For almost everyone, Security+ comes first and CySA+ comes second. Security+ is the broad foundation — it proves you understand how attacks, defences and security programs fit together. CySA+ is the analyst step after it: it assumes that foundation and tests whether you can actually spot, investigate and respond to threats in a security operations center (SOC).
Below is a plain-English comparison of the two CompTIA exams as they stand in November 2026, including the Security+ version change happening this month, so you can decide which one to book.
What is the difference between Security+ and CySA+?
Think of Security+ as “know the whole field” and CySA+ as “do the analyst job.”
- Security+ covers general security concepts, threats and vulnerabilities, security architecture, security operations, and security program management. It is wide on purpose. Many employers and government contracts list it as the baseline security certification.
- CySA+ (Cybersecurity Analyst) narrows in on four areas: security operations, vulnerability management, incident response, and reporting and communication. It is built around the daily work of a SOC or vulnerability analyst — reading logs, prioritising vulnerabilities, and handling incidents.
Security+ vs. CySA+ at a glance
| CompTIA Security+ | CompTIA CySA+ | |
|---|---|---|
| Current exam | SY0-701 (V7); SY0-801 (V8) launches November 17, 2026 | CS0-004 (V4), launched June 2026 |
| Questions and time | Up to 90 questions, 90 minutes | Up to 85 questions, 165 minutes |
| Passing score | 750 (scale 100–900) | 750 (scale 100–900) |
| Recommended experience | Network+ and about two years in a security or systems administrator role | About four years in a SOC analyst or vulnerability analyst role |
| Focus | Broad security foundation | Hands-on threat detection, vulnerability management and incident response |
| Typical job titles | Security administrator, systems administrator, junior security analyst | SOC analyst, threat analyst, vulnerability analyst, incident responder |
Exam facts are from CompTIA’s Security+ and CySA+ pages. CompTIA’s experience levels are recommendations, not requirements — you can book either exam without them.
Which should you take first?
Take Security+ first if you are new to security, moving across from help desk or networking, or need a certification that clears HR filters and government job requirements. CySA+ questions assume you already know the Security+ material, so skipping it usually makes CySA+ harder, not faster.
Consider going straight to CySA+ only if you already work in a SOC or security role, handle alerts and vulnerability scans every week, and your employer specifically wants the analyst certification. Even then, most of our CySA+ students already hold Security+.
And if networking still feels shaky, step back one more: CompTIA Network+ first makes both exams far easier. We cover the beginner order in more detail in Is Cybersecurity Hard?
Is CySA+ harder than Security+?
Yes, for most people. CySA+ gives you almost twice the time (165 minutes versus 90), and it needs it: more of the questions are scenario-based, asking you to read log output, judge which vulnerability to fix first, or choose the next step in an incident. Security+ asks “what is this and why does it matter?” CySA+ asks “here is what happened — what do you do?”
Should you wait for the new Security+ (SY0-801)?
CompTIA’s Security+ V8 exam, SY0-801, launches on November 17, 2026. Its updated outline adds more on AI-related security risks. The current SY0-701 exam stays available in English until June 2027, and both versions lead to the same Security+ certification.
Our advice: if you are already studying for SY0-701, finish and sit it — your preparation is not wasted, and switching mid-study only adds work. If you are starting from scratch in 2027, plan for SY0-801.
How long does each one take to prepare for?
| Path | Typical time |
|---|---|
| Security+ self-study | 3–6 months part time |
| Security+ instructor-led course | 5 days of class, plus your own review |
| CySA+ self-study (after Security+) | 2–4 months part time, with lab practice |
| CySA+ instructor-led course | 5 days of class, plus your own review |
Our CompTIA Security+ course and CompTIA CySA+ (CS0-004) course each run five days, live online or in class, with an exam voucher available as an add-on. Many students take them a few months apart: Security+, some time on the job, then CySA+.
Where do these two lead?
Security+ and CySA+ are the first two steps of CompTIA’s defensive security track. After them, people usually branch: PenTest+ for the offensive side, or SecurityX (formerly CASP+) for senior architecture roles. For the full ladder, including non-CompTIA options, see our guide to the best cybersecurity certifications in 2026 or browse the cyber security training range.
Frequently asked questions
Do I need Security+ before CySA+?
No, it is not a formal requirement. CompTIA recommends it, though, and CySA+ assumes you already know the Security+ material, so most people take Security+ first.
Is CySA+ harder than Security+?
For most people, yes. CySA+ is more scenario-based and hands-on, with up to 85 questions in 165 minutes, while Security+ is broader and more conceptual.
Which pays more, Security+ or CySA+?
CySA+ is usually held by people in analyst roles, which tend to pay more than entry-level security roles. The higher pay comes mostly from the job and experience, not the certificate alone.
Should I take SY0-701 or wait for SY0-801?
If you are already studying for SY0-701, sit it. It remains available in English until June 2027 and earns the same Security+ certification. New starters in 2027 should plan for SY0-801.
Can I get a job with only CySA+?
It is possible, but CySA+ is designed for people who already have security or IT experience. Employers hiring analysts usually expect hands-on experience alongside it.
How long is the CySA+ course at The Academy?
Five days, live online or in class, with an exam voucher available as an add-on.
Written by The Academy, Miami and Fort Lauderdale. Last updated November 2026.
