SecurityMocks

CompTIA certification roadmap

CompTIA certification path 2026: Security+ vs Network+ vs CySA+

The usual CompTIA certification path into security runs A+, then Network+, then CompTIA Security+®, then CySA+ or PenTest+, with SecurityX at the top. None of them is required before another: CompTIA lists earlier certifications and years on the job as recommended experience, so you can start wherever your skills already are.

Find your starting point Compare the exams

Written by the SecurityMocks team with AI assistance and checked against the sources below. Last reviewed 7 November 2026.

The path in one picture

The CompTIA certification path in one picture

Three core certifications build general IT skills. Security+ is where the security track starts, and two specialist exams lead on to the expert-level SecurityX.

The core path

  1. A+
  2. Network+
  3. Security+

The security track after Security+

  1. Security+
  2. CySA+ or PenTest+
  3. SecurityX

Who each certification is written for

CompTIA’s recommended experience is the clearest signal of where each exam sits. None of it is mandatory.

Recommended experience from each certification’s CompTIA page, summarized in our words. Checked 7 November 2026.
CertificationWhere it sitsCompTIA’s recommended experienceTypical roles
Tech+Optional first stepNone neededAnyone exploring IT
A+Core, firstAbout a year in an IT support jobHelp desk, IT support
Network+Core, secondA+, plus 9 to 12 months supporting or running networksNetwork support, network operations, systems admin
Security+Core, third; starts the security trackAbout two years of hands-on work as a security administratorSecurity analyst, security engineer, systems admin
CySA+Security track, defensiveAbout four years as a SOC or vulnerability analystSecurity analyst
PenTest+Security track, offensiveThree to four years of penetration testing, with Network+ and Security+ level knowledgePenetration tester, security consultant
SecurityXTop of the security trackAt least ten years in IT, five of them hands-on in security, plus knowledge across Network+, Security+, CySA+, Cloud+ and PenTest+Security architect, security control assessor

Two names have changed recently. CASP+ became SecurityX when its CAS-005 exam launched on 17 December 2024, and Tech+ is the successor to IT Fundamentals (ITF+). CompTIA’s infrastructure certifications, such as Linux+, Server+ and Cloud+, sit beside this path; this guide follows the security route.

Path chooser

Which CompTIA certification should I get first?

Start from what you can already do, not from the top of the list. CompTIA’s own career advice suggests beginners start with A+, but says the pathway isn’t one-size-fits-all. Find the row that sounds like you.

  1. Background · 01

    No IT experience yet

    A+ teaches the hardware, operating systems and troubleshooting that every later exam takes for granted, and CompTIA ties it to help desk and IT support roles. Tech+ is optional; CompTIA lists no experience for it, so it suits you only if you want a gentler first exam.

    Your pathA+ (Core 1 and Core 2), then Network+, then Security+

  2. Background · 02

    Help desk or IT support

    Your job already covers much of A+. The deciding question is networking: if subnets, DNS and port numbers still feel shaky, Network+ is the natural next exam. If they don’t, you can move straight to Security+.

    Your pathNetwork+, then Security+; or Security+ next if networking is solid

  3. Background · 03

    Network, systems or cloud administrator

    Network admins, NOC staff and holders of a vendor networking certification would mostly repeat what they know in Network+. Two years of admin work is also close to the experience CompTIA recommends for Security+, which adds the security layer to the systems you already run. Review network attacks and secure protocols, then book it.

    Your pathSecurity+, then CySA+ or PenTest+

  4. Background · 04

    SOC analyst, or aiming to be one

    If you already hold Security+ and spend your days on alerts, scans and tickets, CySA+ tests that work directly. Without Security+, take it first: CompTIA treats CySA+ as the higher-level certification, and earning it renews Security+.

    Your pathSecurity+ if you don’t have it, then CySA+, then SecurityX in time

  5. Background · 05

    Drawn to offensive security

    PenTest+ covers planning, running and reporting on penetration tests. CompTIA recommends Network+ and Security+ level knowledge before it.

    Your pathSecurity+, then PenTest+

  6. Background · 06

    Government or defense contract work

    Your job posting or contract names the certifications that qualify for your work role, so check it before you plan anything. Our guide to DoD 8140 and Security+ explains how to look the requirement up.

    Your pathThe certifications your work role lists

  7. Background · 07

    Ten or more years in IT, five in security

    That’s the experience CompTIA recommends for SecurityX. Earning it also renews every lower certification you hold in the security line.

    Your pathSecurityX, with CySA+ or PenTest+ first if you want the steps

Can you skip A+ and go straight to Network+? Yes. Network+ lists A+ as recommended, not required, and none of the CompTIA pages we checked lists a required certification. Skipping makes sense when your job already covers hardware and operating systems.

Network+ vs Security+

Security+ vs Network+: which should you take first?

Network+ shows you can build, run and troubleshoot a network. Security+ shows you can protect systems and respond when something goes wrong. Most people take Network+ first because Security+ questions assume networking knowledge, but the order is your choice.

Security+ vs Network+. Facts from CompTIA’s Network+, Security+ V8 and continuing-education pages, checked 7 November 2026.
DetailNetwork+Security+
FocusBuilding, running and fixing networksSecuring systems, networks and people
Current examN10-009, launched June 2024SY0-801, expected on or around 17 November 2026
QuestionsUp to 90, multiple choice and performance-basedSame
Time90 minutesSame
Pass mark720 on a 100–900 scale750 on a 100–900 scale
Biggest domainTroubleshooting, 24%Security operations, 27%
Recommended experienceA+ and 9 to 12 months in network supportAbout two years as a security administrator
Renewal30 CEUs every three years50 CEUs every three years; also renews Network+ and A+

Where Network+ and Security+ overlap

Our own comparison of the two exams’ public domain lists. Roughly, Network+ asks how something works; Security+ asks how it fails and which control fixes it.

On both exams

  • Ports and protocols
  • Segmentation and VLANs
  • Firewalls and ACLs
  • VPNs and IPsec
  • Wireless security and 802.1X
  • DNS and DHCP
  • Logs, SNMP and monitoring
  • Redundancy and high availability
  • Physical security

Mostly Network+

  • Subnetting and IP addressing
  • The OSI model
  • Cabling and connectors
  • Routing and switching
  • Wireless standards and channels
  • A troubleshooting method

Mostly Security+

  • Cryptography and certificates
  • Threat actors and malware
  • Vulnerability management
  • Incident response and evidence
  • Identity and access
  • Governance, risk and compliance
  • AI threats

If the shared topics look unfamiliar, work through our ports and protocols list before you start on Security+.

Do I need Network+ before Security+?

No, it’s recommended background, never a requirement. CompTIA listed Network+ in the recommended experience for SY0-701, but the SY0-801 page names only two years as a security administrator. You need the networking knowledge, not necessarily the certificate.

Is Network+ worth it if you have Security+?

Only if you want network roles, or a job ad asks for it. Security+ already sits higher on the path, and once you hold both, renewing Security+ keeps Network+ current at no extra cost.

Is Security+ harder than Network+?

It depends on your background, and CompTIA publishes no difficulty ranking or pass rates. Our separate guide covers the question in depth.

How hard Security+ is

CySA+ vs Security+

Security+ vs CySA+: broad base or analyst specialty?

CySA+ stands for Cybersecurity Analyst+. Security+ covers the whole security field at a working level; CySA+ goes deep on one job: detecting threats, managing vulnerabilities and handling incidents in a security operations center (SOC). It’s a step after Security+, not an alternative to it.

Security+ vs CySA+. Facts from CompTIA’s Security+ V8, CySA+ V4 and continuing-education pages, checked 7 November 2026.
DetailSecurity+CySA+
ScopeBroad: concepts, threats, architecture, operations, governanceDeep: detection, vulnerabilities, incident response, reporting
Current examSY0-801, expected on or around 17 November 2026CS0-004, launched 23 June 2026
QuestionsUp to 90Up to 85
Time90 minutes165 minutes
Pass mark750 on a 100–900 scaleSame
DomainsFive; security operations is the largest at 27%Four; security operations is the largest at 34%
Recommended experienceAbout two years as a security administratorAbout four years as a SOC or vulnerability analyst
Renewal50 CEUs every three years60 CEUs every three years; also renews Security+, Network+ and A+

Choose Security+ or CySA+ next

Three quick checks. If most of your answers land on the right, you’re ready to look at CySA+.

  • Choose Security+

    You don’t hold a security certification yet.

    Choose CySA+

    You already hold Security+ or know its material well.

    The checkCySA+ builds on Security+-level knowledge rather than teaching it again.

  • Choose Security+

    You want a broad base that fits many security roles.

    Choose CySA+

    You want to specialize in detection and response.

    The checkPicture the job you want next year: generalist, or analyst at a console?

  • Choose Security+

    Your job posting or contract names Security+.

    Choose CySA+

    Your employer wants analyst depth, or you already meet your Security+ requirement.

    The checkThe certification a real job asks for beats any roadmap.

CySA+ exam versions: what retires when

The certification isn’t going away. CompTIA is replacing the CS0-003 exam with CS0-004.

  1. 6 June 2023

    CS0-003 (V3) launches.

  2. 23 June 2026

    CS0-004 (V4) launches in English. Other languages are listed as coming soon.

  3. 22 December 2026

    The English CS0-003 exam retires. Studying for V3? Sit the exam before this date.

  4. 23 March 2027

    The Japanese, Portuguese and Spanish versions of CS0-003 retire.

CompTIA trifecta

The CompTIA trifecta: A+, Network+ and Security+

“Trifecta” is the community’s name for holding all three core certifications. CompTIA calls the same set the CompTIA Secure Infrastructure Specialist (CSIS), one of its stackable certifications, listed for people with up to two years of experience.

  • 4examsA+ is two exams, Core 1 and Core 2, from the same version, so the trifecta takes four passes.
  • 3yrsHow long each certification stays valid after you earn it, under CompTIA’s continuing-education program.
  • 50CEUsEnough to renew all three, because renewing Security+ also renews Network+ and A+.
  • 1dateEarn the next certification within the three-year cycle and the lower ones move to its expiry date.

Worth it if you’re starting from zero

The trifecta follows a common route from help desk to systems work to security, and each exam teaches what the next one assumes.

Less useful if you already work in IT

Someone with two years in networking or systems work gains little from A+. Security+ alone sits higher and costs one exam instead of four.

Other stacks that start with Security+

Security+ with CySA+ makes the CompTIA Security Analytics Professional (CSAP). Security+ with PenTest+ makes the Network Vulnerability Assessment Professional. All three together make the Network Security Professional.

Security+ renewal and CE rules

Exam facts

CompTIA exam facts, side by side

CompTIA usually retires an exam version about three years after launch, so recheck the exam’s page before you book.

Current and upcoming exam versions on the CompTIA security path. Scaled scores run from 100 to 900. Sources: each certification’s CompTIA page and the CompTIA CEU table, checked 7 November 2026.
CertificationExam codeQuestionsTimePass markCEUs per 3 years
Tech+FC0-U71Up to 7060 min650None; doesn’t expire
A+ Core 1220-1201Up to 9090 min67520
A+ Core 2220-1202Up to 9090 min700
Network+N10-009Up to 9090 min72030
Security+SY0-801, from about 17 Nov 2026Up to 9090 min75050
CySA+CS0-004Up to 85165 min75060
PenTest+PT0-003Up to 90165 min75060
SecurityXCAS-005Up to 90Up to 165 minPass or fail only75

Tech+ also comes as FC0-U71-CE, which is valid for five years. SY0-701 remains available in English until it retires on 11 June 2027; see what changed in SY0-801. CompTIA’s certification pages didn’t show voucher prices when we checked, so we haven’t listed them here; the Security+ exam cost guide has that exam’s US price.

How long does a CompTIA certification take?

CompTIA doesn’t publish study times. Its recommended experience runs from none for Tech+ to ten years for SecurityX, and every certification on this path except Tech+ lasts three years once you pass. For Security+, our Security+ study plan has 4-, 8- and 12-week tracks.

Which exams have hands-on questions?

The A+, Network+, Security+, PenTest+ and SecurityX pages all list performance-based questions next to multiple choice. Expect to configure, sort or troubleshoot something, not just pick an answer.

Security+ PBQ guide

Want the Security+ details?

Our guide to what the Security+ certification covers explains the exam, who it suits and what it leads to.

FAQ

CompTIA certification path questions

Which CompTIA certification should I get first?

A+ if you have no IT experience, Network+ if you work in IT support but networking is new, and Security+ if you already work in networking or systems administration. No CompTIA certification is required before another, so start where your skills are.

What is the next certification after CompTIA A+?

Network+ is the usual next step, and CompTIA lists A+ in Network+’s recommended experience. If you’re already comfortable with subnets, DNS and ports, you can go straight to Security+ instead.

Is CySA+ worth it after Security+?

It is if you work, or want to work, as a security analyst. CySA+ tests detection, vulnerability management and incident response in depth, and earning it renews Security+, Network+ and A+. If you want offensive work instead, PenTest+ is the parallel step.

Is CySA+ retiring?

No, only its older exam is. CS0-004 launched on 23 June 2026, and the English CS0-003 exam retires on 22 December 2026. CySA+ stands for Cybersecurity Analyst+.

What is the CompTIA trifecta?

It’s the informal name for holding A+, Network+ and Security+. CompTIA recognizes the set as the CompTIA Secure Infrastructure Specialist (CSIS) stackable certification. It takes four exams, because A+ has two.

Security+ on your path? See where you stand

Take a free Security+ practice test in exam mode: 90 questions, 90 minutes, PBQs first and every option explained. Your domain bars show where to start studying.

Start free Mock Test 1 Practice questions by domain
Illustration of a winding path climbing a hill to a flag at the summit

Ready for exam conditions? Our full-length SY0-801 practice exams run four complete mocks, and the Security+ practice test homepage lists every format.

Sources

All pages fetched and checked on 7 November 2026.