CEH vs CySA+: which one should a future security analyst take?
For security-analyst work, take CySA+ (CompTIA Cybersecurity Analyst, a defensive exam). In the CEH vs CySA+ choice, CySA+ fits analyst tasks better and costs less ($589 vs from $1,290 over three years). The CEH (Certified Ethical Hacker, from EC-Council) tests attack methods. With no security job yet, start with Security+ (CompTIA's core security exam).
Both names appear in US job ads. Of the 8,110 US ads on Adzuna, a job-ad search site, whose title contains the words security analyst in October 2026, 81 contained ceh and 119 contained cysa. To decide before you have a target job, read which one to take.
| CEH | CySA+ | |
|---|---|---|
| Awarded by | EC-Council (security certifier and trainer) | CompTIA (IT exam body) |
| Point of view | Offensive: how attackers break in | Defensive: how analysts detect and handle threats |
| Current exam | 312-50, version 13 | CS0-004, launched June 23, 2026 |
| Questions and time | 125 multiple-choice, 4 hours | Up to 85, multiple-choice and performance-based, 165 minutes |
| Passing score | 60% to 85%, set per exam form | 750 on a scale of 100 to 900 |
| Entry rule | Two years of security work, or official training | No prerequisite; about four years as a SOC or vulnerability analyst recommended |
| US exam voucher (prepaid exam code) | $950 online, $1,199 at a Pearson VUE test center | $439 |
| Renewal | Every 3 years: 120 ECE credits, $80 a year | Every 3 years: 60 CEUs, $150 per cycle |
Source: EC-Council and CompTIA pages listed under Sources, prices read October 12, 2026. A SOC (security operations center) is the team that watches a company's systems for attacks. Pearson VUE is a company that runs in-person exam centers. An exam form is one version of the question set. ECE credits and CEUs are points for logged learning, explained under renewal.
Show the numbers
| Country | CEH | CompTIA CySA+ |
|---|---|---|
| India | 7% | 4% |
| United Kingdom | 2% | 4% |
| United States | 81 of 8,110 | 1.5% |
| Brazil | 3 of 434 | 3 of 434 |
CEH or CompTIA CySA+: which do employers name more?
Instant answer from October 2026 job ads. No email needed.
CEH is named in more job ads in the United States.
Source: Adzuna job ads, October 2026. Small sample: 217 ads. Treat this as a rough guide.
Get your full report
Two optional questions shape your first step. No email needed.
On this page
- Which should you take, the CEH or CySA+?
- What does each exam cover?
- How do the CEH and CySA+ exams differ?
- Who can take each exam?
- What do the CEH and CySA+ cost over three years?
- How do you keep each certification?
- Do security-analyst job ads name the CEH or CySA+?
- What do Reddit posters ask about the CEH and CySA+?
- What we did not check
- Sources
Which should you take, the CEH or CySA+?
Take CySA+ if you want to work as a security analyst or SOC analyst, the person on the team that watches a company's systems for attacks. Take the CEH if your goal is offensive work or an employer or contract names it.
The CEH is EC-Council's knowledge exam on attack methods, from scanning networks to hacking web applications. EC-Council's page also names Cybersecurity Analyst among the 45+ roles it maps the CEH to; that is vendor marketing, not a hiring rule, and the job-ad counts below show employers name both. CySA+ is CompTIA's analyst-level certification, the step above Security+ in CompTIA's renewal hierarchy.
- No security job yet: neither one is a first exam. EC-Council asks for two years of security work or official training, and CompTIA recommends about four years before CySA+. Your first step is Security+; our CySA+ vs Security+ comparison explains the order CompTIA suggests.
- Help desk or IT support now, aiming for a SOC: plan for Security+, then CySA+. Open ten SOC-analyst ads on a job site such as Indeed or LinkedIn and write down every credential they name before you pay for either.
- Already in a SOC or a team that finds and ranks weak spots: CySA+ tests the work you do. The CEH adds the attacker's view, which is useful but further from your daily tasks.
- Aiming for penetration testing (hacking systems with permission to find weak spots): compare the CEH with hands-on exams first, such as the OSCP (OffSec's practical hacking exam). Our CEH vs OSCP page and the PenTest+ page, on CompTIA's penetration-testing exam, cover that route.
- Employer pays, or an ad or contract names the CEH: take the CEH. Official training also removes the two-year rule and the $100 application fee.
For a later move into running a security program, our CEH vs CISSP page compares the CEH with the CISSP, a credential for experienced security staff.
What does each exam cover?
The CEH covers how attacks work; CySA+ covers how to notice, rank and respond to them. CompTIA aims the second at SOC and vulnerability analysts.
EC-Council's official CEH course has 20 modules. EC-Council lists topics such as reconnaissance (gathering information about a target), scanning networks, system hacking, malware (harmful software), social engineering (tricking people into giving access). Later modules cover web-application hacking, SQL injection (attacking a database through a web form), wireless attacks, cloud computing, and cryptography (encryption). The course page also counts 221 hands-on labs, which belong to the course, not the exam.
CompTIA publishes a weight for each domain (topic area) of the CySA+ exam:
| CySA+ domain (CS0-004) | Share of the exam |
|---|---|
| Security Operations (watching systems and alerts) | 34% |
| Vulnerability Management (finding and ranking weak spots) | 26% |
| Incident Response and Management (handling an attack) | 24% |
| Reporting and Communication | 16% |
Source: CompTIA CySA+ V4 page.
EC-Council does not publish a weight for each CEH module on the course page we read, so we cannot set the two outlines side by side topic by topic. CompTIA's blog post on the new exam adds AI use cases and risks to the CySA+ topics.
Show the numbers
| Item | CEH | CompTIA CySA+ |
|---|---|---|
| Questions | 125 questions | 85 questions |
| Exam time | 240 minutes (4 h) | 165 minutes (2 h 45 min) |
| Passing score | 60–85% | 750 (scale 100–900) |
| Format | Multiple choice, hands-on practical | Multiple choice, performance-based tasks |
How do the CEH and CySA+ exams differ?
The CEH exam is all multiple choice; CySA+ adds performance-based questions, short tasks in a simulated system. Neither vendor shows a pass rate on the pages we read.
CEH. The exam has 125 questions in four hours. EC-Council sets the passing score per exam form, anywhere from 60% to 85%. You can take it online with a proctor (a supervisor who watches you over webcam) for a $950 voucher, or at a Pearson VUE center for $1,199. Hands-on skill sits in a separate, optional exam, the CEH Practical: six hours, 20 challenges, a $550 voucher. Passing both gives you the title CEH Master.
CySA+ (details checked October 12, 2026). CS0-004 has up to 85 questions in 165 minutes and needs 750 on a scale of 100 to 900. CompTIA does not say how many of the questions are performance-based. The exam is in English, with French, Japanese, Spanish and Portuguese listed as coming soon.
Which exam versions are current?
For the CEH, version 13; EC-Council says new versions come every 12 to 18 months. For CySA+, study for CS0-004, which launched June 23, 2026.
The older CySA+ exam, CS0-003, retires in English on December 22, 2026, and its English learning products on November 22, 2026 (CompTIA, read October 11, 2026). After December 22, 2026, CS0-004 is the only English CySA+ exam, so books and courses need to cover it.
Who can take each exam?
CompTIA sets no prerequisite for CySA+. The CEH needs two years of information-security work or EC-Council's official training.
CySA+. Its exam page recommends "about 4 years in a SOC analyst or vulnerability analyst role." CompTIA's blog post on the new exam says you can take CySA+ before Security+, but advises against it unless you already have substantial security experience.
CEH. EC-Council's two pages word the rule differently. The CEH product page says "it's recommended" that you have a minimum of two years of IT security experience. The eligibility page, where you actually apply, makes two years in an information-security role a condition unless you attended official training. Plan by the stricter page.
Official training, which EC-Council runs as a five-day boot camp (an intensive full-time course) through partners who set the price, makes you eligible directly. Without it, you apply with proof of your two years and pay a non-refundable $100 application fee. EC-Council's page puts approval at about 5 to 10 business days; an approval is valid for 90 days and a voucher for 12 months.
What do the CEH and CySA+ cost over three years?
Over three years and one passed attempt, CySA+ costs $589 and the CEH $1,290 to $1,539, if you already have two years of security work. Each total below shows its parts.
| Part | CEH online | CEH at Pearson VUE | CySA+ |
|---|---|---|---|
| Application fee | $100 x 1 | $100 x 1 | None |
| Exam voucher | $950 x 1 | $1,199 x 1 | $439 x 1 |
| Renewal fee over 3 years | $80 x 3 = $240 | $80 x 3 = $240 | $150 x 1 cycle |
| Three-year total | $1,290 | $1,539 | $589 |
Source: EC-Council eligibility and continuing-education fee pages; CompTIA US store on the CySA+ V4 page and its renewal-fee page. All prices in US dollars, read October 12, 2026. The CEH columns are the self-study route. The CySA+ $150 assumes renewal by CEUs; we did not check the cost of CompTIA's CertMaster CE route.
With no security work behind you, the CEH route is official training, and its price is set by EC-Council's partners, so these totals do not apply: ask an EC-Council partner for a quote. With training you skip the $100 fee, so the online voucher and three yearly fees come to $1,190, plus the training price. CompTIA's CySA+ voucher with Retake Assurance, a pricier voucher option, costs $579, which makes $729 with the $150 renewal fee. The optional CEH Practical adds $550.
If you take both on the cheapest routes shown, the three-year bill is $1,879: $1,290 for the CEH plus $589 for CySA+.
Show the numbers
| Item | Fee |
|---|---|
| Fees to get certified: Exam | $439 |
| Fees to get certified: Renewal, every 3 years | $150 |
How do you keep each certification?
Both last three years. The CEH needs 120 ECE (EC-Council Continuing Education) credits and a yearly fee; CySA+ needs 60 CEUs (continuing education units) and one fee per cycle.
CEH. You earn 120 ECE credits within three years, through logged activities such as courses and conferences, and pay $80 a year. In EC-Council's credit table, passing another IT-security certification exam counts for 40 of the 120 credits. Missing credits get the CEH suspended; you have 12 months to catch up, after which it is revoked and you must pass the exam again.
CySA+. You earn 60 CEUs, CompTIA's points for approved learning, within three years and pay a $150 renewal fee for the cycle. CompTIA also offers CertMaster CE, a CompTIA course that renews the certification as a single activity. CompTIA's continuing-education FAQ says a CompTIA certification can be renewed by earning a higher-level one, and CySA+ ranks above Security+, Network+ (networking) and A+ (IT support).
Do security-analyst job ads name the CEH or CySA+?
Yes, both. We searched Adzuna for ads whose title contains the words security analyst (our cybersecurity-analyst page) or soc analyst (our SOC-analyst page) and counted an ad when its text included ceh or cysa.
| US ads (October 2026) | All ads | Containing ceh |
Containing cysa |
|---|---|---|---|
Title security analyst |
8,110 | 81 | 119 |
Title soc analyst (small sample) |
233 | 30 | 34 |
Source: Adzuna API, job ads collected in October 2026. Analysis: CertWorthIt. Method.
An ad that names both is counted in both columns, so the columns overlap and cannot be added. A mention can mean required, preferred or one option among several, and a mention does not show that the employer requires it. The searches may miss ads that spell out only Certified Ethical Hacker or Cybersecurity Analyst.
Outside the US, the counts are small, so draw no ranking from them:
- UK:
cehappeared in 4 of the 235 UK security-analyst ads (October 2026, Adzuna).cysaappeared in 10 of the 235. - India:
cehappeared in 17 of the 250 Indian security-analyst ads (October 2026, Adzuna).cysaappeared in 9 of the 250.
Our reading: employers in these ads name both credentials, and the counts do not show which one gets you hired. The role pages linked above list the skills the same ads name.
Show the numbers
| Item | Ads | Share of ads |
|---|---|---|
| SIEM | 415 | 5.1% |
| CISSP | 338 | 4.2% |
| CompTIA | 162 | 2.0% |
| CISM | 134 | 1.7% |
| CompTIA CySA+ | 119 | 1.5% |
| CompTIA Security+ | 112 | 1.4% |
| Splunk | 100 | 1.2% |
| CEH | 81 | 81 of 8,110 |
What do Reddit posters ask about the CEH and CySA+?
In the posts we collected on r/SecurityCareerAdvice, r/CompTIA, r/ITCareerQuestions and r/oscp (Reddit discussion boards), people asked which exam comes first and whether either one makes sense without experience. These are questions from a self-selected group, not statistics.
- Security+ or CySA+ first. The same question was posted in r/CompTIA and r/ITCareerQuestions. CompTIA's answer is Security+ first unless you have substantial security experience.
- CySA+ without experience. The r/ITCareerQuestions poster also asked whether CySA+ would be a waste of time without enough experience. CompTIA sets no prerequisite for it, and our counts cannot show whether a holder without that background gets interviews.
- The CEH for a first security job. One poster weighed the CEH against Security+ and other entry exams (r/SecurityCareerAdvice). See the entry rules above.
- CEH or Security+ on the road to the OSCP. Posters asked which comes first on the way to the OSCP (r/oscp). Our CEH vs OSCP page covers that route.
What we did not check
- Pass rates and salaries. We saw no pass rate on the pages we read, and we do not report salaries.
- Training prices. EC-Council's partners set CEH training prices, and we did not price CySA+ courses or books.
- Retakes and CertMaster CE. EC-Council publishes no retake price; we saw CompTIA's Retake Assurance price but not what it covers, and we did not check what CertMaster CE costs.
- When the yearly CEH fees fall due. Our totals assume one $80 fee in each of the three years.
- CySA+ delivery options. We did not check where or how CompTIA delivers the CS0-004 exam.
- Renewing one with the other. Whether CompTIA accepts the CEH toward CySA+ renewal, and whether EC-Council counts a CySA+ toward its 40-credit exam entry.
- DoD 8140. EC-Council states its CEH exams are DoD 8140 approved; we did not check what that means for either credential.
- Exam prices outside the US.
Sources
All pages below were read October 12, 2026, except where a date is given. Some EC-Council details (the 12-month reinstatement window, the five-day boot camp, partner-set training prices, the DoD 8140 statement, the retake rule and the $550 CEH Practical price) come from our catalog, last checked October 3 to 4, 2026.
- EC-Council: CEH product page, application process and eligibility, ECE policy, continuing education fees.
- CompTIA: CySA+ V4 (exam details, domains and US store prices), CySA+ V4 questions answered, earning CEUs, continuing-education renewal fees; CySA+ overview (version 3 retirement dates) and continuing-education FAQ, read October 11, 2026.
- Job ads: Adzuna API, October 2026, ads whose title contains the words
security analystorsoc analystin the US, UK and India; text includingcehorcysa. Analysis: CertWorthIt. Method. - Reddit: posts collected from r/SecurityCareerAdvice, r/CompTIA, r/ITCareerQuestions and r/oscp, linked where cited.
Questions people ask
Is the CEH or CySA+ better for a SOC analyst job?
CySA+ is the closer match to SOC work (a security operations center is the team that watches a company's systems for attacks). CompTIA built the CySA+ exam (CS0-004) around security operations, vulnerability management (finding and ranking weak spots), incident response (handling an attack) and reporting, and recommends about four years in a SOC or vulnerability-analyst role before it. The CEH (Certified Ethical Hacker, from EC-Council) tests attack methods by multiple choice. In October 2026, we counted 233 US SOC-analyst ads on Adzuna, a job-ad search site. ceh appeared in the text of 30 of them and cysa in 34; the sample is small, so we do not rank them.
CySA+ vs CEH: which exam is harder?
Neither EC-Council nor CompTIA shows a pass rate on the pages we read, so we cannot rank them. The CEH (Certified Ethical Hacker) multiple-choice exam has 125 multiple-choice questions in four hours, and its passing score runs from 60% to 85% depending on the exam form (the version of the question set you get). CySA+ (CS0-004, the version current in October 2026) has up to 85 questions in 165 minutes, including performance-based questions, which are tasks you carry out in a simulated system. It needs 750 on a scale of 100 to 900.
Can I take the CEH or CySA+ with no experience?
CompTIA sets no prerequisite for CySA+, but it recommends about four years in a SOC (security operations center) role or as a vulnerability analyst, who finds weak spots in systems. The CEH (Certified Ethical Hacker) needs two years of information-security work or EC-Council's official training; without training, you also pay a non-refundable $100 application fee. With no security job yet, start with CompTIA Security+, the core security exam that CompTIA points to before CySA+.
How much do the CEH and CySA+ cost over three years?
For someone with two years of security work on EC-Council's self-study route, the CEH (Certified Ethical Hacker) comes to $1,290 over three years: a $100 application fee, a $950 online exam voucher (a prepaid code that books the exam) and $80 a year for three years. At a Pearson VUE test center (a company that runs in-person exam centers), the voucher is $1,199 and the total $1,539. With no experience, the CEH route is official training, whose price partners set and we did not find. CySA+ comes to $589: a $439 voucher plus CompTIA's $150 renewal fee for one three-year cycle. Prices were read October 12, 2026, and exclude training, books and retakes.
Do I need Security+ before CySA+ or the CEH?
No. CompTIA sets no prerequisite for CySA+, and EC-Council's CEH eligibility rule names work experience or training, not Security+. CompTIA's blog post on the new CySA+ exam says you can take CySA+ without Security+ but does not generally recommend it unless you already have substantial security experience. For the CEH (Certified Ethical Hacker), EC-Council asks for two years of information-security work or its official training.
Which do US security-analyst job ads name, the CEH or CySA+?
Both. In October 2026, we counted 8,110 US ads on Adzuna, a job-ad search site, whose title contains the words security analyst. Of those ads, 81 contained ceh (Certified Ethical Hacker) and 119 contained cysa (CompTIA CySA+). An ad naming both counts in both, and a mention does not show that the employer requires the credential.