Security+ V8 · updated November 7, 2026
SY0-801 vs SY0-701: what changed in the 2026 Security+ exam
SY0-801 is the new version of the CompTIA Security+® exam, expected on or around November 17, 2026; SY0-701 stays available in English until June 11, 2027. The format stays the same: up to 90 questions, 90 minutes and 750 to pass. What changes is the content: SY0-801 reweights the domains, adds an objective on AI threats, trims the objectives to 27 and the acronym list to 106, and moves more objectives to scenario level.
- Expected Nov 17, 2026
- SY0-701 retires Jun 11, 2027
- 27 objectives
- 106 acronyms
Written by the SecurityMocks team with AI assistance and checked against the sources below. Last reviewed 7 November 2026.
SY0-801 changes at a glance
- +4Percentage points for Domain 1, now 16% of the exam.
- −6Percentage points for Domain 5, down to 14%.
- 9/ 27Objectives that start “Given a scenario”, up from 7 of 28.
- 106Acronyms on CompTIA’s SY0-801 list, down from about 320.
Release and retirement
SY0-801 release date and SY0-701 retirement
CompTIA’s V8 page says SY0-801 is expected to launch on or around November 17, 2026, in English only. Until then SY0-701 is the current Security+ exam, and for about seven months the two run side by side.
-
Nov 17, 2026
SY0-801 (V8) launches on or around this date, in English only.
-
Jun 11, 2027
SY0-701 (V7) retires in English. After this, English candidates can only book SY0-801.
-
Aug 13, 2027
SY0-701 retires in Japanese, Portuguese, Spanish and Thai.
-
About 2029
CompTIA estimates SY0-801 will retire about three years after launch.
Dates from CompTIA’s Security+ V8 and V7 pages, checked November 7, 2026. CompTIA still calls the launch date expected, so check again before you book. Full retirement details are in the SY0-701 retirement guide.
Domain weights
SY0-801 domain weights vs SY0-701
The five domains keep their names, except that Domain 2 now ends “and Attacks” instead of “and Mitigations”. Weight moves out of program management and into core concepts and threats.
- 1.0 General Security Concepts4 → 3 objectivesSY0-701: 12%. SY0-801: 16%.
- 2.0 Threats, Vulnerabilities, and Attacks5 → 6 objectivesSY0-701: 22%. SY0-801: 24%.
- 3.0 Security Architecture4 → 4 objectivesSY0-701: 18%. SY0-801: 19%.
- 4.0 Security Operations9 → 8 objectivesSY0-701: 28%. SY0-801: 27%.
- 5.0 Security Program Management and Oversight6 → 6 objectivesSY0-701: 20%. SY0-801: 14%.
SY0-701SY0-801
Source: domain weights on CompTIA’s Security+ V8 and Security+ V7 pages, checked November 7, 2026.
Domain by domain
What changed in each SY0-801 domain
Our summary of the changes, in our own words. The weight change comes first, because it tells you where the exam’s questions moved.
Domain 1 · 12% → 16%
Two objectives on controls and core principles fold into one, which now names Zero Trust, defense in depth and least privilege. Change management moves up to scenario level, so expect “what should happen next?” questions about a change. Cryptography keeps certificates and hashing but no longer lists most crypto hardware, steganography or blockchain.
Domain 2 · 22% → 24%
Two new objectives: one gathers threat intelligence, CVE, CVSS and prioritization; the other covers AI risks. Threat actors gain state-sponsored, competitor and accidental-insider labels. The indicators objective adds fileless malware, quishing, deepfakes, user enumeration and MFA bypass, and the attack-surface objective now includes LLMs and shadow IT.
Domain 3 · 18% → 19%
The architecture objective adds multicloud, the cloud deployment models and operational technology. The infrastructure objective adds Zero Trust architecture, Security Service Edge, out-of-band management and service-account hygiene. Data protection roles move here from governance, and RTO, RPO, MTTR and MTBF move into resilience.
Domain 4 · 28% → 27%
Hardening, enterprise controls and mitigation techniques merge into one objective, adding BIMI, canary accounts, secrets scanning and rate limiting. Vulnerability management and automation move to scenario level, and automation now covers AI tools and guardrails. Identity adds passkeys and backup codes; incident response gets eight new headings.
Domain 5 · 20% → 14%
The biggest drop in weight, with modest content changes. Vendor risk adds solicitation documents, service-level objectives and a vendor registry. Compliance adds anti-money-laundering and anti-bribery training, consent and legal holds. Audits now name MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model, while risk appetite types drop out.
SY0-801 exam objectives
How 28 objectives became 27
Two objectives are new, three combine earlier objectives, and three moved up to scenario level. SY0-701’s objective on mitigation techniques no longer stands alone; its content now sits in 4.1. The names below are our short summaries; CompTIA doesn’t publish a crosswalk.
| SY0-801 | What it covers | From SY0-701 | Change |
|---|---|---|---|
1.1 | Core security principles and control families | 1.1 + 1.2 | Merged |
1.2 | Making changes without opening security gaps | 1.3 | Now scenario-based |
1.3 | Choosing and using cryptography | 1.4 | Renumbered |
2.1 | Threat intelligence and vulnerability scoring | Parts of 4.3 | New |
2.2 | Who attacks and why | 2.1 | Renumbered |
2.3 | How attacks arrive: delivery channels and entry points | Part of 2.2 | Split and expanded |
2.4 | Weak spots and exposed attack surfaces, including LLMs | 2.3 + part of 2.2 | Merged |
2.5 | Reading the signs of an attack | 2.4 | Renumbered |
2.6 | AI and LLM risks | None | New |
3.1 | Choosing where and how systems run | 3.1 | Same title |
3.2 | Running a defensible infrastructure | 3.2 | Reworded |
3.3 | Protecting data across its life | 3.3 | Reworded |
3.4 | Staying available and restoring service | 3.4 | Same title |
4.1 | Hardening and protective controls in practice | 4.1 + 4.5 + 2.5 | Merged |
4.2 | Tracking assets from purchase to disposal | 4.2 | Same title |
4.3 | Running vulnerability management | 4.3 | Now scenario-based |
4.4 | Log collection, alerts and telemetry tools | 4.4 | Same title |
4.5 | Identity and access management in practice | 4.6 | Renumbered |
4.6 | Scripted workflows and AI helpers | 4.7 | Now scenario-based |
4.7 | Incident response building blocks | 4.8 | New headings |
4.8 | Picking the right evidence for an investigation | 4.9 | Renumbered |
5.1 | Policies, standards and reference documents | 5.1 | Reworded |
5.2 | Managing risk | 5.2 | Reworded |
5.3 | Third-party and vendor risk | 5.3 | Reworded |
5.4 | Compliance and privacy obligations | 5.4 | Same title |
5.5 | Audits, testing and intrusion-analysis frameworks | 5.5 | Reworded |
5.6 | Security awareness programs | 5.6 | Reworded |
New in SY0-801
New topics to study for SY0-801
These terms appear in the SY0-801 objectives but not in SY0-701’s.
AI threats (objective 2.6)
- Prompt injection
- Poisoning
- Model manipulation
- Jailbreaking
- Hallucinations
- Evasion
- Data loss
- Bias
- Explainability
- Privacy
- Session hijacking
- Code execution
- Ethics
AI in security operations
- Agentic AI
- Chatbots
- Predictive analysis
- AI-augmented baselines
- Guardrails
- LLMs as an attack surface
Identity and access
- Passkeys
- Backup codes
- One-time passwords
- Emergency access accounts
- gMSA
- Access reviews
- Privilege creep
Attacks and indicators
- Quishing
- Deepfakes
- MFA bypass
- Fileless malware
- Protocol downgrade
- Impossible travel
- Living-off-the-land tools
Cloud, code and operations
- Secrets scanning
- CSPM
- CI/CD
- BIMI
- Canary accounts
- Security Service Edge
- IPFIX
- Port mirroring
Threat intelligence and governance
- MITRE ATT&CK
- Cyber Kill Chain
- Diamond Model
- RFP, RFI and RFQ
- Vendor registry
- AML/CTF training
Objective 2.6
How to study the new AI objective
Objective 2.6 is a knowledge objective, not a scenario one, so expect a short description and a question about which AI threat it shows. In our bank it has no PBQs. Four steps cover it.
-
Learn the 13 as a set
Group them: steering the model, corrupting what it learns, fooling its decisions, what it leaks, its built-in limits, and session or code takeover.
-
Drill the look-alikes
Prompt injection vs jailbreaking, poisoning vs model manipulation, poisoning vs evasion. These pairs make the best wrong answers.
-
Follow AI into 2.4 and 4.6
LLMs as an attack surface sit in 2.4. Defenses such as guardrails, and AI in security operations, sit in 4.6, which is a scenario objective.
-
Check one primary source
The OWASP Top 10 for LLM Applications and NIST AI 100-2 define most of these terms.
No longer named
What SY0-801 no longer lists
These SY0-701 terms don’t appear in the SY0-801 objectives. CompTIA says its lists of examples aren’t exhaustive, so don’t forget them entirely, but don’t make them the focus of your study.
- TPM and HSM
- WPA3 and RADIUS
- SASE and SD-WAN
- Blockchain and open public ledgers
- Birthday and collision attacks
- SQL injection and XSS as named types
- Bollards, fencing and sensors
- Steganography
- COPE and CYOD
- Policy Engine and Policy Administrator
- Risk appetite types
Objective 4.7
Incident response: seven steps become eight headings
SY0-801 gives negotiation and notification headings of their own, groups eradication with recovery, and widens lessons learned into a post-incident heading.
SY0-701
- Preparation
- Detection
- Analysis
- Containment
- Eradication
- Recovery
- Lessons learned
SY0-801
- Preparation
- Identification
- Investigation
- Containment
- Negotiation
- Eradication and recovery
- Notification and external reporting
- Post-incident
Decide
Should you take SY0-701 or SY0-801?
Both versions are available in English from November 17, 2026 to June 11, 2027. CompTIA’s Security+ page says V7 is still a good choice if you’re ready to certify now, and its help center says a standard voucher isn’t tied to a version. Find your situation below.
| Your situation | Take | Why |
|---|---|---|
| You’ve covered most of the SY0-701 material and can test before June 2027 | SY0-701 | Your books and practice match it. Leave room before June 11, 2027 in case you need a retake. |
| You’re starting to study now | SY0-801 | You won’t be racing a retirement date, and SY0-701 material doesn’t cover the AI objective or the new incident response headings. |
| You want to test in Japanese, Portuguese, Spanish or Thai | SY0-701 | SY0-801 launches in English only. SY0-701 stays in those languages until August 13, 2027. |
| You failed SY0-701 and hold a Retake Assurance retake | SY0-701 | CompTIA’s voucher terms say a retake voucher can’t be used on another version of the exam. |
| Your exam date is after June 11, 2027 | SY0-801 | It’s the only English version left after that date. |
Whichever you pick, book the exam code you studied for. For SY0-701, practice with the SY0-701 practice plan; for SY0-801, start with Mock Test 1 to find your baseline. Prices are in Security+ exam cost and vouchers.
FAQ
SY0-801 questions, answered
What is SY0-801?
SY0-801 is the exam code for the new version of CompTIA Security+, which CompTIA’s store calls V8. It replaces SY0-701, which stays the current exam until SY0-801 launches and remains available in English until June 11, 2027.
When does SY0-801 come out?
CompTIA expects SY0-801 to launch on or around November 17, 2026, in English only, as of November 7, 2026. Other languages stay on SY0-701 until August 13, 2027.
Is SY0-801 harder than SY0-701?
It asks for more applied thinking: nine of its 27 objectives start with “Given a scenario”, up from seven of 28. On the other hand, the acronym list is about a third of the size. The pass mark stays at 750 on a 100–900 scale. How hard it feels in practice will only be clear once candidates have taken it.
Can I use my SY0-701 voucher for SY0-801?
Yes, if it’s a standard voucher. CompTIA’s help center says vouchers are tied to the exam but not to a version, so one bought now can be used for either while it’s valid. A Retake Assurance retake is the exception: it must be used on the version you first sat. See the voucher rules that can cost you money.
Do SY0-701 study materials still work for SY0-801?
Much of the core material carries over, but not all of it. Add the new AI objective, the new incident response headings and the topics listed above, and don’t spend long on terms SY0-801 no longer names. Practice questions should be labeled with the exam version they were written for.
Are there SY0-801 practice tests?
Yes. Our four full-length mock tests are written to the SY0-801 v2.0 objectives, with PBQs and a rationale for every option. Mock Test 1 is free.
Practice on the new objectives
Mock Test 1 is a free, full-length SY0-801 practice exam, explained option by option.
Sources
CompTIA pages checked November 7, 2026.
- CompTIA: Security+ V8: expected launch date, English only, estimated retirement, format, passing score and domain weights.
- CompTIA: Security+ V7: SY0-701 retirement dates by language and domain weights.
- CompTIA: Security+ overview: V7 still offered alongside the coming V8.
- CompTIA Help: using a voucher on a different version and CompTIA Voucher Terms & Conditions.
- OWASP Top 10 for LLM Applications and NIST AI 100-2 E2025, for the AI terms.
- Objective counts, scenario objectives, acronym counts, incident response headings and the per-objective changes: our comparison of CompTIA’s SY0-801 (v2.0) and SY0-701 objective documents, recorded in our topic map on November 4, 2026. The short summary on CompTIA’s V8 web page groups and words the objectives differently; we follow the objectives document.