AP Cybersecurity

Unit 1: Introduction to Security

An introductory unit that is meant to span around 10 class periods. It covers Introductory Social Engineering (Unit 1.1), Suspicious Website Logins (Unit 1.2), Best Practices for Public Networks (Unit 1.3), AI-Based Cybersecurity Attacks (Unit 1.4), and Leveraging AI in Cyber Defense (Unit 1.5).

Unit 2: Securing Spaces

A unit focusing on physical spaces and social engineering. Meant to cover 21 class periods, it contains: Cyber Foundations (Unit 2.1), Physical Vulnerabilities and Attacks (Unit 2.2), Protecting Physical Spaces (Unit 2.3), and Detecting Physical Attacks (Unit 2.4).

Unit 3: Securing Networks

A unit focusing on computer networks. Meant to cover 26 class periods, it contains: Network Vulnerabilities and Attacks (Unit 3.1), Protecting Networks: Managerial Controls and Wireless Security (Unit 3.2), Protecting Networks: Segmentation (Unit 3.3), Protecting Networks: Firewalls (Unit 3.4), and Detecting Network Attacks (Unit 3.5).

Unit 4: Securing Devices

A unit focusing on individual computers and devices. Meant to cover 23 class periods, it contains: Device Vulnerabilities and Attacks (Unit 4.1), Authentication (Unit 4.2), Protecting Devices (Unit 4.3), and Detecting Attacks on Device (Unit 4.4).

Unit 5: Securing Applications and Data

The longest unit, focusing on software and digital security. Meant to cover 30 class periods, it contains: Application and Data Vulnerabilities and Attacks (Unit 5.1), Protecting Applications and Data: Managerial Controls and Access Controls (Unit 5.2), Protecting Stored Data with Cryptography (Unit 5.3), Asymmetric Cryptography (Unit 5.4), Protecting Applications (Unit 5.5), and Detecting Attacks on Data and Applications (Unit 5.6).

Skill Category 1: Analyze Risk

• Evaluate risk to organizational assets.
• Calculate ROI and understand when and when not to take action on risk.
• Documenting and understanding the impact of risk.

Skill Category 2: Mitigate Risk

• Implement security controls to actively stop cyberattacks.
• Understand the difference between Protective, Deterrent, and Corrective security controls.
• Implementing and logging security mitigations.

Skill Category 3: Detect Attacks

• Implement detection methods.
• Analyze evidence and Monitor systems to find active attacks.
• Evaluate the usefulness of different threat detection methods.

Skill Category 4: Collaborate

• Work with others and AI to accomplish a task.
• Use AI as a tool to collaborate, both alone and in a group.
• Create clear team-based cybersecurity objectives

Structure

The AP Cybersecurity Exam is given during May to all students taking the course at a high school or self-studying with an official. The exam consists of 60 Multiple Choice Questions (MCQs) and 1 Free Response Question (FRQ). The MCQ section is timed at 80 minutes, while the FRQ section has 50 minutes; making the total time given 130 minutes. The MCQ section is weighted at 70% of the exam score, while the FRQ section is 30%. During the MCQ section, students may be asked questions in a range of cybersecurity topics spanning from Social Engineering to Cryptography to Authentication and Data Protection. During the FRQ section, students will be asked to understand, mitigate, and identify threats by attackers, as well as evaluate the viability/effectiveness of different defense systems.

Exam Weighting

Instead of weighing by unit, the AP Cybersecurity exam is weighed by skill category. With Skill Categories 1-3 having 25-40% weighting, and Skill Category 4 not being directly tested.

Score Distributions

Because AP Cybersecurity officially launched during the 2026-2027 school year, there are no official Score Distributions, as the 2025-2026 pilot phase scores were not made public.