CompTIA Cybersecurity Certifications (2026): The Path From A+ and Network+ to Security+, CySA+, PenTest+ and SecurityX

Published November 11, 2026. Exam facts come from CompTIA’s certification pages linked in each section, checked on that date. CompTIA is replacing Security+ V7 with V8 this month, so check the version you book. Fees vary by country, so we link to CompTIA’s buy pages instead of listing prices.

CompTIA’s catalog runs from help desk and networking to cloud, data and AI (CompTIA catalog). Eight of them make up its cybersecurity path: A+ and Network+ as the IT foundation, Security+ as the first security certification, CySA+ and PenTest+ for defense and offense, SecurityX at the senior level, and two newer specialty exams, SecAI+ and SecOT+.

This guide puts those certifications in order, shows what each exam looks like, and explains when you can skip a step.

Short answer: new to IT, start with A+. Already working in IT, start with Network+ or go straight to Security+. After Security+ and some security work, take CySA+ for analyst and SOC roles or PenTest+ for penetration testing. SecurityX comes last; CompTIA recommends ten years of IT experience for it. SecAI+ and SecOT+ are side branches for AI and operational technology work.

CompTIA cybersecurity certifications at a glance

Sources: each certification links to its CompTIA page; CEU numbers are from CompTIA’s continuing education page. CompTIA lists experience as recommended, not required, and none of these pages lists another certification as a prerequisite.

The CompTIA cybersecurity pathway, step by step

1. A+: only if you are new to IT

CompTIA calls A+ “the industry standard to start your IT career.” It takes two exams, Core 1 (hardware and networking) and Core 2 (operating systems and security), in any order, but both must come from the same version. V15 launched March 25, 2025, and CompTIA estimates its retirement in 2028. CompTIA lists A+ against DoD 8140 work roles including technical support specialist and system administrator (CompTIA).

If you already work in IT support, you can usually skip A+ and start with Network+. Our A+ guide has a study plan if you need it.

2. Network+: the networking foundation

Network+ (N10-009) launched June 20, 2024. Its five domains are networking concepts (23%), network implementation (20%), network operations (19%), network security (14%) and network troubleshooting (24%). Retirement is estimated for 2027 (CompTIA). CompTIA recommends Network+ before Security+ V7, and SecurityX recommends Network+ knowledge too. See our Network+ guide.

3. Security+: the first security certification

Security+ sits at the center of the path. Two versions overlap right now:

CompTIA says V7 “remains a strong option” if you are ready to certify now, while V8 adds coverage of AI-related risks, security operations and modern environments (CompTIA). Sources: V7 page, V8 page. Our Security+ exam guide goes through the V7 objectives, and IT security certifications for beginners compares Security+ with ISC2 CC and GIAC GFACT.

4. CySA+ or PenTest+: pick defense or offense

CySA+ is for security operations and vulnerability management. V4 (CS0-004) launched June 23, 2026, with four domains: security operations (34%), vulnerability management (26%), incident response and management (24%) and reporting and communication (16%) (CompTIA). The V3 English exam retires December 22, 2026, and translations retire March 23, 2027 (CompTIA). See our CySA+ study guide, Security+ vs CySA+ and blue team certifications.

PenTest+ is for penetration testers and vulnerability testers. V3 (PT0-003) launched December 17, 2024, and covers engagement management (13%), reconnaissance and enumeration (21%), vulnerability discovery and analysis (17%), attacks and exploits (35%) and post-exploitation and lateral movement (14%). It is offered in English, French, Japanese and Portuguese (CompTIA). Compare it with other offensive certs in CEH vs PenTest+ vs OSCP and our PenTest+ guide.

Both list 750 as the passing score, and SecurityX recommends knowledge of both.

5. SecurityX: the senior exam

SecurityX (CAS-005, formerly CASP+) is CompTIA’s certification for “security architects and senior security engineers.” It is pass/fail, with up to 90 questions in 165 minutes, and covers governance, risk and compliance (20%), security architecture (27%), security engineering (31%) and security operations (22%) (CompTIA). Our cybersecurity engineer certifications guide compares it with CISSP-ISSEP and cloud security engineer certs, and SecurityX vs CISSP helps you choose between the two.

The newer specialty certifications: SecAI+ and SecOT+

• SecAI+ (CY0-001) launched February 17, 2026, as the first certification in what CompTIA calls its expansion series. Up to 60 questions, 60 minutes, passing score 600, in English and Japanese. Domains: basic AI concepts related to cybersecurity (17%), securing AI systems (40%), AI-assisted security (24%) and AI governance, risk and compliance (19%). CompTIA recommends Security+, CySA+, PenTest+ or equivalent knowledge first (CompTIA). Our AI security certifications guide compares it with ISACA, GIAC and IAPP options.
• SecOT+ (SOT-001) covers operational technology in manufacturing and critical infrastructure: OT safety, risk management, threat intelligence, OT architecture, security operations and incident management. It was pre-order only on November 11, 2026. The page says it is scheduled to launch “on or around December 8, 2026,” while the exam details list a launch date of December 1, 2026, so confirm before you book. Question count and passing score are not published yet (CompTIA). See our OT security certifications guide for how it compares with GICSP.

Renewal: three years and continuing education units

CompTIA certifications in this path renew on a three-year cycle. You earn continuing education units (CEUs) through activities completed during the cycle, and at least 50% of a course’s content must relate to the exam objectives of the certification you are renewing. The CEU requirement grows with the level: 20 for A+, 30 for Network+, 50 for Security+, 60 for CySA+ and PenTest+, 75 for SecurityX and 15 for SecAI+ (CompTIA).

DoD 8140 and the CompTIA path

CompTIA lists DoD 8140 work roles on several certification pages. Security+ V7 maps to roles including cyber defense analyst, incident responder, vulnerability analyst, security control assessor and system administrator (CompTIA). Network+ maps to technical support specialist, network operations specialist and system administrator (CompTIA), and SecurityX to security architect, systems requirements planner and security control assessor (CompTIA). Our DoD 8140 certifications guide and IAT and IAM levels guide explain how those roles and levels work.

CompTIA certification cost: who pays

CompTIA publishes current exam voucher prices in the Buy Now section of each certification page, for example Security+ V7 and SecurityX. Prices vary by country. CompTIA also sells bundles that pair CertMaster training with a voucher and Retake Assurance, which includes a second attempt if you need it.

• Your employer. Ask whether your employer pays for certifications tied to your role before you buy a voucher.
• DoD 8140 programs. Service members, DoD civilians and contractors in covered roles should ask their command or contract lead how certification is funded.
• Schools and training programs. Some college courses and workforce programs include a voucher; ask before you buy one separately.

Compare total costs in our certification cost calculator and cheapest cybersecurity certifications list.

How CompTIA fits with ISC2, GIAC and other cert bodies

CompTIA certifications count toward other paths. ISC2’s approved list, which can waive one year of the five years of CISSP experience, includes Security+, CySA+, SecurityX and CASP+ (ISC2). Some people start with ISC2 Certified in Cybersecurity (CC) instead of Security+, and others compare Security+ with GIAC GSEC; our GIAC certifications guide maps the GIAC side. For the full picture across cert bodies, see our cybersecurity certification path and map.

CompTIA cybersecurity certification questions

Sources

• CompTIA, Certifications catalog
• CompTIA, A+
• CompTIA, A+ Core 1 and 2 V15
• CompTIA, Network+
• CompTIA, Security+
• CompTIA, Security+ V7
• CompTIA, Security+ V8
• CompTIA, CySA+
• CompTIA, CySA+ V4
• CompTIA, PenTest+
• CompTIA, SecurityX
• CompTIA, SecAI+
• CompTIA, SecOT+
• CompTIA, Earn Continuing Education Units
• ISC2, CISSP experience requirements

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.