CySA+ vs CASP+ (now SecurityX): which exam fits your job?
In CySA+ vs CASP+, take CySA+ (CompTIA Cybersecurity Analyst) first if you detect, analyze and respond to threats. CASP+, renamed CompTIA SecurityX in December 2024, is CompTIA's advanced exam for security architects and senior security engineers. With less than ten years in IT, take CySA+ first; CompTIA recommends ten years in IT, five in security, before SecurityX.
In October 2026, the word cysa appeared in 119 of the 8,110 US security-analyst ads on Adzuna, a job-ad search site, and the word casp in 48 of the 8,110 ads. Those are analyst jobs, the work CySA+ is built for; the job-ad section explains what each word catches and misses.
Rename · Next step · Job ads · Exams · Cost · Renewal · DoD 8140 · Worth it
| CompTIA CySA+ | CompTIA SecurityX (formerly CASP+) | |
|---|---|---|
| Written for | Security analysts in security operations and vulnerability management | Security architects and senior security engineers |
| Current exam | CS0-004 (V4), launched June 23, 2026 | CAS-005 (V5), launched December 17, 2024 |
| Recommended experience | About 4 years as a SOC (security operations center) or vulnerability analyst | 10 years of hands-on IT, including 5 in hands-on security |
| Required prerequisite | None listed | None listed |
| US exam voucher | $439 | $544 |
| Renewal every three years | 60 CEUs and a $150 CE fee | 75 CEUs and a $150 CE fee |
CySA+ and SecurityX side by side. Source: CompTIA exam and continuing education pages under Sources, with the date each was read. A SOC is the team that watches a company's systems for attacks; vulnerability management is finding and fixing weak spots in systems. A voucher is the prepaid code you buy to book an exam. CEUs (continuing education units) are credits for approved learning and work, and the CE (continuing education) fee is what CompTIA charges per renewal cycle.
Show the numbers
| Country | CompTIA SecurityX (CASP+) | CompTIA CySA+ |
|---|---|---|
| United Kingdom | 1 of 235 | 4% |
| India | 2 of 250 | 4% |
| United States | 48 of 8,110 | 1.5% |
| Brazil | 0 of 434 | 3 of 434 |
CompTIA SecurityX (CASP+) or CompTIA CySA+: which do employers name more?
Instant answer from October 2026 job ads. No email needed.
CompTIA CySA+ is named in more job ads in the United States.
Source: Adzuna job ads, October 2026.
Get your full report
Two optional questions shape your first step. No email needed.
On this page
- Are CASP+ and SecurityX the same certification?
- Is SecurityX the next step after CySA+?
- CompTIA CASP+ vs CySA+: which do US job ads name?
- How do the CySA+ and SecurityX exams differ?
- What do CySA+ and SecurityX cost over three years?
- Does SecurityX renew CySA+?
- Which DoD 8140 work roles does CompTIA map to each?
- Is SecurityX worth it after CySA+?
- What we did not check
- Sources
Are CASP+ and SecurityX the same certification?
Yes. CASP+ stood for CompTIA Advanced Security Practitioner. In a blog post dated December 18, 2024, CompTIA wrote that CASP+ "is now the new CompTIA SecurityX," and the next exam version, CAS-005, went live on December 17, 2024, replacing CAS-004.
People who already held CASP+ keep it. CompTIA says the new name "will not affect the certification status of current CASP+ certification holders or the continuing education program." As of a 2024 archived copy of CompTIA's former CASP+ page, unexpired CASP+ vouchers could be used for the SecurityX exam. CASP, CASP+ and SecurityX all refer to one certification.
Is SecurityX the next step after CySA+?
It can be, years later. CompTIA's SecurityX page names CySA+ in the knowledge it recommends ("Network+, Security+, CySA+, Cloud+, and PenTest+ or equivalent knowledge") and pairs it with ten years of IT work, five in security. For CySA+, CompTIA recommends about four years in a SOC or vulnerability-analyst role. Cloud+ is CompTIA's cloud exam.
The two exams aim at different jobs. CompTIA lists security analyst, SOC analyst, vulnerability analyst, threat intelligence analyst and incident responder among the roles CySA+ prepares you for. For SecurityX it names security architects and senior security engineers, the people who design and build an organization's defenses.
CompTIA's renewal hierarchy, which decides which certification renews which, ranks them from high to low as SecurityX; then CySA+ and PenTest+ (penetration testing, attacking systems with permission to find weak spots); then Security+, then Network+, then A+ (CompTIA's core security, networking and entry-level IT exams).
- No security job yet. CySA+ has no required prerequisite, so you may take it now. CompTIA's own CySA+ blog says taking it without Security+ is "generally not recommended" unless you already have "substantial cybersecurity experience." Start with Security+, CompTIA's core security exam; our CySA+ vs Security+ comparison covers that order, and our cybersecurity roadmap lays out the steps.
- Holding Security+, under ten years in IT. If you want analyst work, CySA+ is the next CompTIA exam in that direction; SecurityX comes later, after the ten years CompTIA recommends.
- Working in a SOC or on vulnerability scans. CySA+ matches that work. Our SOC-analyst page shows what those ads ask for, and our CEH vs CySA+ page compares CySA+ with an ethical-hacking exam (CEH, Certified Ethical Hacker).
- Holding CySA+, moving into design or engineering. SecurityX is the CompTIA exam aimed at that kind of work, once your experience is near the ten years CompTIA recommends. Until then, keep CySA+ current (60 CEUs or one $150 CE fee every three years). Our SecurityX page covers the exam on its own, and our Security+ vs SecurityX comparison covers it from a Security+ start.
- Already an architect or senior engineer without CySA+. SecurityX is open to you without CySA+ (see the next question). If you add CySA+ later, the SecurityX renewal keeps it current when you select SecurityX as your intent level, as the renewal section explains.
Can you skip CySA+ and take SecurityX first?
Yes. CompTIA lists no required prerequisite on the SecurityX page, so you can book it without CySA+ or any other CompTIA certification. The experience and knowledge lines are recommendations.
CompTIA CASP+ vs CySA+: which do US job ads name?
In US security-analyst ads, both words appear; the table shows each count with its base. We searched Adzuna for the job title security analyst (for Brazil, the Portuguese analista de segurança) together with the quoted word casp or cysa, the same kind of search for both. The US row is the main one; the other countries are shown alongside it.
| Country | Security-analyst ads containing cysa |
Security-analyst ads containing casp |
|---|---|---|
| United States | 119 of the 8,110 | 48 of the 8,110 |
| United Kingdom | 10 of the 235 | one of the 235 |
| India | 9 of the 250 | 2 of the 250 |
| Brazil | 3 of the 434 | none of the 434 |
Source: Adzuna API, October 2026; each cell gives the ads containing the word out of all ads returned by the security-analyst search in that country. Analysis: CertWorthIt. Method.
What each word catches: cysa matches CySA and CySA+, and misses ads that spell out only "Cybersecurity Analyst." casp matches CASP and CASP+, and misses ads that write only SecurityX, so the casp column is a minimum for the certification. An ad that names both is counted in both columns, and a mention does not show whether the employer requires the certification, prefers it or lists it as one option.
Security analyst is the job CySA+ is written for. It is not the job SecurityX targets, so this US row compares the two in analyst ads only and says nothing about architect or engineer ads. The UK, India and Brazil rows are small samples, so read them side by side with care and draw no order from them. Our cybersecurity-analyst page shows what else US analyst ads ask for.
We also counted CySA+ in a US Adzuna search for soc analyst: in October 2026, the word cysa appeared in 34 of the 233 of the ads it returned. We have no casp count for SOC-analyst ads.
Show the numbers
| Item | Ads | Share of ads |
|---|---|---|
| SIEM | 415 | 5.1% |
| CISSP | 338 | 4.2% |
| CompTIA | 162 | 2.0% |
| CISM | 134 | 1.7% |
| CompTIA CySA+ | 119 | 1.5% |
| CompTIA Security+ | 112 | 1.4% |
| Splunk | 100 | 1.2% |
| CEH | 81 | 81 of 8,110 |
| CompTIA SecurityX (CASP+) | 48 | 48 of 8,110 |
How do the CySA+ and SecurityX exams differ?
CySA+ gives up to 85 questions and a scaled score; SecurityX gives up to 90 and reports only pass or fail. Both allow up to 165 minutes.
| CySA+ (CS0-004) | SecurityX (CAS-005) | |
|---|---|---|
| Questions | Maximum 85, multiple-choice and performance-based | Maximum 90, multiple-choice and performance-based |
| Time | 165 minutes | Up to 165 minutes |
| Result | 750 needed on a 100 to 900 scale | Pass or fail, no scaled score |
| Languages | English; French, Japanese, Spanish and Portuguese listed as coming soon | English; other languages to be determined |
| Domains (topic areas) | Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, Reporting and Communication 16% | Security engineering 31%, security architecture 27%, security operations 22%, governance, risk, and compliance 20% |
Source: CompTIA's CySA+ V4 page, its CySA+ V4 blog post (question types) and the SecurityX page.
Performance-based questions (PBQs) ask you to carry out a task in a simulated system rather than choose an answer; the CompTIA pages we read give no count of them for either exam. A scaled score turns your raw result into a fixed range, here 100 to 900.
The domain weights show the difference in job. Security operations, the daily watching and handling of alerts, is the largest CySA+ domain (34%) and the second-smallest on SecurityX (22%). SecurityX puts its two largest weights on engineering and architecture, and adds governance, risk, and compliance (the rules and risk decisions a company has to meet), which has no CySA+ domain of its own.
CompTIA retires the English CS0-003 exam (V3) on December 22, 2026, and its translated versions on March 23, 2027, so new CySA+ study material should cover CS0-004. For CAS-005, CompTIA gives no exact retirement date; its page estimates 2027, about three years after launch.
Show the numbers
| Item | CompTIA SecurityX (CASP+) | CompTIA CySA+ |
|---|---|---|
| Questions | 90 questions | 85 questions |
| Exam time | 165 minutes (2 h 45 min) | 165 minutes (2 h 45 min) |
| Passing score | pass/fail only | 750 (scale 100–900) |
| Format | Multiple choice, performance-based tasks | Multiple choice, performance-based tasks |
| Languages | English | 1 language |
What do CySA+ and SecurityX cost over three years?
With one attempt each, CySA+ comes to $589 over three years and SecurityX to $694, at CompTIA US store prices checked October 12, 2026. Each total is one exam voucher plus one $150 CE fee for the three-year cycle.
| Item | CySA+ | SecurityX | Both, SecurityX before CySA+ renewal is due | Both, SecurityX after one CySA+ renewal |
|---|---|---|---|---|
| Exam voucher, one attempt | $439 | $544 | $439 + $544 | $439 + $544 |
| CE fees | $150 (one cycle) | $150 (one cycle) | $150 (SecurityX fee only) | $150 (CySA+) + $150 (SecurityX) |
| Total | $589 | $694 | $1,133 | $1,283 |
| With Retake Assurance vouchers instead (terms not checked) | $579 + $150 = $729 | $709 + $150 = $859 | $579 + $709 + $150 = $1,438 | $579 + $709 + $150 + $150 = $1,588 |
Source: voucher prices from CompTIA's CySA+ V4 and SecurityX pages (US store); CE fee from CompTIA's renewal fee page. Sums: CertWorthIt. Training and tax are not included.
Retake Assurance is a higher-priced voucher option sold in CompTIA's store; we did not read what it covers, so check the store before choosing it. Without it, CompTIA's retake policy charges the exam price on every attempt, so a second try adds another $439 for CySA+ or $544 for SecurityX. There is no wait before a second attempt and at least 14 days before a third.
The $1,133 for both assumes you pass SecurityX inside your first CySA+ cycle, so one SecurityX CE fee keeps both current. If you renew CySA+ on its own once and add SecurityX in the next cycle, the two CE fees bring the one-attempt total to $1,283; each further CySA+-only cycle adds $150.
Show the numbers
| Item | Fee |
|---|---|
| CompTIA SecurityX (CASP+): Fees to get certified: Exam | $544 |
| CompTIA SecurityX (CASP+): Fees to get certified: Renewal, every 3 years | $150 |
| CompTIA CySA+: Fees to get certified: Exam | $439 |
| CompTIA CySA+: Fees to get certified: Renewal, every 3 years | $150 |
Does SecurityX renew CySA+?
Yes. On CompTIA's page about renewing multiple certifications, the SecurityX CE cycle "fully renews" CySA+, PenTest+, Security+, Network+ and A+. It does not work in reverse: CySA+ fully renews Security+, Network+ and A+, and SecurityX sits above it.
Two conditions come with the fee saving. CompTIA says you only pay CE fees for your highest-level certification, and you must select that certification as your "intent level" (the one you tell CompTIA you are renewing) when you pay fees or submit CEUs. CE fees are not waived where the higher certification does not fully renew the lower one; SecurityX does fully renew CySA+, so that exception does not apply to this pair.
Renewing on your own credits takes 60 CEUs for CySA+ or 75 for SecurityX, earned within the three-year cycle. CompTIA also offers CertMaster CE, an option that renews a certification as a single activity. CompTIA's CE program FAQ adds that if you earn a higher-level certification to meet your renewal, you do not pay the CE fee for the lower one.
Which DoD 8140 work roles does CompTIA map to each?
CompTIA's mapping lists both, for sets of roles that overlap only in part. DoD 8140 is the US Department of Defense rule on qualifications for its cyber workforce, set out in the manual DoDM 8140.03 and organized by work role, a defined job type with a code. CompTIA's framework alignment page says seven of its certifications, CySA+ and SecurityX included, are approved across 30 work roles under it.
On that page, we counted 31 rows with an "Approved:" list. CySA+ is in 10 of them and SecurityX in 19; 6 list both:
| Rows naming | Work roles on CompTIA's page |
|---|---|
| Both | Cyber Defense Analyst (511), Cyber Defense Incident Responder (531), Vulnerability Assessment Analyst (541), Systems Security Analyst (461), Cyber Crime Investigator (221), Security Control Assessor (612) |
| CySA+ only | Cyber Defense Forensics Analyst (212), Warning Analyst (141), Forensics Analyst (211), All-Source Analyst (111) |
| SecurityX only | 13 rows, including Security Architect (652), Enterprise Architect (651), Systems Requirements Planner (641), Information Systems Security Developer (631) and Information Systems Security Manager (722) |
Source: CompTIA framework alignment page; row counts by CertWorthIt. CompTIA's text says 30 work roles, while its page lists 31 rows; our numbers count rows.
The SecurityX page itself names NICE and DoD 8140 work roles such as security architect, systems requirements planner, security control assessor and research and development specialist. NICE is a US government framework that names cybersecurity work roles. All of this is CompTIA's own mapping, and its page shows no proficiency levels, so check which credentials the exact position you apply for accepts.
Is SecurityX worth it after CySA+?
It is worth it when your work is moving from responding to alerts to designing and engineering defenses, and your experience is close to the ten years in IT, five in security, that CompTIA recommends. If you plan to stay in analyst work, CySA+ already matches that job, and our counts cover analyst ads only, so they cannot show what architect or engineer ads ask for.
Holding SecurityX simplifies renewal: under the intent-level rule above, one SecurityX CE fee per cycle keeps CySA+ current too. The CISSP (Certified Information Systems Security Professional, from the certification body ISC2) has a work-experience requirement, and ISC2 lets one approved certification replace up to one year of it (a waiver). ISC2's approved list names both CySA+ and SecurityX. Only one waiver counts, so adding SecurityX gives no second year if CySA+ already covers one. Our CISSP vs CASP comparison and CySA+ vs CISSP comparison cover those choices.
What we did not check
- Ads that name only SecurityX or only "Cybersecurity Analyst." Our word searches miss them.
- Architect and engineer ads. Our counts cover security-analyst ads, plus one CySA+ count in US SOC-analyst ads.
- What each match means. We did not read the matching ads one by one.
- Pass rates and salaries. This page uses neither.
- Retake Assurance terms and the price of CertMaster CE.
- Visible SecurityX price. The $544 SecurityX price did not show in the page text we read, only in the store's price list; confirm it in CompTIA's store before you buy.
Sources
CompTIA and ISC2 pages were read between October 7 and October 12, 2026; voucher prices were checked October 12, 2026. An archived copy is a saved copy of a page from the year given.
- CompTIA CySA+ pages: CySA+ V4 (exam details, domains, recommended experience, vouchers), CySA+ (V3 retirement dates, read October 11, 2026), CySA+ V4 questions answered (question types, roles, Security+ advice).
- CompTIA SecurityX pages and policy: SecurityX (exam details, domains, recommended experience, work roles, vouchers), Introducing CompTIA SecurityX, former CASP+ page (archived copy from 2024), retake policy.
- CompTIA continuing education: CE renewal fees, earning CEUs, renewing multiple certifications, CE program FAQ.
- DoD 8140: CompTIA framework alignment; row counts by CertWorthIt.
- ISC2: CISSP experience requirements.
- Job ads: Adzuna API, October 2026, security-analyst ads in the US, UK, India and Brazil and SOC-analyst ads in the US; words
cysaandcasp. Analysis: CertWorthIt. Method.
Questions people ask
Are CASP+ and SecurityX the same certification?
Yes. CompTIA renamed CASP+ (CompTIA Advanced Security Practitioner) to CompTIA SecurityX in December 2024 and released the CAS-005 exam on December 17, 2024. CompTIA says the new name does not change the status of people who already hold CASP+ or their continuing education program. CASP, CASP+ and SecurityX are one certification.
Should I take CySA+ before SecurityX, or can I skip it?
You can skip it: CompTIA lists no required prerequisite for SecurityX (formerly CASP+), so you can book it without holding CySA+ (CompTIA Cybersecurity Analyst). CompTIA does recommend ten years of hands-on IT work, five of them in security, plus knowledge at the level of Network+, Security+, CySA+, Cloud+ and PenTest+. If you work as a security analyst and are years away from that, CySA+ is the exam written for your current job.
Does SecurityX renew CySA+?
Yes. CompTIA's page on renewing multiple certifications, read October 12, 2026, says the SecurityX continuing education (CE) cycle fully renews CySA+, as well as PenTest+, Security+, Network+ and A+. You pay the $150 CE fee only for SecurityX and select it as your intent level (the certification you tell CompTIA you are renewing) when you pay or submit CEUs, the continuing education units you earn for approved learning. CySA+ does not renew SecurityX.
How much do CySA+ and SecurityX cost over three years?
At CompTIA US store prices checked October 12, 2026, CySA+ comes to $589 over three years: a $439 exam voucher (the prepaid code that books the exam) plus one $150 continuing education (CE) fee. SecurityX, formerly CASP+, comes to $694: a $544 voucher plus the same $150 fee. Holding both comes to $1,133 ($439 + $544 + $150) if you pass SecurityX before your CySA+ renewal falls due, because SecurityX then renews CySA+. If you renew CySA+ once on its own first, add its $150 fee: $1,283. Training and retakes are not included.
Which do US security-analyst job ads name, CySA+ or CASP+?
In October 2026, the word cysa appeared in 119 of the 8,110 US ads found by an Adzuna search for security analyst (Adzuna is a job-ad search site), and the word casp in 48 of the 8,110 ads. The casp count misses ads that write only SecurityX, and security analyst is the job CySA+ is written for, while CompTIA aims SecurityX at security architects and senior security engineers.
Do CySA+ and SecurityX count for DoD 8140?
CompTIA's framework alignment page, read October 12, 2026, says seven CompTIA certifications, CySA+ and SecurityX (formerly CASP+) among them, are approved across 30 work roles under DoDM 8140.03, the US Department of Defense manual on qualifications for its cyber workforce. Approval is per work role (a defined job type with a code), not per certification, and the two are listed for partly different roles. Check which credentials the exact position you apply for accepts.
Should I take CySA+ V3 or V4?
The current CySA+ (CompTIA Cybersecurity Analyst) exam is CS0-004, also called V4, launched June 23, 2026. CompTIA retires the English V3 exam, CS0-003, on December 22, 2026, and the translated V3 exams on March 23, 2027. If you will test after December 22, 2026 in English, study for CS0-004.