CompTIA CySA+ CS0-003 vs CS0-004: Which to Book in 2026

Last updated September 2026

Free one-page guide

Which cert next

Networking, then Security+, then the cert the job actually names: SecurityX if you stay technical, CISSP over CISM when you want to lead, CCSP after CISSP for cloud, CEH when postings require it, plus where ISC2 CC and PMP fit. From CyberExperts.

Join the CyberExperts Daily Brief. The PDF shows up here after you subscribe.

CompTIA CySA+ V4 (CS0-004) launched June 23, 2026 and is the exam new candidates should plan for. CySA+ V3 (CS0-003) remains available in English until December 22, 2026. Study for CS0-004 unless you are already exam-ready on V3.

Security+ proves you know the language. CySA+ proves you can use it in a SOC: triage alerts, prioritize vulnerabilities, and communicate risk without drowning your manager in CVSS theater. If you are still deciding between the two, our Security+ vs CySA+ comparison lays out the differences.

If you are still choosing a first cert, start with How to Pass CompTIA Security+ in 2026. For the wider map, see Best Cybersecurity Certifications in 2026. Career changers should pair this with How to Transition to a Cybersecurity Career at Any Age. Management-track readers comparing depth later often look at CISSP without reading a shelf of books.

Is CySA+ your next step?

CySA+ fits people who already touch tickets, logs, or vulnerability queues and need a vendor-neutral analyst credential hiring managers recognize:

SOC analysts (Tier 1–2) who want a structured detection and response outline
Vulnerability or threat analysts who need to defend prioritization decisions
IT admins moving into security operations with Security+ (or equivalent) already in hand
Career changers who can show labs around SIEM, EDR and IR basics, and not only flashcards

CompTIA recommends roughly four years of hands-on SOC or vulnerability work. That is a recommendation, not a gate. What fails candidates is weak practice with analysis, not a missing birthday on a résumé.

CS0-004 at a glance

According to CompTIA’s CySA+ V4 page:

Exam code: CS0-004 (V4). V3 CS0-003 retires in English December 22, 2026.
Launch: June 23, 2026
Length: up to 85 questions, 165 minutes
Passing score: 750 on a 100–900 scale
Question types: multiple-choice and performance-based
Languages: English first; additional languages rolling out

Exam fees change and bundles vary. Check CompTIA’s checkout (or your employer voucher) the week you schedule. Do not trust a blog’s price from last quarter.

Where the CS0-004 points are

Official V4 domain weights:

Security Operations (34%). Architecture and logging that support detection; indicators across network, endpoint, cloud, and identity; SIEM/EDR/packet/threat-intel workflows; threat hunting concepts; automation/process improvement; AI use-cases and governance risks in the SOC.
Vulnerability Management (26%). Choosing scan methods, reading tool output, risk-based prioritization, and tying findings to controls and compliance language.
Incident Response and Management (24%). Attack frameworks (for example MITRE ATT&CK / kill chain thinking), IR phases, triage, evidence handling, containment, eradication, recovery, and root cause.
Reporting and Communication (16%). Dashboards and reports for vuln and IR audiences; metrics such as detection and remediation time; post-incident reviews stakeholders will actually read.

If you only memorize port numbers, you will hate the PBQs. CySA+ rewards people who can explain why this alert matters now.

CS0-003 or CS0-004?

New starters in fall 2026: study CS0-004. Training products and practice banks are catching up to V4, and you avoid a mid-prep exam retirement.

Already deep into CS0-003 materials: you can still sit V3 while English remains available (through December 22, 2026). Only do that if your practice scores are already exam-ready. Do not start a fresh V3 plan in October.

An eight-week, lab-first plan

Weeks 1–2: map the domains. Read CompTIA’s objectives once end-to-end. Build a one-page cheat sheet per domain in your own words.
Weeks 3–5: security operations reps. Live in a SIEM trial or open stack (even a home ELK/Wazuh lab). Practice writing the story: evidence → hypothesis → next action.
Weeks 4–6: vulnerability management. Run authenticated vs unauthenticated scans in a lab. Practice ranking findings with business context, not only CVSS.
Weeks 6–7: IR drills. Walk a ransomware-ish and a business-email-compromise tabletop. Write the containment steps as if your manager will paste them into Slack.
Week 8: practice exams and PBQs. Time yourself. Review every miss by objective ID. Stop when scores are stable, not when you finish a book.

Official CertMaster / CompTIA labs help if your employer pays. If not, a disciplined lab plus one solid practice bank beats three unread PDFs.

Practice like an analyst

Explain every PBQ out loud before clicking. If you cannot narrate the triage, you are guessing.
Keep a “false positive graveyard” notebook: why the alert looked real, what disproved it.
Rehearse short executive summaries. Domain 4 is not fluff; it is how analysts keep funding and trust.
Sleep before the exam. CySA+ is a long sit; fatigue creates silly misreads.

Where CySA+ fits

Security+ is the broad baseline. CySA+ is the analyst’s next step: detection, vuln prioritization and IR communication. CISSP is a different game: broader managerial scope and experience expectations. Many people do Security+ → CySA+ (or cloud/security specialty) → CISSP years later. Use the 2026 certs guide if you want the career framing as well as the exam outline. Heading toward offensive work instead? Compare PenTest+ and CEH. If networking is the gap, start with Network+. Further out, CompTIA SecurityX is the senior hands-on step, and CCSP fits if your detection work is mostly in the cloud. If your SOC runs on Microsoft Sentinel and Defender, Microsoft SC-200 pairs well with CySA+, and GIAC GSEC is a respected, pricier alternative foundation.

Once you know your lane, the certification roadmap shows what usually comes after CySA+.

Before you book

Pick CS0-004 unless you are already exam-ready on V3. Build a tiny lab you actually open three nights a week. Write short incident notes like a human, not a CVSS bot. Certifications get interviews; staying current is what keeps you useful once you have the job.

Alerts make more sense when you know what is happening outside your SOC. The CyberExperts Daily Brief covers what changed in security in five minutes, weekday mornings. Get tomorrow’s brief.

CySA+ FAQ

Is CySA+ harder than Security+?

For most people, yes. Not because of trivia, but because the PBQs expect analyst judgment. If Security+ felt comfortable, CySA+ is the natural stretch.

How long is CS0-004, and what score passes?

Up to 85 questions in 165 minutes. You need 750 on a 100–900 scale.

Do I need Security+ before CySA+?

Not strictly. CompTIA recommends Security+/Network+ level knowledge. If you already work a SOC queue, you can go straight to CySA+; if terms like SIEM and CVE still blur, earn the baseline first.

How long is CySA+ valid?

CompTIA certifications typically run on a three-year renewal cycle via continuing education or retake. Confirm your cert’s renewal rules in your CompTIA account after you pass.

Will CS0-003 study materials still help for CS0-004?

Core analyst skills transfer. Domain weights and the AI and cloud SOC emphasis differ on V4, so use the CS0-004 objectives as your checklist and treat V3 books as secondary.

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.