TCM Security made its name with cheap, practical certifications like the PNPT, and it has applied the same formula to AI. The track has three parts. AI 100: Fundamentals is a free four-hour course on how large language models and neural networks work. AI Hacking 101 is about six hours on attacking LLM-based applications, covering prompt injection and jailbreaking, sensitive data exfiltration through RAG, improper output handling and the rest of the usual OWASP LLM list.
Both are taught by Andrew Bellini, an electrical engineer turned ethical hacker who is behind all of TCM's AI material. A third course, Securing AI Applications, covers the defensive side. The PAPA certification is what makes this worth reviewing. For $249 you get both courses for 12 months, local labs, one exam attempt and one free retake. The exam gives you two days to pentest an agentic AI application in a dedicated lab, then two more days to write a report.
There are no flags and no multiple-choice questions. TCM's line is that it does not want to profit from failure, which is why the retake is included. I like this format a lot. Most AI security credentials I have reviewed are multiple-choice tests about vocabulary. Testing an agent end to end and then writing up findings for a client is the actual job.
Allowing AI tools in the exam is also the honest choice, since everyone doing this work uses them. The weaknesses are about level and recognition. This is an associate exam, and if you have years of web testing behind you, much of the course will feel familiar with an LLM twist. The name PAPA also means nothing to most recruiters yet. Compared with OffSec's AI-300, which starts around $1,749, or SANS courses that run to thousands, PAPA is a fraction of the price, so the trade-off is reasonable. One more thing to plan for: the labs are local, so you need a laptop that can run VMs comfortably.
Check that before you buy, because your 12-month clock starts at purchase. Overall, this is the AI pentesting cert I would point most people to first. It is cheap, practical, honest about its level and graded on a report rather than trivia.