514,000 open cybersecurity roles in the US right now. Most of them require someone who can actually investigate alerts, not just talk about security frameworks.
That’s exactly what CompTIA CySA+ is designed to prove you can do.
If you’ve already got your Security+ and a couple of years in IT, CySA+ is probably the cert sitting between you and your next level. This guide covers everything: what the exam looks like, how long you’ll need to study, what it pays, and how to pass it the first time.
Quick note on exam version: CompTIA launched CS0-004 on June 23, 2026. CS0-003 hasn’t disappeared, it’s still bookable in English through December 22, 2026 (English study materials retire a month earlier, on November 22). Check comptia.org/certifications/cybersecurity-analyst for the exact date before you register. The content in this guide covers both versions, with CS0-004 changes called out where relevant.
What Is CySA+ and Why Does It Matter?
CySA+ (Cybersecurity Analyst+) is CompTIA’s intermediate security certification. The “intermediate” part is important. This isn’t a beginner cert. It assumes you already know the basics and want to prove you can work in a SOC, manage vulnerabilities, and respond to real incidents.
The exam is DoD 8140/8570 approved at IAT Level II. That means it’s recognised for US government and federal contractor roles, which opens a hiring category most certs can’t touch.
Most importantly, it focuses on what analysts actually do: reading telemetry, chasing down threat indicators, writing up findings, and presenting them to people who make decisions. Security+ gets you in the door. CySA+ shows you know what to do once you’re inside.
Who Should Get CySA+?
Honestly, this cert isn’t for everyone, and that’s fine.
CySA+ makes the most sense if you’re a:
- SOC Analyst (Level 1 or 2) looking to move up and formalise your skills
- Security+/Network+ holder with 2-4 years of hands-on experience wanting to go deeper on the blue team side
- IT generalist who has been pulled into security work and wants to validate it
- Junior incident responder who needs a credential that shows analyst-level capability
CompTIA recommends 3-4 years of experience before sitting the exam. You can pass without it, but the performance-based questions will be genuinely difficult if you’ve never worked in a real SOC environment.
Is CySA+ Right for You?
Ask yourself: have you worked with a SIEM before? Have you investigated a real alert, not a lab exercise? Have you written up an incident report or vulnerability finding for a manager?
If the answer is yes to most of those, you’re in good shape.
If you’re brand new to security, start with Security+ first. That cert was built for your current level.
CySA+ Exam Format: What You’re Actually Sitting
| Detail | CS0-003 / CS0-004 |
|---|---|
| Questions | Up to 85 |
| Question types | Multiple choice + performance-based |
| Time limit | 165 minutes |
| Passing score | 750 out of 900 |
| Cost (US retail) | $425 USD |
| Delivered via | Pearson VUE (in person or online proctored) |
The performance-based questions (PBQs) are the part that trips people up. These aren’t multiple choice. You’ll get a simulated environment, a log file, a SIEM dashboard, or a network diagram, and you’ll need to work through a realistic scenario. Think: “Here are 200 events from Splunk, find the compromised host and explain your reasoning.”
Budget about 20-25 minutes for each PBQ. They appear early in the exam. Skipping them to answer easier questions first is a valid tactic, but go back and actually complete them. PBQs carry significant weight. Adding a firewall to the picture? Start with what FortiGate is and how an NGFW works.
CySA+ Domains: What Gets Tested
CS0-003 covers four domains:
| Domain | Weight |
|---|---|
| 1. Security Operations | 33% |
| 2. Vulnerability Management | 30% |
| 3. Incident Response and Management | 20% |
| 4. Reporting and Communication | 17% |
Domain 1 (Security Operations, 33%) is the heart of the exam. SIEM tooling, log analysis, endpoint telemetry, network traffic analysis, SOAR automation, behavioral threat hunting. If you use Splunk, Sentinel, or any XDR platform day to day, this domain should feel familiar.
Domain 2 (Vulnerability Management, 30%) covers scanning tools, CVE prioritisation, CVSS scoring, patch workflows, cloud and web app testing. This is where knowing the difference between a critical CVE on an internet-facing server and the same CVE on an isolated dev machine matters.
Domain 3 (Incident Response, 20%) tests your knowledge of IR frameworks, containment and eradication steps, forensics basics, and evidence handling. You won’t be doing deep forensics, but you do need to understand the process from detection to lessons-learned.
Domain 4 (Reporting, 17%) is one of the newer additions. Writing technical findings for non-technical stakeholders, compliance reporting, and security metrics. This is the domain most technical people underestimate. It shows up on the exam more than people expect.
What’s New in CS0-004?
The V4 exam expands coverage on:
- AI-assisted threat detection and response
- Cloud-native and hybrid environment security
- Zero Trust architecture
- Detection engineering
- MITRE ATT&CK and MITRE D3FEND (named as required frameworks)
CS0-003 stays bookable through December 22, 2026 (English study materials retire a month earlier, November 22). If your study plan runs past that window, you’ll be sitting CS0-004, not CS0-003, so add these topics to your list now rather than finding out at registration.
CySA+ Salary: What It Actually Pays
Here’s the deal on CySA+ compensation.
The US Bureau of Labor Statistics median for information security analysts is $120,360. That’s the broad category. CySA+ holders specifically sit in the $97K-$107K range on average, depending on location, years of experience, and industry.
| Role | Typical Range (US) |
|---|---|
| SOC Analyst (L2) | $90,000-$110,000 |
| Information Security Analyst | $100,000-$120,000 |
| Threat Intelligence Analyst | $100,000-$125,000 |
| Vulnerability Analyst | $95,000-$115,000 |
| Mid-career with CySA+ | $105,000-$125,000 |
CompTIA’s own data suggests CySA+ adds $8,000-$15,000 annually over Security+ alone. That’s not nothing. Over a 5-year period, that’s $40,000-$75,000 in additional earnings, before promotions.
Salary movement after CySA+ depends on your market and what you were earning before it. The common path is a SOC Analyst holding Security+ and a few years of experience moving into an Information Security Analyst title, which usually sits a band above the SOC tier. Check current postings in your own city rather than trusting an average in a blog post, because published averages lag the market by a year or more.
That’s a typical outcome, not a best case.
How CySA+ Fits Into the CompTIA Career Ladder
CompTIA’s cybersecurity path runs like this:
Security+ (entry) --> CySA+ (intermediate) --> SecurityX (advanced)Security+ is broad and conceptual. It covers cryptography, compliance, identity management, network security. Great for getting into the field or proving a baseline to employers.
CySA+ is narrower and much more hands-on. It assumes you already know the concepts and tests whether you can apply them in real analyst scenarios. This is where you shift from “knows about security” to “does security”.
SecurityX (formerly CASP+) is for architects and senior practitioners designing enterprise security posture. Expected experience: 10 years in IT, 5 in security. Salaries push $150,000+.
CySA+ vs Security+: Which One First?
This question comes up constantly. The answer is Security+ first, always.
Security+ is the foundation. CySA+ builds on it. Trying to pass CySA+ without Security+ knowledge is like skipping Networking 101 and jumping into routing protocols. Technically possible. Practically painful.
If you have Security+ and real-world SOC experience, you’re already in a strong position for CySA+.
How Long Does CySA+ Take to Study For?
Most candidates with the right experience need 6-12 weeks. Here’s how that breaks down:
| Experience Level | Study Time |
|---|---|
| 3-4 years hands-on SOC work | 6-8 weeks, 40-60 hours total |
| 1-2 years security experience | 10-14 weeks, 80-100 hours total |
| Security+ but limited hands-on | 14-18 weeks |
The biggest prep mistake is over-indexing on video courses and under-investing in practice exams and lab work. Most people who fail CySA+ didn’t fail on conceptual questions. They struggled with PBQs.
Spend at least 20-25% of your study time in hands-on tools. TryHackMe’s SOC path, Blue Team Labs Online, and any sandbox SIEM access you can get are all worth your time. If you have access to Splunk or Microsoft Sentinel at work, use it.
How to Study for CySA+: A Practical Plan
Here’s a study approach that works for most candidates:
Week 1-2: Foundation Review
Go through the exam objectives from comptia.org. For each domain, honestly rate yourself on how comfortable you are. Security Operations and Vulnerability Management are the heaviest, so start there if you’re splitting focus.
Week 3-6: Core Study
Work through a structured course covering all four domains. The Mike Chapple/David Seidl study guide (Sybex) is the standard book recommendation. Pair it with hands-on practice in a SIEM environment.
For SOC simulation, TryHackMe’s SOC Analyst path and Blue Team Labs Online are solid free-to-low-cost options that mirror what the PBQs test.
Week 7-8: Practice Exams
Take at least 3-4 full practice exams before booking your real test. CompTIA’s own CertMaster Practice platform is one option. Third-party practice banks from Jason Dion or MeasureUp are also widely used.
Track which domain you’re losing points in. If you’re dropping marks in Domain 4 (Reporting), go back and review that material specifically. Don’t just hammer the same practice test repeatedly.
Week 9+: Fill Gaps
Address the weak spots your practice exams revealed. If you’re consistently missing questions on CVSS scoring or threat hunting methodology, that’s where your last study hours should go.
Want structured, hands-on practice for this phase of prep? Our Wazuh SIEM Workbook gives you real SOC and vulnerability-detection labs to drill the practical side, and SMEnode Academy’s cybersecurity courses cover the full CySA+ blueprint with an instructor
What Makes People Fail CySA+
Three things kill most CySA+ attempts:
1. Underestimating the PBQs. Performance-based questions look like “easy labs” until you’re in the exam with 165 minutes on the clock and a SIEM you’ve never seen before showing you 400 events. Practice with real tools, not just conceptual study.
2. Skipping Domain 4. Reporting and Communication is 17% of the exam. Most technical people wave it off as “soft skills” and don’t study it. Then they lose 8-10 questions in that domain and wonder why they didn’t pass.
3. Studying without enough hands-on experience. CySA+ assumes you can work through realistic scenarios. If you’ve never pulled a log file, investigated an alert, or written up a finding, those assumptions break down quickly. Get hands-on time, even if it’s lab-based. To get the reps in before you touch production, the FortiGate NSE4 Lab Workbook runs the scenarios in EVE-NG.
CySA+ Renewal Requirements
The cert is valid for 3 years. Renewal requires 60 Continuing Education Units (CEUs) within that period, plus a $50 annual maintenance fee ($150 over the full cycle).
CEUs can come from:
- Security training and courses
- Industry conferences and webinars
- College courses
- Higher certifications (passing SecurityX automatically satisfies the full 60 CEUs)
- Writing or teaching security content
- Documented security work
If you’re actively working in a security role, you’re probably accumulating CEUs without thinking about it. Log them as you go.
The Job Market for CySA+ Holders in 2026
The BLS projects a 33% growth rate for information security analysts through 2034, which is roughly 4x the average for all occupations. That’s what “fastest-growing occupation” actually means in practice.
Right now:
- 514,000+ open cybersecurity roles in the US (CyberSeek data)
- 3.1-3.5 million unfilled roles globally (ISC2 2024 Workforce Study)
- SOC analyst roles grew 31% year-over-year as of 2026 (StationX)
And this cert is DoD 8140 approved. Federal contracts and government security roles specifically list CySA+ as a qualifying credential at IAT Level II. That’s a substantial pipeline of positions that commercial cert holders can’t access.
Basically: demand is high, supply is limited, and the cert opens doors in both commercial and government sectors. That’s a good combination.
Looking for live instruction alongside your self-study prep? SMEnode Academy’s cybersecurity courses cover the hands-on analyst skills that translate directly to CySA+ exam performance.
Bottom Line
CySA+ is the right cert for security professionals who’ve moved past entry-level and want to formalise their analyst skills. It pays well, it’s DoD-recognised, and the job market for the roles it qualifies you for is growing fast.
The exam is genuinely challenging, mostly because of the performance-based questions. Study the right way: conceptual foundation plus hands-on practice plus multiple full practice exams before test day.
If you’re ready to book, verify the current exam version at comptia.org first. CS0-004 is live as of late June 2026.
Ready to start prepping? Our Wazuh SIEM Workbook gives you real SOC, vulnerability-detection, and incident-response labs, designed for working analysts who study in short, focused sessions, not multi-hour marathons. Want the full exam blueprint with an instructor? SMEnode Academy’s cybersecurity courses cover that.
Frequently Asked Questions
Is CySA+ worth it in 2026?
Yes, especially if you’re targeting SOC analyst, threat hunter, or vulnerability analyst roles. The cert is DoD-recognised, demand for CySA+-qualified candidates is strong, and the salary premium over Security+ is measurable.
Can I take CySA+ without Security+?
You can. There are no mandatory prerequisites. But Security+ knowledge is assumed across most of the exam content. Going in without that foundation significantly increases the difficulty.
How hard is CySA+ compared to Security+?
Harder, for most people. Security+ is broader and more conceptual. CySA+ is narrower but requires you to apply that knowledge in realistic analyst scenarios. The performance-based questions are the main difficulty spike.
What’s the difference between CS0-003 and CS0-004?
CS0-004 adds AI-assisted security operations, expanded cloud coverage, detection engineering, and MITRE ATT&CK as a named framework requirement. Core structure stays the same: four domains, 85 questions, 165 minutes.CS0-003 remains bookable in English until December 22, 2026, after that it’s CS0-004 only.
How many times can I take CySA+?
If you fail, you can retake immediately. After a second failure, CompTIA requires a 14-day waiting period before each subsequent attempt.
Sources: CompTIA.org, U.S. Bureau of Labor Statistics (bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm), ISC2 2024 Cybersecurity Workforce Study, CyberSeek, StationX Cybersecurity Job Market Report 2026
