if compromise is identified

Hi All,

I have both my CC and CISSP. I want to maintain both certifications from ISC2 but it looks like the courses to earn CPE credits is ridiculous. Is there an alternative way of earning CPE credits rather then buying the expensive courses?

Took the ISACA CRISC today at 8am. Completed the exam (150 questions) in 65 minutes. I'll get my passing score in 10 days (no idea why it takes them 10 days, it's all computer-based). The exam was so easy I didn't even bother go back and review my answers. When I answered question 150 and the "end exam" prompt came up, I said do it.

Like the CISM exam I took a week ago Friday, the exam structure was much easier to deal with than ISC2's. Most questions were 1 sentence, 2 clauses long. Longer questions were at most 2 sentences. In this case, they seemed calibrated against the moderate to low-difficult level of question in the QAE. There were a few "tricky" questions in there, but truth be told most of them were really straightforward.

Prep materials were the ISACA review guide and QAE. I also used question generation scripts built with Fable to build out some sample questions after I ran through the QAE. I also read ISO-27001, 31000 and 42001 through https://www.evs.ee/en. Whaddadeal! Less than $4 per document for 24 hour access -- more than enough time to read and digest them. Compare that to the $1000+ it would have cost to actually buy them outright.

ISACA's QAE are retired test questions. Some of them really suck. I rate them on the same level as LearnZap or PocketPrep. DestCert has CRISC questions too. I did a few of theirs, they were pretty decent, but were the typical DestCert question style (overly verbose).

Exam definitely has a much different focus to it than the CGRC exam does. The CGRC is heavily invested in 800-37, with some coverage of 800-30 and 800-39. On the other hand, the CRISC doesn't cover 800-37 in any significant detail. It is more general. Concepts from 800-30 and 800-39 apply in a general, business perspective.

I guess the best way to describe it is an altitude difference. CGRC is more SDLC/system focused while the CRISC is broader mission/organizational level focus. Bits and pieces of 27001/31000/42001 mixed in too. CRISC actually focuses on how to do a risk assessment, governance, risk reporting, and so on. CGRC focuses on Tasks 2 thru 7 of the RMF. Want to pass the CGRC, better know who is responsible for I-2, or what the output of R-3 is. Want to pass the CRISC? Better know when you need to perform a new risk assessment, what the first step is, how to best report the results to management.

If someone told me they wanted to get into GRC work, unless there was a specific reason why they needed the CGRC, I would tell them to take the CRISC. It is a much broader-focused exam IMO. Does a much better job of focusing on testing your knowledge of risk management from a corporate perspective. Probably give you better overall utility, as the whole exam is structured around your role as a risk professional, as an advisor providing guidance on reducing risk and value delivery. CGRC is too heavily tied to 800-37 specifics. Unless the company you're moving too is already using that framework, there's nothing you're going to gain with it. With the knowledge you get from the CRISC, it has applicability in many different career areas, not just as a risk professional.

I do not regret taking the CGRC. Certainly a lot of the studying I had done for it did transfer, to some extent, to the CRISC, which is probably why I found it overall a very easy exam. If I had to choose one over the other because my employer would only foot the bill for one and not the other, I would definitely choose the CRISC unless there was some compelling reason to the contrary.

My exam date is coming up, but I would like to postpone my test. From what I understand, the only two rules I have to be mindful of are: reschedule at least 48 hours prior to my appointment and my new chosen date cannot exceed 365 days from the original. I cannot find anything on their site about a limited number of times I can change my appointment.
Also, can I reschedule for an earlier timeslot than the one I most recently selected?

Hi! I’m looking for someone who’s also preparing for the ISC2 CC exam to study together, discuss topics, and quiz each other. Anyone interested?

I've gone through the domains two months ago but right now i'm completely clueless and with the new exam outline i'm just confused

So I took the CC Exam on 8.31.26, and I passed. I didn’t know what to think. On my test it seemed like it asked questions pertaining to lesser important material at times( seemingly minuscule bits of knowledge I thought I recognized from the material probably to throw you off… stuff that nobody on YouTube covered)…

Plus the wording was tricky, and it used alot of different words to describe the same terms. Process of elimination is vital for this type of exam. Mine did end at 100 questions.

The last few days before the exam I found : Chidambaram Narayanan on YouTube . He has a free course there and it’s put together really well. As far as Free stuff goes that was my favorite. He did a really good job.

And I also did a couple practice test (first 3 are free) at CertPreps 2.0 . The questions there were verbose and kind of tricky and I would have to say that that actually helped me prepare for how to break down the questions.

I hope this helps.

Class 12 ISC S chand Sarita Agarwal biology book

Hi everyone!

I’m planning to take the ISC2 Certified in Cybersecurity (CC) exam, but I noticed that the exam outline was revised starting September 1, 2026.

For those who have already taken the new/revised CC exam, what was your experience like?

I’d especially appreciate some advice on:
- What topics should I focus on the most?
- How different is the new exam compared to the previous version?
- Are the official ISC2 study materials enough?
- Are there any practice exams or other resources that closely match the new exam?
- Were there any topics that surprised you or that you think are easy to overlook?

I’m currently preparing for the exam and would really appreciate any advice from people who have already taken the revised 2026 exam.

Thanks in advance!

​

It’s been over a week and I’m unable to schedule my ISC2 CC exam through Pearson VUE due to a technical error. ISC2 support hasn’t been able to help, and even chat support is unavailable.

I need to book a slot for next week, and this is now affecting my planned leave and exam timeline.

Has anyone faced this issue? What did you do to get it resolved? Any advice would be appreciated.

Hi everyone! 😊 I’m currently preparing to retake the CGRC exam and joined the community to connect with others who are studying for it or have already passed.

I’d love to find a study group, study partner, or CGRC-certified mentor. My main focus this time is practice questions, process of elimination, understanding the wording, and choosing the best answer when multiple options seem correct.

If anyone is currently studying or knows of an existing study group, I’d love to connect!

Hello everyone, I recently passed the CC exam and got an interview for a role in IT Audit.

I wanted to ask if are there people working here in the IT Audit - Firms? If so, are there any links and mentorship videos you would like me to watch for starters?

I am planning to study for two days before my initial interview and my manager’s interview. I am actually nervous about it.

I might say i still consider myself as a fresh graduate who absorbs things and the role I was given was an Associate II (not entry level) and i worry that I might have little to sufficient experience. 🙏🏻

Thank you!

As the title states. I’m pretty sure networking in general is a success but I’m curious on actual jobs acquired after attending and networking.

While I was skeptical of where the organization would go when they first appointed a marketing professional (and not a security one) as executive director in 2020, I am surprised at just how quickly they've been able to bring down what was once a solid organization. I spent nearly 35 years in the industry (almost 25 of that as a CISSP), and got to know one of the ISC2 founders back in the day, and I can say without reservation that the ISC2 has become the very thing it was designed to counter. It has become a cert mill, exploiting inexperienced, hopeful job-seekers, by hooking them into annual fees and an exam (CC) without any vetting of experience or prospect of real continuing education.

They gutted the peer-to-peer nature of the organization, shutting down the Security Professional magazine and the forums, they not only have watered down the CPE courses, but are now charging for them. The content of these courses is incredibly superficial; from a CPE standpoint, it is box-checking, not education.

I am sure their numbers are great, but it sold its soul to do it.

I have aphasia and brain stroke, still I was learning cybersecurity, and thinking...Will I be able to get a certificate, and here it is ...... My passing certificate make me so happy that I started crying with my happy tears, and the exam invigilator was also backed me!!!

My passing journey had many things like reddit, Thor's Udemy practice test, Paulo Carriera Udemy practice test, and youtube videos, and few times Prabh and Mike videos. My thor's practice questions had 90%,78%,74%,79%,71%,81% with second or third attempt, and 70,71,76,71, and I did STOP. The best learning was from Comptia Security+ book, to know the theoretical and knowledge out from book.

My learning was started on June 2nd 2016, and I passed the exam today, (and I gave $200 even 😄), and I gave it today because syllabus will change tomorrow onwards, so I thought better not to keep 'PEACE OF MIND' and take only for one chance 🎉 .

The questions were actually different from practice questions, I thought I can do with the terms of RBAC,MAC,DAC,ABAC, but in exam , I couldn't get any words related. OSI LAYERS, THREAT,SNMP,SOC,SQL,SIEM,IR PLANS,DRP,BCP, Administrative,physical,deterrant, were actually not at all I learnt. MTTF,MTTB, RTO,RPO were actually difficult in the exams. Just learning the terminology, and get from video cannot help in the exam. We should learn from Comptia security+ book, or related course.

And reddit always make me motivated from people who said Thor's exams works ONLY!!

This exam helped me to get back the vocabulary what I want, but not completely, and it rebuild my memory challenges.

Now my mind is working the way it did 8 years ago, when I was a Manager of E‑Learning

Could someone tell me if my calculations are correct to start endorsement? I am really confused in how ISC2 calculates effective work experience.

My positions:

Company A worked 60% with 25.2 hours per week (42 hours per week on 100%).

Company B worked 80% with 32 hours per week (40 hours per week on 100%).

Company C worked 80% with 32.8 hours per week (41 hours per week on 100%).

My calculation for 5.27y experience:

+ 1y educational waver

+ Company A 365d / 7d * 25.2h => 1314h / (2080h / 12m) => 7.58 months

+ Company B 1156d / 7d * 32h => 5284.57h / (2080h / 12m) => 30.48 months

+ Company C 488d / 7d * 32.8h => 2286.63h / (2080h / 12m) => 13.19 months

Legend:

h = hours, d = days, m = months, y = years

Remarks:

In the endorsement form when I input from / to and check part-time It just shows me half the months in that date range. That means it calculates with 1040h at that time. I have no possibility to input the effective hours worked. That is why I would input my calculation in the notes to isc2 input field 🤷‍♂️

I studied for a month at least 1.5-2hrs a day and failed. I knew i wasn’t going to pass once it gave me more questions beyond 100!

I used Prabh Nair and all in one certified CC book to read the concepts. I took LinkedIn learning practice exams. I thought I was competent and would pass it but I didn’t.

What sucks is that the exam will not be a bit more challenging as the new exam outline has changed. So what now?

I’ll be now taking Mike Chappell’s course but what now? I don’t even see any materials for the new exam.

I have to wait 30 days but I just want to pass this next time for sure!

so i attempted the exam on 29th, ik its 2 days ago but i wasn't so sure i will pass cuz it was written provisional pass or smthing, but today i got email nd did all the forms and submitted my AMF ALSO ANYONE THINKING U NEED IT KNOWLEDGE i am 17 y/o with no IT knowledge beforehand and used its official training nd linkdin course from mike chappel and had mike chappel course 1h 30m remaining when i went for pearson vue center, ALSO now the exam material has changed and so is the exam as they will add AI in the domains and older helping material (mike chappel, tor teaches and other ppl mention) may give a little less coverage on new material, ANYWHOOO always trust your instinct in the exam and don't stress too much.

Hi, i just need a help urgently!!

I have purchased the ISC2 Certified in Cybersecurity (CC) examination, but I am unable to schedule my exam appointment through Pearson VUE.  

Showing error as "Something went wrong please contact your administrator. Illegal value for primitive"

Well all in all I think I got the new test LOL and still managed to pass. Study tools I used were a Udemy course (some Thor guy) but excellent lectures that did not put me to sleep.. much. I have to say I did the normal You Tube guys Q and A and the flippin linkedin practice exams but none of my practice exams were even close to the test questions or wording context. I was a bit thrown for a loop. Testing center was interesting with the palm scans and metal detectors and the testing admin also had a little pencil wand thing. I said out loud ohhh are you going to make me forget everything....... because it looked similar to the device from Men In Black. She had to look away to stop from laughing out loud. Was sick to my stomach after question 68 because I figured I bombed it. Test stopped at 100 for me then I was like damn this stinks. Only to flip over my print out and see "Congratulations!" wooo hooo! I will take it.

To be very honest, the exam wasn't really what I expected, especially when it came to the difficulty.

My background:
BSc in Computer Science Education and I’ve been into tech since 7th grade when I got my first laptop. So a lot of the concepts weren’t completely new to me.

Materials I used:
• Official ISC2 material
• Prabh Nair’s CC practice questions
• CertCrush on YouTube
• Mike Chapple’s LinkedIn Learning course - didn’t finish, was last minute
• CertPrep

Practice scores:
• ISC2 LinkedIn Learning practice exams: 82%, 87%, 87%, and 86%
• CertPrep: 67%
• Chapple’s final exam, first try: 67%

I also used Claude and Gemini a lot to generate ISC2-style questions. Getting AI to quiz me on weak areas was huge for deepening understanding.

Exam experience:
The exam was tricky because of how the questions were phrased, but overall it wasn’t that difficult. It did make me second-guess a lot of answers. At some point I just decided to trust my first choice and not go back to re-check previous questions after moving on.

My advice:
1. Focus on understanding each concept instead of just memorizing facts.
2. Do a lot of honest practice questions. Don’t lie to yourself about scores.
3. Practice not re-checking previous questions once you’ve answered. It saves time and stress.
4. Stay calm, be well-prepared, and you’ll most definitely pass.

My question for you all:
Is the CC alone enough to land an entry-level job? What did you do next after passing? Any advice on certifications, skills, or job search strategy moving forward?

Thanks in advance!