CompTIA Cybersecurity Analyst (CySA+)

What it is

CySA+ (Cybersecurity Analyst) is CompTIA's intermediate certification for defensive security work: monitoring, detecting and responding to threats, and managing vulnerabilities. Where Security+ proves you understand the vocabulary of security, CySA+ is about the daily work of an analyst in a security operations centre (SOC), reading alerts and logs, deciding what matters, and communicating it.

Which version is current

As of 2026-09, per CompTIA's official pages:

• CySA+ V4, exam CS0-004 launched on June 23, 2026. It has a maximum of 85 questions, lasts 165 minutes, and needs 750 on a 100 to 900 scale to pass.
• CySA+ V3, exam CS0-003 is retiring. The English exam retires on December 22, 2026; the Japanese, Portuguese and Spanish versions retire on March 23, 2027.

If you are starting now, study for CS0-004 unless you are certain you will sit the older exam before it retires.

What the exam covers

CompTIA lists four domains for V4: Security Operations (34%), Vulnerability Management (26%), Incident Response and Management (24%), and Reporting and Communication (16%). The last domain is worth noticing: a good analyst's value is often in a clear, calm write-up that other people can act on.

Prerequisites

There are no formal prerequisites, but CompTIA recommends about four years in a SOC analyst or vulnerability analyst role. Students can still take it earlier, but it is much easier with Security+ level knowledge and real hands-on practice in log analysis, which platforms such as LetsDefend, a home Wazuh lab and TryHackMe's SOC content provide.

Free versus paid

The exam is paid. CompTIA's certification page did not show an exam price when checked, and prices vary by country, so check the CompTIA store for your region. Study materials range from CompTIA's own paid learning products to free resources: NIST SP 800-61, MITRE ATT&CK and vendor documentation cover much of the underlying knowledge.

Time needed

Most people who already hold Security+ spend a few months preparing alongside work or study. The larger investment is the hands-on practice that makes the scenarios on the exam feel familiar.

What you can do afterwards

CySA+ is a signal for SOC analyst, threat detection and vulnerability management roles. It pairs well with a portfolio: a written incident investigation from a lab, detection rules you have tested, or a short report on a home lab setup.

Common questions

Security+ or CySA+ first? Security+ first for almost everyone. CySA+ assumes that foundation.

Is it recognised outside the US? It is vendor neutral and used internationally, though how much employers weigh it varies by country and company. Check local job listings.

Does it expire? CompTIA certifications are valid for three years and renewed through continuing education; check the current rules on CompTIA's site.