CySA+ CS0-003 to CS0-004: What Changed, and Which One to Sit
For a few months both versions are live at once. Which one you should book depends on when you can realistically sit it — and the answer is not automatically “the newest”.
On this page
CompTIA CySA+ is mid-career blue-team certification — detection, analysis and response. It is currently in a transition window with two live versions, which makes “which one do I book” a real question rather than a trivial one.
The dates that actually matter
Official V3 learning products disappear on 22 November, a full month before the V3 exam does. If you intend to sit CS0-003, buy your study material before that date — otherwise you are preparing for a live exam with no current official resources.
Which version should you sit?
| Your situation | Sit |
|---|---|
| Already deep into CS0-003 material and can test before 22 Dec 2026 | CS0-003. Finish what you started |
| Starting from scratch today | CS0-004. No reason to learn a version that expires within months |
| Testing in a language other than English | Either — translated V3 runs to 23 Mar 2027 |
| Unsure you can be ready before December | CS0-004. Do not gamble on a hard deadline |
| Employer requires it this quarter | Whichever you can pass soonest — the credential is identical |
The key point: the certification is the same either way. CySA+ is CySA+; the exam version is not printed on your credential and the three-year renewal cycle is unchanged. Choose on readiness and deadline, not prestige.
CS0-003 domains and weights
Security operations and vulnerability management are 63% between them. That distribution tells you what CySA+ is really testing: day-to-day analyst work, not incident-command theory.
Reporting and Communication at 17% is the domain candidates most often underestimate. It is nearly a fifth of the exam and it is the easiest to prepare, because the content is stable and largely about audience, format and escalation rather than technology.
What each domain actually asks
The domain titles are broad enough to be unhelpful on their own. Here is what sits behind each.
Security Operations — 33%
The analyst’s day. Reading and correlating logs, recognising malicious activity in network and host telemetry, understanding attack techniques well enough to spot them, and using the tooling — SIEM queries, packet analysis, endpoint telemetry. Questions tend to show you evidence and ask what it indicates or what you check next.
Vulnerability Management — 30%
Scanning, interpreting results, and — the part that carries most of the marks — prioritisation. Knowing that a vulnerability exists is easy; deciding which of two hundred findings gets fixed this sprint is the tested skill. Expect scoring systems, asset context, exploitability and compensating controls.
Incident Response Management — 20%
The process end to end: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Also the artefacts — what evidence to preserve and how — and the decision points where an analyst escalates rather than acts.
Reporting and Communication — 17%
Vulnerability and incident reporting, stakeholder communication, and the metrics that get reported upward. Mostly about audience: the same finding is described differently to an engineer, a service owner and an executive. Stable, learnable content — and nearly a fifth of the exam.
Exam format
Multiple-choice plus performance-based questions. CompTIA recommends Network+ and Security+ or equivalent knowledge, with a minimum of four years of hands-on experience as an incident response analyst, SOC analyst or equivalent.
What changed in V4
CompTIA rebalanced the domains and added coverage of AI, cloud, automation and zero trust — the same modernisation pattern visible across the current CompTIA refresh cycle and in SecurityX CAS-005.
If you are sitting V4, treat those four areas as additive study on top of any V3 material you already have. The analyst fundamentals — triage, vulnerability prioritisation, response process, reporting — carry across essentially intact.
How to prepare
The study-time calculator will tell you whether the December deadline is realistic for your schedule.
What CySA+ leads to
CySA+ sits in the middle of CompTIA’s security stack — above Security+, below SecurityX — and it is the point where a career usually branches.
| Direction | What it looks like | Where to go next |
|---|---|---|
| Deeper into defence | SOC analyst → senior analyst → detection engineering | Vendor SIEM certifications, threat-hunting training |
| Toward offence | Understanding attacks well enough to emulate them | PenTest+, then hands-on offensive work |
| Toward architecture | Designing the controls rather than watching them | SecurityX |
| Toward cloud security | The same analyst skills, applied to cloud telemetry | SC-500 or a cloud-vendor security certification |
| Toward management | Owning the programme rather than the alerts | CISSP |
The reason CySA+ is a useful branch point is that its content is genuinely foundational to all five. Log analysis and detection feed detection engineering. Understanding attacker behaviour feeds offensive work. Vulnerability prioritisation feeds architecture and risk. Nothing you learn for it is wasted, whichever way you turn.
Keep a running list of the detections and vulnerabilities you find genuinely interesting. After six months of SOC work most people can tell which half of the job energises them — the analysis or the engineering — and that answer is a better guide to your next certification than any roadmap diagram.
On renewal: CySA+ runs a three-year continuing-education cycle, and it is one of the certifications that renewing SecurityX also renews. If you expect to take SecurityX eventually, that consolidation is worth factoring into the timing.
Cost and booking
CompTIA prices by region and runs periodic promotions, so treat the checkout page as the only reliable figure. Two things are worth budgeting for beyond the exam fee itself.
The retake. CompTIA’s first retake carries no mandatory waiting period, but subsequent attempts do. If your timeline is tight against the December V3 deadline, plan as though you get one attempt rather than treating a resit as a fallback.
Vouchers and bundles. CompTIA sells exam vouchers separately from study material, and bundles are usually cheaper than buying both. Given V3 learning products disappear on 22 November while the exam itself runs to 22 December, anyone taking the V3 route should buy the bundle rather than the voucher alone — otherwise you own an exam booking and no current official material.
Frequently Asked Questions
When does CySA+ CS0-003 retire?
The English CS0-003 exam retires on 22 December 2026. English learning products retire a month earlier on 22 November 2026, and translated versions run until 23 March 2027.
Is CS0-004 available now?
Yes. CySA+ V4 launched on 23 June 2026, so both V3 and V4 are bookable at the time of writing.
Is a CySA+ earned on CS0-003 worth less?
No. The certification is CySA+ regardless of which exam version you passed, and it carries the same three-year renewal cycle. The version number is not printed on your credential.
What is the passing score for CS0-003?
750 on a scale of 100 to 900, from a maximum of 85 questions in 165 minutes.
Practise CySA+ Before You Book
500–1,000+ practice questions with worked explanations, written against the current exam objectives.
CySA+ Practice Test
Practice Before You Book
500–1,000+ practice questions per exam with detailed explanations, across Azure, AWS, GCP, security, and AI certifications.