Cybersecurity Certification Path: A 2026 Roadmap by Career Goal

By Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3   Published: 10/25/23   Updated: 10/12/26   13 min read
Cyber Security Careers

Last updated September 2026

Free one-page guide

Which cert next

Networking, then Security+, then the cert the job actually names: SecurityX if you stay technical, CISSP over CISM when you want to lead, CCSP after CISSP for cloud, CEH when postings require it, plus where ISC2 CC and PMP fit. From CyberExperts.
Join the CyberExperts Daily Brief, the same Beehiiv signup already on this site. The PDF shows up here after you subscribe.

This roadmap replaces our older certifications-path article. Exam versions, prices and experience requirements below were checked against the vendors’ own pages in September 2026. Two changes to plan around: CompTIA expects Security+ V8 to launch on or around November 17, 2026, and Microsoft retired its Azure Security Engineer Associate certification on August 31, 2026; its replacement is the Cloud and AI Security Engineer Associate (exam SC-500).

There is no single “right” cybersecurity certification path. There is a right order for the job you want next. A SOC analyst, a penetration tester, a cloud security engineer and a future CISO all start in roughly the same place, then split. The mistake most people make is collecting whatever cert is popular this year instead of the one that moves them one step closer to a specific role.

This roadmap lays out five paths by goal: beginner or career changer, SOC and defense, offensive security, cloud, and management. Each one is an ordered list with a one-line reason, the experience the vendor recommends, and what the exam costs. Where we have a full guide, it’s linked. If you want a ranked list rather than a path, see Best Cybersecurity Certifications in 2026.

How to use this roadmap

Path 1: Beginner or career changer

Goal: get hired into a first IT or junior security role. If you’re coming from another field, read How to Transition to a Cybersecurity Career at Any Age first.

  1. CompTIA Network+: nearly everything in security sits on networking. CompTIA recommends A+ plus 9 to 12 months in a junior network role. $399 exam (US retail since June 2026). Skip it if you already work with networks daily. Heading into network engineering? Cisco CCNA goes deeper.
  2. CompTIA Security+: the vendor-neutral baseline many employers and DoD 8140 work roles look for. CompTIA recommends Network+ and two years in a security or systems admin role. $439 exam.
  3. Optional: ISC2 Certified in Cybersecurity (CC): an entry-level exam from the organization behind CISSP. ISC2 says no experience is needed (more entry-level certifications for beginners). $199 exam (ISC2’s free One Million Certified in Cybersecurity program closed to new enrollments on May 20, 2026). Useful as a low-cost first step, but it doesn’t replace Security+ in most job posts. With no IT background at all, the Google Cybersecurity Certificate is another structured starting point.
  4. Then pick a lane from the paths below. Don’t stack more entry-level certs.

Path 2: SOC analyst and defender (blue team)

Goal: detect, triage and respond to incidents, then grow into senior analyst, threat hunter or security engineer.

  1. Security+: vocabulary and baseline. $439.
  2. CompTIA CySA+: the analyst cert, focused on security operations, vulnerability management, incident response and reporting. The current CS0-004 exam launched June 23, 2026. CompTIA recommends about four years in a SOC or vulnerability analyst role. $439. Not sure whether to start here or with Security+? Read how Security+ and CySA+ compare. In Microsoft Sentinel and Defender shops, Microsoft SC-200 ($165) is a practical add-on, and GIAC GSEC is a pricier, respected alternative baseline.
  3. Later: CompTIA SecurityX or CISSP: SecurityX (formerly CASP+) if you want to stay hands-on as a senior engineer or architect; CISSP if you’re moving toward leading a program. CompTIA recommends 10 years of IT experience, including 5 hands-on in security, for SecurityX. CISSP requires 5 years of paid experience.

Path 3: Offensive security and penetration testing (red team)

Goal: find and exploit weaknesses legally, write reports clients act on, and grow into senior tester or red teamer.

  1. Network+ and Security+: CompTIA lists both (or equivalent knowledge) as recommended experience for PenTest+.
  2. CompTIA PenTest+ or EC-Council CEH: PenTest+ (PT0-003) mixes multiple-choice with performance-based questions and covers planning, recon, attacks and reporting; CompTIA recommends 3 to 4 years in a pentest role. $439. CEH v13 is 125 multiple-choice questions in four hours; you need official training or two years of security experience plus a $100 application fee. A remote-proctored CEH voucher is $950 in EC-Council’s store. Pick based on which one your target employers or contracts ask for.
  3. OffSec OSCP+: the hands-on benchmark. The exam is a 24-hour proctored practical against live machines, including an Active Directory set. OffSec lists the standalone exam at $1,699 and the PEN-200 course from $1,749. OSCP+ must be renewed every three years.

Path 4: Cloud security

Goal: secure workloads in AWS, Google Cloud or Azure as a cloud security engineer or architect.

  1. Security+: the general security baseline cloud certs assume.
  2. A vendor cert for the platform you actually use. AWS Certified Security – Specialty: 65 questions in 170 minutes, $300, and AWS recommends five years of IT security experience plus two years securing AWS workloads. Google Professional Cloud Security Engineer: 50 to 60 questions in two hours, $200, with 3+ years of industry experience including a year on Google Cloud recommended. For Azure, note that Microsoft retired the Azure Security Engineer Associate certification on August 31, 2026, and replaced it with the Cloud and AI Security Engineer Associate (exam SC-500), available since July 21, 2026. For Microsoft security operations roles, see our SC-200 guide.
  3. ISC2 CCSP: the vendor-neutral cloud security credential. It requires five years of IT experience, including three in security and one in a CCSP domain; an active CISSP satisfies the whole requirement. $599 exam.

Path 5: Management and leadership

Goal: run a security program as a manager, director or CISO.

  1. Security+ (or equivalent experience): leaders still need the technical baseline.
  2. ISC2 CISSP: ISC2 calls it the most globally recognized certification in the information security market. It requires five years of cumulative, full-time experience in at least two of eight domains; a degree or an approved cert can cover one year. You can pass first and become an Associate of ISC2 while you earn the experience. The exam is adaptive: 100 to 150 items in three hours. $749. If your first attempt doesn’t go your way, here’s how to work out why and pass on the retake.
  3. ISACA CISM: governance, risk, program management and incident management. ISACA requires five years of information security management experience within the 10 years before you apply; you can take the exam first and apply within five years. $575 for ISACA members, $760 for non-members, plus a $50 application fee. If your path is audit rather than management, ISACA CISA is the audit counterpart.
  4. Optional: CCSP if your organization is mostly in the cloud, or SecurityX if you want a hands-on senior technical credential rather than a management one.

From Donald: I earned ITIL, PMP, CASP (now CompTIA SecurityX) and CISSP, in that order. I did them in order from easier to harder, and I would do it again this way, because one prepares you for the next. ITIL preps you for CISSP, and CASP preps you for CISSP.

Cybersecurity certification comparison (2026)

CertificationBest forLevelExperience (vendor guidance)Exam cost (US)Our guide
ISC2 CCAbsolute beginnersEntryNone required$199CC guide · Practice
CompTIA Network+ (N10-009)Networking foundationEntryA+ plus 9–12 months (recommended)$399Network+ guide · Practice
CompTIA Security+ (SY0-701)Security baselineEntryNetwork+ plus 2 years (recommended)$439Security+ guide · Practice
CompTIA CySA+ (CS0-004)SOC analystsIntermediateAbout 4 years (recommended)$439CySA+ guide
CompTIA PenTest+ (PT0-003)PentestersIntermediate3–4 years (recommended)$439PenTest+ guide
EC-Council CEH v13Pentesters, compliance-driven rolesIntermediateOfficial training, or 2 years plus $100 application$950 remote voucherCEH guide · Practice
OffSec OSCP+Hands-on pentestersAdvancedNot stated here; PEN-200 is the prep course$1,699 examOSCP guide
AWS Certified Security – SpecialtyAWS security engineersAdvanced5 years IT security plus 2 years AWS (recommended)$300AWS Security Specialty guide
Google Professional Cloud Security EngineerGoogle Cloud security engineersAdvanced3+ years incl. 1 on Google Cloud (recommended)$200—
ISC2 CCSPCloud security architectsAdvanced5 years IT incl. 3 security (required)$599CCSP guide · Practice
CompTIA SecurityX (CAS-005)Senior engineers and architectsAdvanced10 years IT incl. 5 security (recommended)$544SecurityX guide · Practice
ISC2 CISSPSenior generalists, managersAdvanced5 years in 2+ domains (required)$749CISSP guide · Practice
ISACA CISMSecurity managersAdvanced5 years security management (required)$575 member / $760 non-memberCISM guide · Practice

CompTIA prices are US retail after the June 2026 increase, as published by authorized CompTIA partner Total Seminars; the other prices come from each vendor’s site. Prices change and vary by country, so confirm at checkout.

To budget a whole path, plug the certifications you are considering into our cybersecurity certification cost calculator, which totals exam and renewal fees over the years you choose.

Common mistakes on the certification path

Where to start this week

If you’re new: book time for Network+ or Security+ and build a small home lab. If you’re already in a SOC: CySA+. If you want to break things for a living: PenTest+ or CEH, then OSCP+. If you already have five years in: CISSP or CISM, depending on whether you want to lead programs or govern them. Whatever you pick, keep a running list of what you built and learned along the way. That list wins interviews more often than the cert does.

Your cert path takes years. Attackers change tactics every week. The CyberExperts Daily Brief keeps you current while you study, in five minutes each weekday morning. Get tomorrow’s brief.

Frequently asked questions

What is the best cybersecurity certification path for beginners?

For most people: Network+ (skip it if you already work with networks), then Security+, then a specialty cert matched to the job you want, such as CySA+ for SOC work or PenTest+ for offensive work. ISC2’s Certified in Cybersecurity (CC) is a low-cost optional first step with no experience requirement.

Which certification should I get after Security+?

It depends on your goal. CySA+ for SOC and analyst roles, PenTest+ or CEH for penetration testing, a cloud vendor security cert or CCSP for cloud security, and CISSP or CISM once you have the years of experience they require.

Can I get CISSP with no experience?

You can take and pass the exam, but you won’t be a CISSP until you have five years of cumulative, full-time experience in at least two of the eight domains. A degree or an approved certification can cover one year. If you pass early, you become an Associate of ISC2 and have six years to earn the experience.

Is CEH or PenTest+ better?

Both are intermediate offensive-security certs. PenTest+ includes performance-based questions and costs $439; CEH v13 is 125 multiple-choice questions and requires official training or two years of experience plus an application fee. Pick the one your target employers ask for, and plan on OSCP+ if you want the hands-on benchmark.

What certifications do I need for cloud security?

Start with Security+, add the security certification for the cloud you use (AWS Certified Security – Specialty or Google Professional Cloud Security Engineer), then consider ISC2’s CCSP. Microsoft retired its Azure Security Engineer Associate certification on August 31, 2026; its replacement is the Cloud and AI Security Engineer Associate (exam SC-500).

CISSP or CISM for management?

CISSP is broader and more technical across eight domains; CISM focuses on governance, risk, program management and incident management. Both require five years of experience. Many security leaders eventually hold both.

What happened to CASP+?

CompTIA renamed CASP+ to CompTIA SecurityX when it launched the CAS-005 exam in December 2024. Existing CASP+ holders kept their certification, and the older CAS-004 exam retired June 17, 2025.

Sources

Stay Current

Newer CyberExperts coverage on this topic

This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.

Latest Daily Brief

Tuesday’s brief: GitLab’s critical fix, then Patch Tuesday, hijacked fridge controllers and Server 2012’s last update

The fastest way to catch up on what changed after this article was published.

Read Today's Brief

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.