Security+ and CySA+ are not two grades of the same certification. They describe two different jobs. Security+ covers the core security skills most technical roles need. CySA+ is for the person who watches, investigates and responds. This guide compares what CompTIA actually publishes about both — exam length, recommended experience, and the version changes happening right now — so you can pick the one that matches your work. Checked against CompTIA’s certification pages on October 13, 2026.
Understand the difference
What each certification is about
Security+ is breadth. It is the certification that says you understand how security is applied across systems and networks, and that you can work safely inside an organisation’s controls. CompTIA recommends CompTIA Network+ and about two years of experience in a security or systems administrator job role.
CySA+ is depth in one direction: detection and response. CompTIA describes it as validating your ability to detect, analyse and respond to cybersecurity threats. For the current version it recommends about four years in a SOC analyst or vulnerability analyst role.
The practical difference: Security+ asks whether you know how to protect a system. CySA+ asks what you do when something looks wrong.
Understand the difference
The exams side by side
| Security+ | CySA+ | |
|---|---|---|
| Current version | V7 | V4 |
| Exam code | SY0-701 | CS0-004 |
| Questions | Maximum of 90, multiple-choice and performance-based | Maximum of 85 |
| Duration | 90 minutes | 165 minutes |
| Passing score | 750 on a scale of 100–900 | 750 on a scale of 100–900 |
| Recommended experience | Network+ and about two years in a security or systems administrator role | About four years in a SOC analyst or vulnerability analyst role |
| Languages | English, Japanese, Portuguese, Spanish, Thai | English, with French, Japanese, Spanish and Portuguese coming soon |
Two things stand out. CySA+ gives you 165 minutes for 85 questions; Security+ gives you 90 minutes for 90. That is not a rounding difference — it tells you to expect questions you work through rather than recall. And the recommended experience gap is roughly double: two years against about four. That is CompTIA’s own framing of the distance between them.
Work out the order
Do you need Security+ before CySA+?
No — CompTIA does not require it. Neither certification has a mandatory prerequisite, and you can book either exam today.
But CompTIA’s recommendation for the previous CySA+ version was explicit: Network+, Security+ or equivalent knowledge, with a minimum of four years of hands-on experience as an incident response analyst, SOC analyst or equivalent. That is the clearest published statement that Security+ sits earlier on the path.
The honest reading: Security+ is not a gate, it is a foundation. People do pass CySA+ without it. They tend to be people who already do the job, and who already know what Security+ would have taught them.
Work out the order
Which exam is harder?
CompTIA does not publish a difficulty ranking, and it does not publish pass rates for either exam. Anyone quoting you a precise difficulty figure is not getting it from CompTIA.
What CompTIA does publish supports a reasonable conclusion:
- CySA+ recommends roughly twice the experience.
- CySA+ allows 165 minutes rather than 90.
- CySA+ is scoped to one specialism rather than a broad survey.
Longer exam, deeper scope, more experience recommended. For most people CySA+ will be the harder sit — but it is harder in a specific way. It is not “more of Security+”. If analysis is not your day job, extra study time alone may not close the gap.
Pick your path
If you have no security certification yet
Start with Security+. Not because CySA+ is off limits, but because Security+ gives you the vocabulary and the mental model that CySA+ assumes you already have. Sitting CySA+ first means learning the foundations and the specialism at once, in a 165-minute exam that expects you to apply both.
There is a practical argument too. Security+ appears as a baseline requirement in far more job adverts than CySA+, so it tends to open more doors earlier.
If you are not yet comfortable with networking fundamentals, look earlier still: our A+ vs Network+ guide (opens in a new tab) covers that decision.
Pick your path
If you already hold Security+
Then the question is whether CySA+ is the right next step — and that depends on direction, not level.
CySA+ fits if you are moving towards a security operations centre, detection work, threat hunting, incident response or vulnerability management. It is the natural continuation of Security+ along the analyst path.
CySA+ may not fit if your direction is cloud security, penetration testing, security architecture or governance. Those are different branches. Choosing CySA+ because it looks like “the next one up” is the most common way people pay for a certification they never use.
Be honest about the experience gap. If you passed Security+ recently and do not yet work in analysis, CompTIA’s recommendation of about four years in the role is a real signal. It does not stop you booking — it tells you how much ground you are covering on your own.
Pick your path
Version timing matters right now
This is the part most comparisons leave out, because it changes. As of October 13, 2026, both certifications are mid-transition.
Security+ is about to change version
| Current | V7 — SY0-701, launched November 7, 2023 |
|---|---|
| Next | V8 — SY0-801, launching November 17, 2026 |
| V7 retires (English) | June 11, 2027 |
CompTIA says V8 brings expanded coverage of areas such as AI-related risks, and that it is available in English at launch. V7 stays bookable in English until June 2027, so there is no cliff edge.
What this means for you. If you are ready to sit Security+ in the next few weeks, V7 is a legitimate choice and stays valid long after you pass — a certification does not expire because a new exam version appears. If you are months away from ready, you will likely be preparing for V8 anyway, and studying V7 material late in its life risks learning to a syllabus you will not sit.
CySA+ has already changed version
| Current | V4 — CS0-004, launched June 23, 2026 |
|---|---|
| Previous | V3 — CS0-003, launched June 6, 2023 |
| V3 retires (English) | December 22, 2026 |
CompTIA is clear that V4 is the version to choose for the most up-to-date skills and content. V3 remains available in English until December 22, 2026, with Japanese, Portuguese and Spanish following on March 23, 2027.
What this means for you. If you are choosing CySA+ today and are not already deep into V3 study, V4 is the sensible target. If you are booking a V3 sit, that English retirement date is close enough to matter — check it against your own readiness before you commit.
Check the exam code before you book, and before you buy anything. Exam vouchers are usually tied to one specific exam code, and a voucher for one version does not automatically work for another.
Pick your path
Which jobs line up with each
CompTIA lists the work roles each certification maps to. Security+ V7 maps to roles including cyber defence analyst, incident responder, vulnerability analyst, security control assessor, system administrator, network specialist and information security manager. CySA+ V3 maps to roles including all-source analyst, forensics analyst, cyber crime investigator, systems security analyst, cyber defence incident responder and vulnerability assessment analyst.
Notice the overlap at the analyst end — and notice that Security+ also reaches into administration and management roles that CySA+ does not. That is breadth against depth again.
We do not publish salary figures or hiring statistics for either certification. Those numbers vary by country, employer and year, and the ones circulating online are rarely traceable to a source worth repeating.
Decide
How to decide, in four questions
- What does your current work look like? Mostly building, configuring and administering points to Security+. Mostly watching, investigating and responding points to CySA+.
- What is the next job you want? Choose the certification that matches the job description you are aiming at, not the one that sounds more advanced.
- How close are you to the recommended experience? About two years for Security+, about four for CySA+. A large gap is not a block, but it is study time you should plan for.
- When will you actually be ready to sit it? With V8 arriving on November 17, 2026 and CySA+ V3 retiring on December 22, 2026, your timeline affects which version you should be studying.
If the first two questions disagree, follow the second. You are certifying for where you are going.
Decide
What CompTIA does not tell you
- No pass rates. CompTIA does not publish them for either exam.
- No difficulty score. The comparison above is inference from duration, scope and recommended experience — reasonable, but not a published ranking.
- No prices here. Exam prices vary by country and change; check CompTIA or your test provider for the current figure where you live.
- Recommended experience is a recommendation. It is not enforced when you book.
Verify anything time-sensitive, especially version dates, against CompTIA’s certification pages before you book.
Reference
Frequently asked questions
Is CySA+ higher than Security+?
It is more specialised rather than simply higher. CompTIA recommends about four years of analyst experience for CySA+ against about two years in a security or systems administrator role for Security+. CySA+ goes deeper into detection and response; Security+ covers more ground.
Can I take CySA+ without Security+?
Yes. Neither exam has a mandatory prerequisite. CompTIA’s recommended experience for the previous CySA+ version did list Security+ or equivalent knowledge, so most people find it easier with that foundation in place.
Which exam is longer?
CySA+ — 165 minutes for a maximum of 85 questions, against 90 minutes for a maximum of 90 questions on Security+.
What is the passing score for each?
Both use 750 on a scale of 100 to 900.
Should I wait for Security+ V8?
It depends on when you will be ready. V8 (SY0-801) launches on November 17, 2026, and V7 (SY0-701) stays available in English until June 11, 2027. If you are sitting the exam soon, V7 is fine and your certification stays valid. If you are months away, prepare for V8.
Is CySA+ CS0-003 still worth taking?
CompTIA retires CS0-003 in English on December 22, 2026 and recommends V4 (CS0-004) for the most current content. If you are starting now, target V4.
Do I need both?
No. Many people hold Security+ and stop there, or move to a different specialism. CySA+ earns its place only if analysis is the direction you want.
Reference
Sources
All checked October 13, 2026:
- CompTIA — Security+ certification
- CompTIA — Security+ V7 (SY0-701) exam details
- CompTIA — Security+ V8 (SY0-801) exam details
- CompTIA — CySA+ certification
- CompTIA — CySA+ V4 (CS0-004) exam details
- CompTIA — CySA+ V3 (CS0-003) exam details
If Security+ is your choice, our guide on passing Security+ on your first attempt (opens in a new tab) covers preparation. If you are weighing which CompTIA exam to book, see choosing the right CompTIA exam voucher (opens in a new tab).
Article record
- Dates
