Security+ is where most cybersecurity careers start. A few years in, the question changes from “how do I get in?” to “what do I do next?” For many experienced IT and security professionals, the answer comes down to two CompTIA certifications: CySA+ and SecurityX.
People often lump them together as “the advanced CompTIA certs,” but they are built for different jobs. CySA+ is for the people who watch, hunt, and respond: SOC analysts, incident responders, and vulnerability analysts. SecurityX is for the people who design and lead: security architects and senior security engineers. Choosing between them depends less on which one is harder and more on the work you want to be doing in three years.
There is also a timing question. CompTIA released a new version of CySA+ in June 2026, and the previous version’s English exam retires on December 22, 2026. If you have been putting this decision off, now is a good time to make it.
First, a quick name check: CASP+ is now SecurityX
If you have been in the field a while, you know SecurityX as CASP+, the CompTIA Advanced Security Practitioner. CompTIA renamed it in December 2024, when the CAS-005 exam launched, and placed it in its “Xpert” series of expert-level certifications.
If you already hold CASP+, nothing changes. Your certification and continuing-education status carry over, and CompTIA issues an updated SecurityX badge and certificate. You will still see “CASP+” in job postings and older contract language for a while, so it helps to know they are the same credential.
CySA+ and SecurityX at a glance
| CySA+ (V4) | SecurityX | |
|---|---|---|
| Exam code | CS0-004 | CAS-005 |
| Level | Intermediate | Advanced (CompTIA “Xpert” series) |
| Built for | SOC analysts, incident responders, vulnerability analysts | Security architects, senior security engineers |
| Recommended experience | About 4 years in a SOC or vulnerability analyst role | 10 years in IT, including 5 years of hands-on security |
| Exam length | Up to 85 questions, 165 minutes | Up to 90 questions, 165 minutes |
| Question types | Multiple-choice and performance-based | Multiple-choice and performance-based |
| Scoring | Scaled: 750 to pass (100–900 scale) | Pass/fail, no scaled score |
| Domains | Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, Reporting and Communication 16% | Security Engineering 31%, Security Architecture 27%, Security Operations 22%, Governance, Risk and Compliance 20% |
| Renewing it also renews | Security+, Network+, A+ | CySA+, PenTest+, Security+, Network+, A+ |
Exam details from CompTIA’s CySA+ V4 and SecurityX exam pages, October 2026.
CySA+: for the people who defend
CySA+ is a hands-on analyst certification. It tests whether you can work a security problem the way it actually arrives: an alert, a trail of logs, a vulnerability scan, and someone who needs to know what happened. Security operations makes up the largest share of the exam, followed by vulnerability management, incident response and management, and reporting and communication.
That last domain is easy to overlook, but it is where many analysts get stuck in real life: explaining a finding clearly to someone who doesn't live in the SIEM.
CompTIA’s recommended path is Network+, then Security+, then CySA+, with around four years of hands-on experience in a SOC or vulnerability analyst role. That is guidance rather than a hard prerequisite, but the exam assumes you have done the work.
What changed in CySA+ V4
The new version, CS0-004, launched in June 2026. The structure is familiar, but the content has moved with the job:
- AI in the SOC: AI use cases and AI-assisted workflows, along with AI-related risks and governance.
- Risk-based vulnerability prioritization: including EPSS (the Exploit Prediction Scoring System), rather than patching strictly by severity score.
- Modern architectures: Zero Trust Network Access (ZTNA), Secure Access Service Edge (SASE), and monitoring across cloud and hybrid environments.
- Software supply chain risk: including Software Bills of Materials (SBOMs).
- Automation: across SIEM, SOAR, EDR, and XDR tools.
V3 or V4?
The previous version, CS0-003, is still available for now, but its English exam retires on December 22, 2026. If you are well into studying for V3 and can test before that date, finishing makes sense. If you are starting from scratch, study for V4. It reflects the tools and practices you will use on the job, and it is the version that stays current.
SecurityX: for the people who design and lead
SecurityX sits at the top of CompTIA’s security track. Where CySA+ asks “what is happening, and how do we respond?”, SecurityX asks “how should this environment be built, secured, and governed in the first place?” Its largest domains are security engineering and security architecture, followed by security operations and governance, risk, and compliance.
CompTIA positions it for security architects and senior security engineers, and recommends at least ten years of IT experience, including five years of hands-on security work. It also expects knowledge at the level of Network+, Security+, CySA+, Cloud+, and PenTest+.
Two things set the exam apart. It is pass/fail with no scaled score, so there is no number to chase. It's built around architecture and engineering work, which is why it is often weighed against management-focused certifications like CISSP and CISM. That is a comparison for a separate post.
The DoD 8140 angle
If you work in or alongside DoD, the question is not only which certification is more impressive. It is which one maps to your work role. Under DoD 8140, qualification is tied to a position’s DCWF work role and proficiency level. We covered how that works in our DoD 8140 compliance guide.
CompTIA lists both certifications as approved for DoDM 8140.03, but they mainly line up with different kinds of roles. CompTIA maps CySA+ to analyst and response roles such as Cyber Defense Analyst, Cyber Defense Incident Responder, and Vulnerability Assessment Analyst. It maps SecurityX to design and assessment roles such as Security Architect, Systems Requirements Planner, and Security Control Assessor.
Before you choose, find your position’s work role and check the current DoD 8140 qualification matrix on DoD Cyber Exchange to see which certifications count, and at what proficiency level. If you are a training coordinator, the same check tells you which certification to budget for which seat.
How to choose
Three questions settle it for most people:
- What does your day look like now? If you spend it in alerts, logs, scans, and tickets, CySA+ builds directly on that work. If you spend it designing systems, reviewing architectures, or setting security requirements, SecurityX fits better.
- How much experience do you have? CompTIA’s guidance is about four years for CySA+, and ten years (including five in security) for SecurityX. You can sit either exam without meeting those numbers, but they are a good guide to what the questions assume.
- Where do you want to be in three years? If the goal is senior analyst, threat hunter, or incident response lead, CySA+ is the stronger next step. If the goal is security architect or senior security engineer, SecurityX is the destination, and for many people CySA+ is the step before it.
For a lot of professionals, the answer is not either/or. It is CySA+ now and SecurityX later.
A practical bonus: renewals
CompTIA certifications renew every three years through continuing education, and renewing a higher-level certification also renews the ones beneath it. Renewing CySA+ also renews Security+, Network+ and A+. Renewing SecurityX renews all of those, plus CySA+ and PenTest+. If you hold several CompTIA certifications, moving up the stack makes them easier to maintain.
Pick the work, then the certification
The right next certification is the one that matches the work you want to do. If you are weighing CySA+ against SecurityX, or working out which one your team’s 8140 work roles call for, talk to one of our program managers.
TrainACE runs instructor-led CySA+ and SecurityX classes in Greenbelt, Maryland, and live online.
Leave Your Comment Here