Updated September 29, 2026: Both exams are changing. CySA+ V4 (CS0-004) launched June 23, 2026, and the English CS0-003 exam retires December 22, 2026. Security+ V8 (SY0-801) is expected on or around November 17, 2026, while the English SY0-701 exam stays available until June 11, 2027 (CompTIA, CompTIA).
Security+ and CySA+ are the two CompTIA security certifications people most often weigh against each other. They aren’t really rivals. Security+ proves you know the core of security across the board. CySA+ proves you can do the day-to-day work of a security analyst: watching alerts, investigating incidents and managing vulnerabilities.
This comparison puts the current exams side by side, explains who each one is for, and tells you which to take first based on your goal. For the full details of each exam, see our Security+ guide and CySA+ guide.
Security+ vs CySA+ at a glance
| Security+ (SY0-701) | CySA+ (CS0-004) | |
|---|---|---|
| Level | Foundational security (CompTIA’s core security cert) | Intermediate, analyst-focused |
| Best for | First security job, help desk and sysadmins moving into security, DoD roles | SOC analysts, incident responders, vulnerability analysts |
| Recommended experience | Network+ and 2 years as a security or systems administrator | About 4 years in a SOC or vulnerability analyst role |
| Questions | Up to 90, multiple-choice and performance-based | Up to 85, multiple-choice and performance-based |
| Time | 90 minutes | 165 minutes |
| Passing score | 750 on a 100-900 scale | 750 on a 100-900 scale |
| US exam price | $439 ($579 with Retake Assurance) | $439 ($579 with Retake Assurance) |
| Renewal | 3 years: 50 CEUs + $150 CE fee | 3 years: 60 CEUs + $150 CE fee |
| Current version | V7 launched Nov 7, 2023; V8 expected Nov 17, 2026 | V4 launched Jun 23, 2026; V3 English retires Dec 22, 2026 |
| DoD 8140 (Matrix V2.1) | Intermediate option for 19 work roles | Advanced option for 511, 531, 541 and 612, among others |
Prices are from the CompTIA US store on September 29, 2026. Exam facts come from CompTIA’s Security+ V7 and CySA+ V4 pages; renewal figures come from CompTIA’s CEU and CE fee pages. The DoD row comes from the DoD 8140 Qualification Matrix V2.1; see our DoD 8140 certifications guide.
What each exam covers
Security+ is broad. It checks that you understand the whole field well enough to work safely in it.
| Security+ SY0-701 domain | Weight |
|---|---|
| General security concepts | 12% |
| Threats, vulnerabilities, and mitigations | 22% |
| Security architecture | 18% |
| Security operations | 28% |
| Security program management and oversight | 20% |
CySA+ is narrower and deeper. Almost everything in it is about the work a SOC analyst does on shift.
| CySA+ CS0-004 domain | Weight |
|---|---|
| Security Operations | 34% |
| Vulnerability Management | 26% |
| Incident Response and Management | 24% |
| Reporting and Communication | 16% |
Security+ asks whether you know what a SIEM, an IDS or a vulnerability scan is. CySA+ hands you log excerpts, scan output and incident details and asks what you would do next. That’s why CySA+ gives you 165 minutes for fewer questions: there is more to read and analyze in each one.
Difficulty: how much harder is CySA+?
CySA+ is the harder exam for most people. The question count is lower, but the performance-based questions take longer, and they assume you have seen real alerts and scan results. CompTIA’s own recommended experience tells the story: about two years in an admin role for Security+, about four years in a SOC or vulnerability analyst role for CySA+.
Neither exam has a formal prerequisite, so you can book CySA+ without Security+. Most people don’t, because Security+ covers the vocabulary CySA+ assumes you already know. If you already work in a SOC and handle tickets every day, going straight to CySA+ is reasonable.
Cost and renewal
- Exam vouchers: $439 each on the CompTIA US store (September 29, 2026), or $579 with Retake Assurance. Taking both costs $878 before study materials.
- Renewal: both are valid for three years. Security+ needs 50 CEUs and CySA+ needs 60, with a $150 CE fee per three-year cycle. CompTIA says CE fees are not annual.
- Stacking: CompTIA lists “earn a higher-level CompTIA certification” as a renewal option with no CE fee. Earning CySA+ can renew a Security+ you already hold, so one renewal effort can cover both.
- Timing: if you plan to take Security+ soon, SY0-701 remains available in English until June 11, 2027 even after V8 launches. For CySA+, study for CS0-004; CS0-003 retires in English on December 22, 2026.
Jobs and salary
Both certifications point toward the same job family. The U.S. Bureau of Labor Statistics reports a median salary of $129,180 for information security analysts in May 2025, with employment projected to grow 21% from 2025 to 2035 (BLS). BLS doesn’t publish pay by certification, so treat that as the ceiling of the analyst track, not a promise for a new cert holder.
In practice, Security+ is often a screening requirement for entry-level security, help desk and system administrator jobs, especially in government. CySA+ shows up in SOC analyst, threat analyst and incident responder postings. For vendor and survey salary figures, see our cybersecurity certification salary guide.
Which should you pick?
- You are new to security: Security+ first. If you are brand new to IT, consider Network+ or CompTIA A+ before that, or see Best Cybersecurity Certifications in 2026 for beginner-friendly options.
- You need a DoD or contractor job: Security+ first. It is an Intermediate option for 19 work roles in the DoD 8140 matrix, which makes it the most flexible single CompTIA cert for DoD work. Add CySA+ when your role is 511 Cyber Defense Analyst, 531 Incident Responder, 541 Vulnerability Assessment Analyst or 612 Security Control Assessor at the Advanced level.
- You already work in a SOC: CySA+. It matches your daily work and signals you are ready for a senior analyst or incident response role.
- You want to move into penetration testing: Security+, then PenTest+ or OSCP.
- You are headed for management: Security+ now, then CISSP or CISM later once you have the experience.
The most common path is simple: Security+, a year or two of hands-on work, then CySA+.
Building a longer path beyond these two? The full certification roadmap shows common orders by career goal, including analyst and DoD tracks.
Analysts read the news before the alerts hit. The CyberExperts Daily Brief covers what changed in security and why it matters, in five minutes, weekday mornings. Get tomorrow’s brief.
Frequently asked questions
Should I take Security+ or CySA+ first?
Most people should take Security+ first. It covers the core security knowledge CySA+ assumes. If you already work as a SOC analyst, you can go straight to CySA+; there is no formal prerequisite.
Is CySA+ harder than Security+?
Yes, for most people. CySA+ has up to 85 questions in 165 minutes with more scenario and log analysis, and CompTIA recommends about four years of SOC or vulnerability analyst experience, versus two years of admin experience for Security+.
How much do Security+ and CySA+ cost?
Each voucher is $439 on the CompTIA US store as of September 29, 2026, or $579 with Retake Assurance.
Does CySA+ renew Security+?
CompTIA lets you renew by earning a higher-level CompTIA certification, with no CE fee. Earning CySA+ can renew an active Security+. Otherwise, Security+ needs 50 CEUs and CySA+ needs 60 CEUs, each with a $150 CE fee every three years.
Which exam versions are current?
Security+ SY0-701 is current, with V8 (SY0-801) expected on or around November 17, 2026; SY0-701 English retires June 11, 2027. CySA+ CS0-004 launched June 23, 2026; CS0-003 English retires December 22, 2026.
Do both count for DoD 8140?
Yes. In the DoD 8140 Qualification Matrix V2.1, Security+ is an Intermediate option for 19 work roles, and CySA+ is an Advanced option for roles including 511, 531, 541 and 612.
Which pays more, Security+ or CySA+?
BLS doesn’t report salary by certification. It reports a May 2025 median of $129,180 for information security analysts. CySA+ usually goes with more experienced analyst roles, which tend to pay more than entry-level positions.
Sources
- CompTIA, Security+ V7 (SY0-701) exam details: comptia.org
- CompTIA, Security+ V8 (SY0-801) exam details: comptia.org
- CompTIA, CySA+ V4 (CS0-004) exam details: comptia.org
- CompTIA, CySA+ V3 (CS0-003) retirement: comptia.org
- CompTIA store, Security+ voucher prices (Sep 26, 2026): shop.comptia.org
- CompTIA store, CySA+ voucher prices (Sep 26, 2026): shop.comptia.org
- CompTIA, Earn continuing education units: comptia.org
- CompTIA, Continuing education renewal fees: comptia.org
- DoD 8140 Qualification Matrix V2.1 (effective Sep 19, 2025): media.defense.gov
- BLS, Information security analysts: bls.gov
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
