Skip to content
CertGPS
Comparison

Security+ Then CySA+: When to Step Up, and Whether to Skip Security+

CySA+ builds on Security+ for SOC and vulnerability analysts. When to make the step, whether to skip Security+, and how the November and December exam changes affect it.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

Security+ Then CySA+: When to Step Up, and Whether to Skip Security+

CompTIA builds CySA+ on top of Security+, so few readers are really choosing between them. Security+ checks that you know the controls; CySA+ checks that you can work an alert queue, from reading indicators to ranking vulnerabilities and closing an incident. The open question is timing, and this winter it's sharper than usual: Security+ SY0-801 launches on November 17, 2026, and the English CySA+ CS0-003 exam retires on December 22.

The two exams side by side

Security+CySA+
IssuerCompTIACompTIA
Current versionsSY0-701; SY0-801 from November 17, 2026CS0-004 since June 23, 2026; English CS0-003 until December 22, 2026
QuestionsUp to 90, multiple choice and performance-basedUp to 85, multiple choice and performance-based
Time90 minutes165 minutes
Passing score750 on a 100–900 scale750 on a 100–900 scale
Price (US list)$439 voucher for SY0-701$439 voucher for CS0-004
Recommended experienceNetwork+ and two years as a security or systems administratorAbout four years as a level 2 SOC analyst or vulnerability analyst
PrerequisitesNoneNone; Security+ recommended
RenewalEvery three years: 50 CEUs and a $150 feeEvery three years: 60 CEUs and a $150 fee

What the next ten weeks change

Both exams are mid-transition, and CompTIA's voucher terms make the dates matter. A voucher is tied to an exam series, and a retirement date overrides the expiry printed on it.

For Security+, nothing forces a decision yet. SY0-701 stays available in English until June 11, 2027, so someone already studying for it can finish. Starting from nothing this month, you'll probably end up on SY0-801, which adds a new objective on AI threats such as prompt injection. Our SY0-701 vs SY0-801 piece covers that choice in detail.

For CySA+, the window on the old exam is nearly shut. CS0-003 still makes sense only if you've already worked through its material and can sit by late November, leaving room for an immediate retake before December 22. CompTIA retires the English V3 learning products a month earlier, on November 22. Anyone who passed Security+ this year and is planning CySA+ for 2027 should study CS0-004 and nothing else.

What CySA+ asks that Security+ doesn't

Security+ is broad and shallow by design. CompTIA's SY0-701 outline asks you to tell a deterrent control from a directive one, recognize impossible travel as an indicator of compromise, and know what SPF, DKIM and DMARC each check. Security Program Management and Oversight, the governance domain, takes 20% of it.

CySA+ narrows to the analyst's job and goes deep. Security Operations is 34% of CompTIA's CS0-004 outline, and objective 1.3 names more than 20 tools you may be asked to use in a scenario, among them CyberChef, Zeek, Suricata, YARA and MISP. The CS0-004 outline also expects you to read JSON, XML, YAML and Windows EVTX files and to pick out a suspicious PowerShell or Python command. Vulnerability work goes as far as ranking findings with CVSS alongside the Exploit Prediction Scoring System (EPSS), and cloud scanners such as Prowler and Trivy appear by name. Reporting carries 16%, with SOC metrics like mean time to detect and the parties an incident communication plan has to reach.

CySA+ also allows close to two minutes a question against Security+'s one, and its scenarios come with log lines and tool output to read.

Can you go straight to CySA+?

You can. CompTIA recommends Security+ before CySA+ but doesn't require it, and CySA+ sits above Security+ in CompTIA's certification hierarchy. An analyst who already triages alerts every day and isn't applying for anything that names Security+ can save the $439 Security+ voucher and spend the study time on the CySA+ tool list.

Two groups shouldn't skip it. Anyone not yet working in security will find CySA+ hard to prepare for without the foundation Security+ provides, and CompTIA's four-year recommendation describes a candidate already doing the job. And on a US Department of Defense contract, check the certifications your 8140 work role accepts; CompTIA maps both exams to DoD 8140, but a contract may still name one of them.

One renewal for both

Holding both costs less than it looks. CompTIA's continuing education rules let a higher certification renew the ones below it, so keeping CySA+ current, with 60 CEUs and a $150 fee per cycle, also renews Security+ and Network+. Passing the latest CySA+ exam or earning SecurityX renews CySA+ with no fee at all. CompTIA also lists the pair as a stackable certification, the CompTIA Security Analytics Professional, and adding SecurityX makes the Security Analytics Expert stack.

The two don't add up toward CISSP. Both are on ISC2's list of credentials that waive one of CISSP's five required years, but ISC2 grants one year at most, however many listed credentials you hold.

Our view

Take Security+ while you're getting into security work, and take CySA+ once you're doing analysis for a living rather than when a calendar says four years have passed. We read CompTIA's experience figure as a description of its target candidate, and an analyst who already uses most of the tools in objective 1.3 is that candidate. If you're already in a SOC with no posting asking for Security+, we'd skip it and go straight to CS0-004. A reasonable practitioner might keep Security+ anyway for its DoD 8140 coverage, and that's a fair call on a defense contract. Our SOC analyst career ladder covers what comes after CySA+.

Sources