Skip to content
CertGPS
News and updates

Security+ SY0-701 vs SY0-801: The Objective Changes and Which Exam to Sit

What SY0-801 changes inside the Security+ outline, domain by domain: merged objectives, a new AI objective, governance cut to 14%, and who should still sit SY0-701.

RB
Rachel Brown
Security Researcher
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

Security+ SY0-701 vs SY0-801: The Objective Changes and Which Exam to Sit

SY0-801 keeps SY0-701's published question limit, time limit and passing score: up to 90 questions, 90 minutes, a 750 pass mark. The differences are all in the outline. CompTIA cut the objectives from 28 to 27, raised the number written as scenarios from seven to nine, added an objective on threats from artificial intelligence (AI), and shrank governance from a fifth of the exam to 14%.

Weights and objective counts

The domain names barely change. Domain 2 swaps "Mitigations" for "Attacks", because its mitigation objective moved into Security Operations.

DomainSY0-701 (V7)SY0-801 (V8)
1. General Security Concepts12%, 4 objectives16%, 3 objectives
2. Threats, Vulnerabilities, and Mitigations (V8: and Attacks)22%, 5 objectives24%, 6 objectives
3. Security Architecture18%, 4 objectives19%, 4 objectives
4. Security Operations28%, 9 objectives27%, 8 objectives
5. Security Program Management and Oversight20%, 6 objectives14%, 6 objectives

Domain 1: fewer objectives, more weight

V7's separate objectives on control types and on fundamental concepts merge into V8's 1.1, "Explain security concepts and controls", which adds defense in depth and least privilege. Zero Trust stays, minus V7's breakdown into policy engine, policy administrator and enforcement point. The physical controls V7 listed here (bollards, fencing, sensors) and the honeypot family leave the domain. Physical items reappear as threat vectors and attacks in domain 2, and honeypots, honeytokens and a new canary account turn up in 4.1.

Change management turns into a scenario objective. V7 asked you to "explain the importance" of it; V8's 1.2 asks you to "demonstrate the impact", and adds the change advisory board and fail-forward planning. The cryptography objective sheds blockchain, the open public ledger and steganography. It also stops naming TPM, HSM and the secure enclave: V8 lists "Tools" with no examples.

Domain 2: threats and vulnerabilities pulled apart, and AI

A new 2.1 covers the characteristics of threats and vulnerabilities: threat feeds, intelligence sources, CVSS scoring, CVE and prioritization, material V7 kept under vulnerability management. Threat actors (now 2.2) add terrorists, competitors and accidental or unintentional actors, and "nation-state" becomes "state-sponsored".

The threat-vector objective, 2.3, is much longer. It now names RCS messaging, QR codes, browser extensions, password managers, session tokens, living-off-the-land tools, SaaS providers, operational technology and signal-based vectors such as Bluetooth and NFC. Objective 2.4 adds attack surfaces V7 didn't list: large language models, identity providers, public repositories, public object storage, hardcoded secrets and stale credentials. The indicators objective, 2.5, adds quishing, deepfakes, MFA bypass, user enumeration, fileless malware and log manipulation.

Objective 2.6 is the one wholly new topic, "Summarize threats and vulnerabilities associated with artificial intelligence (AI) usage." It lists model manipulation, poisoning, prompt injection, data loss, bias, explainability, hallucinations, jailbreaking, evasion, privacy, ethics, session hijacking and code execution.

Domains 3 and 4: mitigation becomes operations

Architecture changes least. Objective 3.2 is reworded to "manage the security architecture" and gains Zero Trust architecture, Security Service Edge, group managed service accounts and privilege creep. Resilience (3.4) picks up the recovery metrics V7 kept under risk management (RTO, RPO, MTTR, MTBF), plus backup immutability and restoration testing.

Security Operations is where V7's pieces get reassembled. V7's objectives on securing computing resources and on modifying enterprise capabilities combine with domain 2's mitigation objective into V8's 4.1, a single scenario objective on applying mitigating controls. It adds secrets scanning and BIMI for email. Vulnerability management (4.3) becomes a scenario, adding cloud security posture management, IP address management and source code review. Identity (4.5) adds passkeys, emergency access accounts and compromised credential monitoring. Automation (4.6) becomes a scenario too, and lists agentic AI, chatbots and AI-augmented baselines. Incident response (4.7) adds negotiation and mandatory external reporting, and the investigation objective (4.8) adds memory dumps and log parsing.

Domain 5: six points lighter

Governance (5.1) becomes a catalog of artifacts: guidelines, standards, procedures, plans and policies, including clean desk and vulnerability disclosure. Third-party risk adds RFP, RFI and RFQ to vendor selection, compliance adds anti-money-laundering and anti-bribery training, and the audit objective names MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model as reference sources.

What the V8 outline stops naming

Several V7 terms don't appear in the V8 document at all: WPA3 and wireless heat maps, SASE and SD-WAN, RTOS and ICS/SCADA, typosquatting, pretexting, bloatware, birthday attacks, and cross-site scripting by name (V8 says only "Injection"). CompTIA's objectives documents warn that their examples aren't exhaustive, so an omitted example isn't proof that a topic is off the exam. Use the full objective statements and your preparation gaps to set priorities.

Which exam to sit

Both lead to the same certification with the same three-year validity. Stay on V7 if you're already deep into V7 material and can test by early spring 2027, ahead of its English retirement on June 11, 2027, or if you test in Japanese, Portuguese, Spanish or Thai, since V8 launches in English only. Start on V8 if you're beginning now, and expect few books for a while. Wiley lists the SY0-801 edition of Chapple and Seidl's Sybex guide for December 2026, and Total Seminars has McGraw Hill's All-in-One shipping the same month. Until then the objectives PDF is the reference.

The dates, voucher rules and renewal options are in the Security+ V8 timeline, and the Security+ study guide has a study plan for either version.

Sources