Take Security+ first, then CySA+. CompTIA publishes that order itself. CySA+ certifies a different job, the analyst in a security operations center who reads what the defenses are reporting and decides what happens next.
If you are asking whether you can skip Security+ and go straight to CySA+, the answer is yes, and it is rarely the right call. CompTIA says almost exactly that.
Can You Take CySA+ Without Security+?
Yes. Neither exam has a prerequisite. CompTIA publishes recommendations, never requirements: Security+ (SY0-701) recommends Network+ and two years in a security or systems administrator role, and CySA+ (CS0-004) recommends about four years in a SOC analyst or vulnerability analyst role. Nobody checks either number when you book a seat.
CompTIA’s own answer to the skip question:
You can take CompTIA CySA+ without first earning Security+, but it is generally not recommended unless you already have substantial cybersecurity experience. You need to know how a network works (CompTIA Network+) and how to secure it (CompTIA Security+) before you can analyze it (CompTIA CySA+).
The progression it publishes runs Network+, then Security+, then CySA+, then advanced cybersecurity specializations. The full CompTIA certification path covers where the rest of the catalogue sits.
The candidates who should skip are the ones CompTIA describes: people who already have substantial cybersecurity experience. If you have been triaging alerts and running vulnerability scans for years, Security+ will spend 28% of its exam on the security operations you already do daily. CySA+ tests the job itself. Book CySA+ and move on.
Skip Security+ without that experience and you meet the gap inside the CySA+ exam instead of the Security+ one. CySA+ assumes you already understand the controls you are being asked to monitor. If you are still weighing Network+ against Security+ as a starting point, CySA+ is two decisions away.
What Is the Difference Between CySA+ and Security+?
CompTIA draws the line itself: “Security+ validates that candidates understand cybersecurity concepts. CySA+ validates that candidates can actively apply those concepts in operational environments.”
The domain weights show the same split. Security+ spreads across five domains: General Security Concepts at 12%, Threats, Vulnerabilities and Mitigations at 22%, Security Architecture at 18%, Security Operations at 28%, and Security Program Management and Oversight at 20%. Broad on purpose.
CySA+ V4 has four domains, and every one of them belongs to the same job: Security Operations at 34%, Vulnerability Management at 26%, Incident Response and Management at 24%, Reporting and Communication at 16%. That last 16% covers two kinds of reporting: vulnerability findings and dashboards for the people who fund the fixes, and incident write-ups for the people who were not in the room. Both are a large share of what a SOC analyst gets paid to do.
V4 also added an objective on artificial intelligence in security operations, worded by CompTIA as “use cases, risks, and governance considerations”. If you studied CySA+ material before June 2026, that part is new to you.
Both certifications are approved under DoD Directive 8140, which matters if you are aiming at defense or federal work. For Security+, CompTIA lists work roles including cyber defense analyst, incident responder and vulnerability analyst. CompTIA maps CySA+ to ten 8140.03 work roles on its framework-alignment page, among them cyber defense analyst, cyber defense incident responder and all-source analyst. The V4 exam page states the approval outright.
Is CySA+ Harder Than Security+?
CompTIA files Security+ as foundational and CySA+ as intermediate, so it answers that one itself. Both exams pass at 750 on a scale of 100 to 900, but the same number is not the same bar: CompTIA sets each cut score at minimal competence for the job that exam certifies. Where you feel the difference is the clock. Security+ gives you a maximum of 90 questions in 90 minutes. CySA+ gives you a maximum of 85 questions in 165 minutes, close to two minutes a question against the one minute Security+ allows. That ratio is our arithmetic rather than a CompTIA figure.
Both mix multiple-choice with performance-based questions. CompTIA publishes no PBQ count for either exam, so any specific number you read elsewhere is a guess. Pass-IT writes its practice questions for both exams from the published objectives. The extra time is the clearest published sign of what CySA+ asks of you. Reading a scan output or a log excerpt and working out what it means costs more time than recognizing a definition.
That 750 is a scaled score rather than a share of correct answers. Multiple-choice and performance-based questions do not carry equal weight, and CompTIA has never published how the raw score becomes the scaled one. A pass tells you that you cleared the bar, not how many questions you answered correctly.
Does CySA+ Renew Your Security+?
Yes, and CompTIA publishes the rule outright. Both credentials run three years and renew through the Continuing Education program. Hold more than one CompTIA certification and you meet the renewal requirements for your highest-level one only; the ones below it renew automatically. CompTIA’s renewal table lists CySA+ as fully renewing Security+, Network+ and A+, meaning both Core 1 and Core 2.
Pass CySA+ while your Security+ is still active, and Security+ renews with it. CompTIA also waives the continuing-education fee on the lower one. The waiver turns on the words “fully renews”: where a higher CompTIA certification covers the lower one only in part, you still pay the fee. Renewing on units instead takes 50 CEUs for Security+ and 60 for CySA+ per three-year cycle, and holding both means you upload against CySA+ only. CompTIA publishes a CE fee per cycle on each of them, so that is one fee instead of two.
CS0-004 or CS0-003: Which Version Should You Book?
CySA+ moved to V4, exam code CS0-004, on 23 June 2026. The previous version, CS0-003, is still bookable. It retires in English on 22 December 2026, and in Japanese, Portuguese and Spanish on 23 March 2027.
Book CS0-004 if you are starting now. Both versions run 85 questions in 165 minutes and pass at 750, so the older exam buys you no format advantage. Work through V3 objectives in late 2026 and you still have the V4 additions ahead of you, starting with the AI objective. Book CS0-003 only if you are nearly through V3 material and can sit it before that 22 December cutoff, or if you need it in a language other than English. V4 launched in English, with French, Japanese, Spanish and Portuguese listed as coming soon.
V3 named Network+ and Security+ outright under recommended experience. V4 dropped them and lists only the four years of analyst work. The order advice stayed on the page, moved into the FAQ. There CompTIA answers the skip question more openly than its blog does: yes, you can, while it still recommends Security+ for the groundwork.
Security+ has its own clock. CompTIA lists SY0-701’s retirement as “usually three years after launch (estimated 2026)” and names no date. Draft objectives for its successor are already public and name it SY0-801 (Security+ V8), with no launch date announced. That is no reason to rush, but check the exam page before you buy material. If V8 launches while you are studying, the objectives move under you.
CySA+ vs Security+ Side by Side
| Security+ (SY0-701) | CySA+ (CS0-004) | |
|---|---|---|
| Level | Foundational | Intermediate analyst |
| Questions (max) | 90 | 85 |
| Duration | 90 minutes | 165 minutes |
| Passing score | 750 (scale 100–900) | 750 (scale 100–900) |
| Question types | Multiple-choice and PBQ | Multiple-choice and PBQ |
| Domains | 5 | 4 |
| Recommended experience | Network+ and 2 years in a security or sysadmin role | About 4 years as a SOC or vulnerability analyst |
| Focus | Broad security concepts | Security operations and analytics |
| CEUs to renew | 50 | 60 |
| CE fee per cycle | Set by CompTIA | Set by CompTIA |
| Valid for | 3 years (CE program) | 3 years (CE program) |
| Languages | English, Japanese, Portuguese, Spanish, Thai | English, with French, Japanese, Spanish and Portuguese coming |
After CySA+, CompTIA’s pathway continues into advanced specializations, with SecurityX (CAS-005) at the expert end. For most people SecurityX sits close to a decade of experience away, and the SecurityX comparison covers why.
Security+ proves you understand security. CySA+ proves you can work in it. That gap is a job, and the exam clock is where you feel it.
