SecurityX CAS-005 Exam Guide 2026 (formerly CASP+)
CASP+ became SecurityX with CAS-005. It is the same tier of exam — CompTIA’s most advanced — but the objectives were cut from 28 to 23 and rebuilt around cloud-native, AI and post-quantum concerns.
On this page
SecurityX is CompTIA's most advanced security certification, sitting above Security+, CySA+ and PenTest+. It is the exam formerly known as CASP+, rebranded with the release of exam code CAS-005 in December 2024.
The CASP+ rebrand, and what it means
Two practical consequences.
If you already hold CASP+, nothing breaks. Your certification status and continuing-education programme are unaffected, and active holders automatically receive the rebranded SecurityX badge. You do not resit anything.
If you are studying, make sure your material is CAS-005. The previous version, CAS-004, retired on 17 June 2025. CompTIA also consolidated the objectives from 28 down to 23 — which streamlines the exam without making it easier, since the reduction came from merging overlapping topics rather than cutting content.
Exam format — and the scoring surprise
SecurityX is reported pass/fail only, with no scaled score. Every other CompTIA exam in this family reports a number on a 100–900 scale. Practically it means there is no “how close was I” feedback and no target number to aim at — prepare to be comfortably over the line rather than optimising for a score.
The 90 questions mix multiple-choice with performance-based questions, and at this level the PBQs carry real weight. 165 minutes is generous per question, but PBQs consume time disproportionately, so bank time on the multiple-choice items.
The four domains and their weights
Engineering and Architecture together are 58% of the exam. This is a build-and-design credential far more than a policy one, which is the clearest difference from CISSP — a common alternative at this level.
What is genuinely new in CAS-005
The rebuild targeted the areas that changed most since CASP+ was designed.
If you are working from older CASP+ material, those five are your gap list.
What the performance-based questions involve
PBQs are where SecurityX separates itself from a multiple-choice security exam, and where most of the time pressure comes from.
Expect to be dropped into a scenario and asked to do something rather than identify it: match controls to a described architecture, order the steps of a response, complete a configuration, or analyse output and choose the remediation. The underlying skill is the same one the job requires — given an imperfect environment and a requirement, decide what to change.
Three habits help:
- Read the requirement twice before touching anything. PBQs frequently include constraints in the last sentence that invalidate the obvious answer.
- Give yourself a hard time budget. Decide in advance that no single PBQ gets more than about six minutes on the first pass. Flag it and come back with whatever time the multiple-choice items leave you.
- Answer partially rather than not at all. Leaving a PBQ untouched guarantees nothing; a reasoned partial attempt may not.
Renewal and continuing education
SecurityX runs on CompTIA’s standard three-year continuing-education cycle. The detail worth knowing is that it sits at the top of CompTIA’s security stack, so renewing SecurityX also renews the certifications beneath it — Security+, CySA+ and PenTest+ among them.
If you hold several CompTIA security certifications, that consolidation is a genuine argument for taking SecurityX beyond the credential itself: one renewal cycle instead of several, all satisfied by the same continuing-education activity.
Existing CASP+ holders keep their cycle unchanged through the rebrand — the badge changes, the renewal obligations do not.
Who should take it
CompTIA's recommendation is blunt: 10 years of general IT experience including 5 years hands-on security, with knowledge equivalent to Network+, Security+, CySA+, Cloud+ and PenTest+.
The distinguishing feature versus CISSP is that SecurityX stays technical. CISSP is managerial and broad; SecurityX expects you to design and implement. If your career is heading toward hands-on security architecture rather than security management, SecurityX is the better fit — and it is one of the few advanced certifications with performance-based questions, so it demonstrates practical skill rather than recall.
How to prepare
The study-time calculator will size this to your hours, and the comparison tool puts SecurityX beside CISSP if you are choosing between them.
Frequently Asked Questions
Is SecurityX the same as CASP+?
Yes. CompTIA rebranded CASP+ to SecurityX with the CAS-005 release in December 2024. Existing CASP+ holders keep their certification status and automatically receive the SecurityX badge.
What is the passing score for CAS-005?
There isn't one in the usual sense. SecurityX is reported pass/fail only, with no scaled score. That is unusual for CompTIA, whose other exams score on a 100-900 scale.
How long is the SecurityX exam?
165 minutes for a maximum of 90 questions, mixing multiple-choice and performance-based questions.
What experience does SecurityX assume?
CompTIA recommends a minimum of 10 years of general hands-on IT experience including 5 years of hands-on security, plus foundational knowledge equivalent to Network+, Security+, CySA+, Cloud+ and PenTest+.
Practise SecurityX Before You Book
500–1,000+ practice questions with worked explanations, written against the current exam objectives.
SecurityX Practice Test
Practice Before You Book
500–1,000+ practice questions per exam with detailed explanations, across Azure, AWS, GCP, security, and AI certifications.