AP Cybersecurity Topics: The 5 Units and Skill Categories

AP Cybersecurity is one of College Board's new AP courses, offered for the first time in Fall 2026, with its first exam on 5 May 2027, fully digital. It has no prerequisite and is designed to be equivalent to a one-semester introductory college cybersecurity course. This guide summarizes the five units in the official framework, their topics, and the four skill categories.

Unit 1: Introduction to Security

The introductory unit focuses on the human side of security and core threats.

• Recognizing social engineering tactics and explaining their impact.
• Weak authentication and suspicious website logins; making authentication stronger.
• Security on public networks (public Wi-Fi) and types of wireless attacks.
• AI-based attacks and the use of AI in cyber defense.

Unit 2: Securing Spaces

Treats physical security as the first layer of defense (defense-in-depth).

• Cyber foundations: types of threats, phases of a cyberattack, the risk assessment process.
• Risk management strategies and types of security controls; why defense-in-depth is needed.
• Physical vulnerabilities and attacks; assessing and documenting risk.
• Protecting physical spaces and detecting physical attacks.

Unit 3: Securing Networks

Built on network attacks, segmentation, firewalls, and log analysis.

• Common network attacks and how network vulnerabilities are exploited.
• Managerial controls and wireless network security settings.
• Network segmentation and how it increases security.
• Firewall types, allowing/denying traffic with an access control list, effective placement.
• Automated security tools and detecting attacks by analyzing log files.

Unit 4: Securing Devices

Device security; authentication and detecting attacks on devices.

• Device vulnerabilities and attacks on devices.
• Authentication methods.
• Protecting devices and detecting attacks on them.

Unit 5: Securing Applications and Data

Application and data security; access controls and cryptography.

• Application and data vulnerabilities and attacks.
• Managerial controls and access controls.
• Protecting stored data with cryptography; symmetric and asymmetric cryptography.
• Protecting applications and detecting attacks on data and applications.

The four skill categories

All units are learned around four core Cybersecurity Skills:

• Analyze Risk: evaluate risk to organizational assets.
• Mitigate Risk: implement protective and deterrent security controls.
• Detect Attacks: implement detection methods, monitor systems, and analyze evidence.
• Collaborate: work with others and with AI to accomplish a task.

The exam is built around three of these: analyze risk (judge what could go wrong and how much it matters), mitigate risk (choose the right control and defense layer) and detect attacks (read logs and evidence to spot intrusions). Each of these carries roughly 25-40% of the exam.

Exam format, date and score weights

The first AP Cybersecurity exam is on 5 May 2027 and it is fully digital, delivered in Bluebook.

• 60 multiple-choice questions — 80 minutes — 70% of the score
• 1 free-response question — 50 minutes — 30% of the score

Questions assess skills like risk analysis, control selection, log/incident interpretation, and evidence-based justification. Scores are reported on the 1-5 scale.

The free-response task: one device, one decision

The free-response task is a device security analysis. You work with one simulated device, using:

• its security policy,
• firewall rules,
• system and application logs,
• file permissions.

Your job is simple to say and hard to do: find the attack, cite the evidence, and recommend a safer configuration. Those three steps are the three exam skills meeting in a single task.

A common myth: it is not just ethical hacking

One common myth is that this course is just ethical hacking. It isn't. The real focus is defense: choosing the right controls and making evidence-based decisions. The course practice also includes collaboration and AI-supported work, not just individual attacks — which is exactly what the fourth skill category, Collaborate, is about.

Who is it for?

It is a strong fit for security-minded pathways:

• cybersecurity,
• information security and assurance,
• computer science,
• IT and network engineering,
• digital forensics,
• secure software engineering.

It is also relevant to risk, audit, and technology governance. The course has no prerequisite and is designed to match an introductory college-level cybersecurity course, so whether or not you studied security before, you can start here.

University credit

AP Cybersecurity has not held its first exam yet. College Board says the first institutional credit policies are expected in Spring 2027. So today, no university guarantees credit for it.

Always check the official policy for your score, campus, major, and entry year — that is the only binding source on credit.

Frequently asked questions