Skip to content
CertGPS
News and updates

CySA+ CS0-003 Retires December 22: What CS0-004 Changed

CySA+ as of October 2026: the CS0-003 retirement dates, how CS0-004 shifted weight to incident response, its longer tool list and new AI objective, and which to sit.

RB
Rachel Brown
Security Researcher
Published
Updated
Read time
3 min
On this page

Related certifications

Topics

CySA+ CS0-003 Retires December 22: What CS0-004 Changed

Ten weeks remain on the English CySA+ CS0-003 exam. CompTIA retires it on December 22, 2026; CS0-004 (V4) has been on sale since June 23 and is where most candidates should start. Compared with V3, it shifts weight toward incident response, names far more tools, and adds an objective on artificial intelligence in the security operations center (SOC).

The changeover dates

CS0-003 (V3) launched on June 6, 2023. CompTIA's CySA+ page sets three dates for its exit:

  • November 22, 2026: English V3 learning products, such as CertMaster, retire.
  • December 22, 2026: the English V3 exam retires.
  • March 23, 2027: the Japanese, Portuguese and Spanish V3 exams retire.

V4 keeps V3's format of up to 85 questions in 165 minutes, with 750 to pass on a 100 to 900 scale. It is available in English now; CompTIA lists French, Japanese, Spanish and Portuguese as "coming soon" without dates. The translated V3 exams remain available three months longer.

Where the weight moved

Both versions have four domains and 15 objectives. CompTIA's objectives documents show the shares changing: Security Operations went from 33% to 34%, Vulnerability Management from 30% to 26%, Incident Response and Management from 20% to 24%, and Reporting and Communication from 17% to 16%.

The objective list was rearranged around that shift. V3's separate objectives on prioritizing vulnerabilities and on recommending controls merged into V4's 2.3, "analyze data to prioritize and mitigate vulnerabilities", which lists the Exploit Prediction Scoring System (EPSS) next to CVSS. Domain 1 gained an objective, the new one on AI. In incident response the scenario moved: V3 asked you to "perform incident response activities" in a scenario and only explain preparation and post-incident work, while V4 summarizes the process in 3.2 and makes 3.3, "implement incident response techniques", the scenario. Objective 4.2 widened from incident response reporting to "security operations and incident response reporting", adding incident declaration, escalation and shift handover. Seven V3 objectives began "Given a scenario"; six V4 objectives do.

A longer tool list

Objective 1.3 shows the change most plainly. V3 named Wireshark, tcpdump, a SIEM, SOAR, EDR, WHOIS, AbuseIPDB, Strings, VirusTotal, Joe Sandbox and Cuckoo Sandbox. V4 keeps most of those and adds CyberChef for decoding, Snort, Suricata and Zeek for packet analysis, three threat-intelligence platforms (Open Threat Exchange, MISP and OpenCTI), YARA, MXToolbox, and OpenUBA for user and entity behavior analysis. It also expects you to read YAML and Windows EVTX files alongside JSON and XML. In vulnerability management, Trivy and Checkov join the cloud tools V3 already named, ScoutSuite and Prowler.

If you studied from a V3 book, those additions are your gap list.

AI in the SOC

V3 had no objective on artificial intelligence. V4's 1.6 asks you to summarize its use in security operations under three headings. The risks are hallucinations, data exposure, model poisoning and malicious prompts. Governance covers legal and regulatory compliance and AI usage policies. The use cases run from comparing artifacts and analyzing log files to document creation, incident investigation, event correlation and automation. Its verb is "summarize", which sets the stated depth; it doesn't guarantee how individual exam items will be presented. CompTIA has added AI objectives to its other security exams too; our cross-exam tracker lists them.

Which version to sit

CS0-003 makes sense only if you've already covered its material and can test by late November. That leaves time for a second attempt before December 22: CompTIA allows one straight away, then requires 14 days before a third. Don't start a V3 learning subscription now, since English V3 products retire on November 22. Vouchers die with the exam, according to CompTIA's voucher terms, so a V3 voucher kept for January is lost money.

Everyone else should prepare for CS0-004. Mike Chapple and David Seidl's CySA+ Study Guide for CS0-004 (Sybex, fourth edition) came out in August 2026, and the CySA+ study guide has a 12-week plan built around the V4 tool list.

If you already hold CySA+, December 22 changes nothing for you. Renewal still runs on 60 continuing education units per three-year cycle, and passing CS0-004 counts as passing the latest release.

Sources