CompTIA Security Certification Path: Security+, CySA+, PenTest+ and SecurityX Compared
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
CompTIA's security track runs from Security+ through CySA+ (defensive) or PenTest+ (offensive) to SecurityX. These four exams differ a lot: Security+ is 90 minutes, while CySA+, PenTest+ and SecurityX run up to 165 minutes, SecurityX is graded pass/fail only, and CompTIA's recommended experience rises from two years to ten years of IT experience. This guide compares the exams on format, domain weights and recommended experience using CompTIA's own certification pages, then maps the two tracks. CompTIA does not require any sequence, so the recommendations here are our reasoning, not official guidance.
The Four Exams Side by Side
Security+, CySA+, PenTest+ and SecurityX form CompTIA's security track. They share a vendor-neutral approach and a mix of multiple-choice and performance-based questions, but they differ sharply in length, scoring and the experience CompTIA recommends. All figures below come from CompTIA's certification pages.
| Security+ | CySA+ | PenTest+ | SecurityX | |
|---|---|---|---|---|
| Exam code | SY0-701 | CS0-004 | PT0-003 | CAS-005 |
| Max questions | 90 | 85 | 90 | 90 |
| Length | 90 minutes | 165 minutes | 165 minutes | Up to 165 minutes |
| Scoring | 750 on 100 to 900 | 750 on 100 to 900 | 750 on 100 to 900 | Pass/fail only, no scaled score |
| Launched | 2023 (V8 expected Nov 2026) | June 23, 2026 | December 17, 2024 | December 17, 2024 |
| Estimated retirement | SY0-701: June 11, 2027 | Not stated | Estimated 2027 | Estimated 2027 |
| Recommended experience | Two years as a security administrator (V8 page) | About 4 years as a SOC or vulnerability analyst | 3 to 4 years as a penetration tester, plus Network+ and Security+ or equivalent | At least 10 years of IT experience including 5 hands-on in security |
PenTest+ and SecurityX are usually retired about three years after launch, and CompTIA estimates 2027 for both, so check the current version before you commit to a long study plan. For exam-by-exam detail, see our objectives guides for Security+, CySA+ PenTest+, Network+ and SecurityX. For the audit track, see our CISA certification guide.
Domain Weights for Each Exam
The domains show what each exam actually emphasizes.
| Exam | Domains and weights |
|---|---|
| Security+ (SY0-701) | General Security Concepts 12%, Threats, Vulnerabilities, and Mitigations 22%, Security Architecture 18%, Security Operations 28%, Security Program Management and Oversight 20% |
| CySA+ (CS0-004) | Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, Reporting and Communication 16% |
| PenTest+ (PT0-003) | Engagement Management 13%, Reconnaissance and Enumeration 21%, Vulnerability Discovery and Analysis 17%, Attacks and Exploits 35%, Post-exploitation and Lateral Movement 14% |
| SecurityX (CAS-005) | Governance, Risk, and Compliance 20%, Security Architecture 27%, Security Engineering 31%, Security Operations 22% |
Security+ spreads across security fundamentals. CySA+ concentrates on detection, vulnerabilities and response. PenTest+ puts 35% on attacks and exploits. SecurityX shifts toward architecture and engineering, with 58% of the exam in those two domains.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Two Tracks After Security+
CompTIA does not require a sequence, so these tracks are our reasoning from the domains and experience recommendations, not official guidance.
| Track | Typical sequence | Fits roles such as |
|---|---|---|
| Defensive (blue team) | Security+, then CySA+, then SecurityX | SOC analyst, incident responder, security engineer |
| Offensive (red team) | Security+, then PenTest+, then SecurityX | Penetration tester, security consultant |
| Network-first | Network+, then Security+, then either track | Network or systems administrators moving into security |
Both tracks converge on SecurityX, which CompTIA positions for experienced practitioners. If you want a senior management credential instead, see our guide to the CISSP domains and exam format.
Read the Experience Recommendations Honestly
The recommended experience is a recommendation, not a prerequisite, and many candidates sit these exams earlier. But it signals how scenario questions are written. CySA+ expects analyst-level judgment, PenTest+ expects hands-on testing experience and SecurityX expects architect-level trade-off decisions. If you are early in your career, build experience alongside study through labs and projects, and treat the more advanced exams as goals for later.
For the first step, see our comparison of Security+, Network+ and CySA+.
Beyond CompTIA
Other bodies offer credentials aimed at different roles. ISC2's CISSP targets security leadership and requires five years of experience. ISACA's CISA targets audit and control work, and ISACA says it requires five years of professional information systems auditing, control or security experience gained within the ten years before the application, with the application due within five years of passing the exam. Check the issuing body's pages for current requirements. Our CISSP vs CISM vs CEH comparison covers how the senior credentials differ.
Studying Across the Track
DD Academy covers Security+, Network+, CySA+, PenTest+, SecurityX, CISA and CISSP in one app, with a separate plan, flashcards and readiness score for each exam. It is free to start on iPhone and the web.
The bottom line
Start with Security+, pick CySA+ or PenTest+ based on whether you want to defend or attack, and treat SecurityX as a later goal that matches ten years of experience. Check the current exam version on CompTIA's pages before you start, since PenTest+ and SecurityX are estimated to retire around 2027.
Frequently asked questions
What order should I take the CompTIA security certifications?
CompTIA does not require an order. A common pattern is Security+ first, then CySA+ for defensive roles or PenTest+ for offensive roles, with SecurityX later for senior practitioners. Choose based on your role and the experience CompTIA recommends for each exam.
How long is the PenTest+ exam?
PenTest+ PT0-003 has a maximum of 90 questions, multiple-choice and performance-based, in 165 minutes, with a passing score of 750 on a scale of 100 to 900. It launched on December 17, 2024.
What is the SecurityX exam format?
SecurityX CAS-005 has a maximum of 90 questions, multiple-choice and performance-based, in up to 165 minutes. It is graded pass/fail only, with no scaled score. It launched on December 17, 2024.
Is SecurityX the same as CASP+?
SecurityX is CompTIA's current name for its advanced security practitioner certification, previously branded CASP+. The current exam is CAS-005. Check CompTIA's page for any naming or version changes.
What experience does CompTIA recommend for PenTest+ and SecurityX?
For PenTest+, 3 to 4 years as a penetration tester plus Network+ and Security+ or equivalent knowledge. For SecurityX, at least 10 years of general hands-on IT experience including 5 years of hands-on security, plus knowledge equivalent to Network+, Security+, CySA+, Cloud+ and PenTest+.
Do I need Security+ before CySA+ or PenTest+?
No exam in the track requires another as a prerequisite. CompTIA does recommend Security+ or equivalent knowledge for PenTest+, and about four years of analyst experience for CySA+, so most people take Security+ first.
Which CompTIA security exam has the highest weight on hands-on attacks?
PenTest+ puts 35% of its content on the Attacks and Exploits domain, the largest single domain across the Security+, CySA+, PenTest+ and SecurityX exams. SecurityX puts the most weight on Security Engineering at 31%.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
