SecurityX (CASP+) vs CISSP: Who CAS-005 Is Built For

Last updated September 2026

SecurityX is the cert for security engineers who want to stay engineers. It’s CompTIA’s top cybersecurity certification, aimed at security architects and senior engineers, and unlike CISSP or CISM it’s a hands-on technical exam with performance-based questions. There’s no experience you have to document to hold it.

If the name is new to you, it’s the certification formerly known as CASP+. CompTIA renamed it when the V5 exam, CAS-005, launched on December 17, 2024, and existing CASP+ holders kept their status. CAS-004 retired on June 17, 2025. CompTIA estimates CAS-005 will retire in 2027 and hasn’t announced a successor date on its SecurityX page.

SecurityX or CISSP?

This is the comparison everyone asks about, and the honest answer is that they measure different things. CISSP is broader, more managerial and more often named in senior job postings, and it requires five years of verified experience. SecurityX tests whether you can design and build: architecture, engineering, automation and cryptography, with performance-based questions and pass/fail scoring. If you want to lead a program, CISSP. If you want to keep building, SecurityX. Plenty of senior people end up with both.

Donald Korinchak holds both and compared the exams from experience, back when SecurityX was still CASP, in CASP vs. CISSP: My Experience.

From Donald: SecurityX is the more technical exam. CISSP has that too, but it is also managerial. When I took CASP, before it became SecurityX, my exam opened with about seven simulations: building networks, using Linux commands to complete tasks and matching terms. CASP is for the technical folks who are in the weeds and know how to do the work.

Who it’s built for

• Senior security engineers who design and implement controls, not just operate them
• Security architects working across cloud, on-premises and hybrid environments
• Experienced CySA+ or PenTest+ holders who want to go up a level without moving into management
• DoD and contractor staff whose work roles list SecurityX (CompTIA maps it to roles such as security architect and security control assessor)

CompTIA recommends at least 10 years of general hands-on IT experience, including 5 years of hands-on security, plus Network+, Security+, CySA+, Cloud+ and PenTest+ or equivalent knowledge (CompTIA). It isn’t an eligibility gate, but the exam is written for people with that background. If you’re early in your career, it isn’t your next cert.

CAS-005 exam facts

Sources: CompTIA’s SecurityX page, the CompTIA store voucher listing, and CompTIA’s continuing education pages on CEUs and fees. Prices vary by country and change, so confirm at checkout.

Four domains, weighted toward engineering

Security engineering is the biggest domain at 31%, and it’s where the performance-based questions tend to bite. Domain list and weights: CompTIA SecurityX exam details.

How experienced engineers still fail it

• Treating it as a vocabulary test. The performance-based questions ask you to configure, analyze or choose under constraints. People who have built these systems pass them; memorizers don’t.
• Being strong in one domain and hoping. Many candidates work mostly in architecture or mostly in operations. With pass/fail scoring and no numeric score to chase, a weak domain is a real risk.
• Skimming the crypto. Engineering includes PKI, key management and post-quantum cryptography. It’s easy to under-prepare if your day job doesn’t touch it.
• Ignoring GRC. Governance, risk and compliance is 20%. Engineers often treat it as the boring part and pay for it.

Twelve weeks, building something every week

This plan assumes about eight hours a week and several years of hands-on security work. Every week includes lab time, because that’s what the exam rewards.

• Weeks 1 to 2: objectives and gaps. Download the CAS-005 objectives and rate yourself on every bullet. Most candidates are strong in one or two domains and weak in the rest; plan around the weak ones.
• Weeks 3 to 5: security architecture. Cloud security (CASB, shared responsibility, container and serverless security), segmentation, SASE and zero trust. Build a small cloud or lab environment and apply the controls yourself.
• Weeks 6 to 8: security engineering. Write small automation scripts in PowerShell, Bash or Python; practice infrastructure as code; review PKI, post-quantum cryptography, key management and cryptographic use cases. This is 31% of the exam.
• Weeks 9 to 10: security operations. SIEM tuning and correlation, threat hunting with Sigma and YARA, incident response and basic malware analysis in a sandbox.
• Week 11: governance, risk and compliance. Frameworks, risk analysis (quantitative vs qualitative), third-party risk and threat modeling with ATT&CK and STRIDE.
• Week 12: timed practice. Full-length practice exams with performance-based questions under the 165-minute limit. Because scoring is pass/fail, aim for comfortable margins across all four domains.

Price and renewal

• Exam voucher: $544 on CompTIA’s U.S. online store as of September 26, 2026 (CompTIA store). The store also sells a voucher with Retake Assurance for $709.
• Discounts: Authorized partners resell vouchers, often below retail, and CompTIA offers academic pricing to eligible students.
• Training: Optional. CompTIA sells CertMaster Perform, Practice and Labs; many experienced engineers pass with the official objectives, one good book or video course, a lab and a practice bank.
• Renewal: SecurityX is valid for three years. To renew with continuing education, earn 75 CEUs and pay $150 in CE fees during the cycle (CEUs, fees). You can also renew by passing the latest version of the exam or completing CompTIA’s CertMaster CE course. When you renew SecurityX, CompTIA also renews the lower-level CompTIA certifications it covers without extra CE fees.

Where SecurityX counts in hiring

Where job postings or contracts name it, and where a hiring manager wants an advanced credential that tests hands-on skill rather than management knowledge. SecurityX maps to NICE and DoD 8140 work roles including security architect, systems requirements planner, security control assessor, and research and development specialist (CompTIA). Outside those settings, CISSP is more often named in senior job postings, which is why many engineers pair the two.

There’s no government pay data by certification. As a reference point, it reports May 2025 median pay of $129,180 for information security analysts, with 21% projected employment growth from 2025 to 2035 (BLS), and $134,050 for computer network architects (BLS).

More comparisons: CISM, CCSP, CySA+ and OSCP

• SecurityX vs CISSP: CISSP is broader, more managerial, and more often named in senior job postings, and it requires five years of verified experience. SecurityX is hands-on, with performance-based questions and no documented experience requirement. Donald Korinchak compares the two from experience in CASP vs. CISSP: My Experience.
• SecurityX vs CISM: CISM is ISACA’s management certification. SecurityX is the technical path for people who want to keep building.
• SecurityX vs CCSP: CCSP goes deeper on cloud security plus legal and compliance topics. SecurityX covers cloud as part of wider enterprise architecture. For platform-specific depth, pair it with AWS Certified Security – Specialty.
• SecurityX vs CySA+ and PenTest+: CySA+ and PenTest+ are the intermediate CompTIA steps for defensive and offensive work. SecurityX sits above both, and CompTIA recommends equivalent knowledge of them before you attempt it. For Microsoft SOC roles, Microsoft SC-200 is a vendor-specific alternative.
• Hands-on offense: If you want to prove you can compromise systems, OSCP is the practical exam to look at instead.

Deciding between the senior technical and management tracks? The certification roadmap shows both.

Architecture decisions last years. Attack techniques change weekly. Designs look different once you’ve seen how attackers get around them. The CyberExperts Daily Brief covers what changed in security in five minutes, every weekday morning. Get tomorrow’s brief.

SecurityX FAQ

Sources

• CompTIA, SecurityX certification and CAS-005 exam details: comptia.org
• CompTIA, SecurityX voucher (U.S. store price): shop.comptia.org
• CompTIA, Earn continuing education units (CEU requirements): comptia.org
• CompTIA, Continuing education renewal fees: comptia.org
• BLS, Information security analysts: bls.gov
• BLS, Computer network architects: bls.gov

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.