Quick answer
The CompTIA cybersecurity pathway in 2026 runs: A+ and Network+ for foundations, Security+ (SY0-701) as the core credential, then CySA+ (defense), PenTest+ (offense), and SecurityX (expert, formerly CASP+). Exams run roughly $400-460 each at US list prices — check store.comptia.org — and Security+ alone satisfies US DoD 8140 baseline requirements for many roles.
The old version of this guide (2020) recommended certificates that have since been renamed and exams that have been retired. CompTIA's cybersecurity ladder is still the most employer-recognized vendor-neutral route into the field, but the naming and the exam codes have moved, and studying from a stale roadmap wastes months. Here is the current structure, what each certification actually qualifies you for, and what the route costs in 2026.
All certificate pages referenced here are CompTIA's own: Security+, CySA+, PenTest+ and SecurityX.
The pathway in 2026
| Stage | Certification | Exam code | What it qualifies you for |
|---|---|---|---|
| Foundations | A+ | Core 1 & 2 (V15) | Help desk, desktop support — the classic entry door |
| Foundations | Network+ | N10-009 | Networking fundamentals; junior network roles |
| Core security | Security+ | SY0-701 | Security admin, junior SOC; DoD baseline credential |
| Specialist | CySA+ | CS0-003 | SOC analyst, threat hunting, vulnerability management |
| Specialist | PenTest+ | PT0-003 | Penetration testing, offensive security |
| Expert | SecurityX | CAS-005 | Security architect; senior/principal roles |
Two naming notes that trip up anyone reading older material: CASP+ is now SecurityX (renamed in 2024, exam CAS-005), and "the cybersecurity pathway" on CompTIA's site specifically means Security+ → CySA+ → PenTest+ → SecurityX. A+ and Network+ sit upstream as recommended foundations, not as part of the cybersecurity stack proper.
How far up do you actually need to climb?
For broader context on where these credentials sit among their peers, our rundown of the top technology certifications dominating the job market places them alongside Cisco and cloud options, and our guide to starting a new IT career covers the routes that begin before certificates. For most people entering the field, Security+ is the destination and CySA+ or PenTest+ is the first fork. Security+ remains the single most-requested baseline certification in security job listings, and it carries a distinction the others do not: it is approved for US Department of Defense 8140 (formerly 8570) baseline requirements, which makes it effectively mandatory for many government and contractor roles.
After that, choose by direction rather than by collecting certificates:
- Defensive (blue team): CySA+ — its 2026 update emphasizes applied, scenario-based SecOps: threat hunting, vulnerability management, detection and response.
- Offensive (red team): PenTest+ — though hiring managers in offensive security weight hands-on proof (labs, CTF records, Home Lab writeups) more heavily than certificates; our piece on penetration testing certifications covers that side in depth.
- Leadership/architecture: SecurityX — the expert tier, sitting alongside (not replacing) years of experience.
Certification-stacking beyond that point has diminishing returns; employers hiring senior people read experience first.
What it costs in 2026
CompTIA raised US exam prices in mid-2026. Current ballparks: Security+ around $425 at list price, with CySA+, PenTest+ and SecurityX in the ~$425-540 band depending on the exam. Authorized resellers (the discount-voucher market) commonly shave 10-30% off list — worth using, but buy only from CompTIA's authorized partner list, because gray-market vouchers get invalidated. Budget realistically for the full journey: foundations (A+ is two exams) plus Security+ plus one specialist exam lands in the $1,200-2,000 range at list price before study materials, and official CompTIA bundles or self-study books change that math considerably.
How to actually pass
- Match the exam objectives, not the marketing. Download the current objectives PDF for your exact exam code (SY0-701, not SY0-601, and so on) and treat it as the syllabus. Exam content tracks those objectives precisely.
- Do performance-based questions deliberately. Security+ and above include scenario/interactive items; practice with the official sample questions so their format is not a surprise on exam day.
- Hands-on beats flashcards past Security+. CySA+ and PenTest+ reward people who have run the tools — set up a lab (even virtual), use the SIEM and scanning tools, and read the docs. Practice tests flag weak spots; they do not build the judgment the scenario questions test.
- Schedule the exam before you feel ready. A booked date converts open-ended studying into a plan; readiness arrives around the booked date, rarely before.
Is the pathway still worth it in 2026?
For vendor-neutral, employer-recognized entry into cybersecurity: yes, and the DoD 8140 approval keeps Security+ uniquely practical for government-adjacent work. The honest caveats: certificates get interviews, portfolios get offers — pair each exam with demonstrable work; and experienced professionals already inside IT sometimes skip straight to Security+ without A+/Network+, since their experience covers the foundations. The route is a ladder, not a toll road — climb the rungs you need.
FAQ
What is the CompTIA cybersecurity pathway?
The recommended sequence Security+ → CySA+ → PenTest+ → SecurityX, preceded by optional A+ and Network+ foundations. Security+ establishes core security skills, CySA+ covers defensive analysis, PenTest+ covers offensive testing, and SecurityX (formerly CASP+) is the expert-level architecture credential.
Is CASP+ still a certification?
The name retired: CASP+ became SecurityX in 2024, with the current exam CAS-005. If you hold CASP+, it remains valid through its renewal cycle; new candidates should register for SecurityX instead. Older guides still using the CASP name are referring to this same credential.
Can I get a cybersecurity job with just Security+?
Yes — it is the most common baseline credential in entry-level security job listings and satisfies US DoD 8140 requirements for many roles. Realistically, Security+ plus demonstrable hands-on work (home lab, TryHackMe/Hack The Box progress, help-desk experience) is the combination that gets interviews.
How much do CompTIA exams cost in 2026?
Around $425 at US list price for Security+ after CompTIA's mid-2026 increase, with the specialist and expert exams running roughly $425-540. Authorized resellers typically discount 10-30%. Verify current pricing at CompTIA's own store before budgeting, as prices vary by region and change periodically.
Do CompTIA certifications expire?
The three-year A+ through SecurityX certifications renew through the CE (Continuing Education) program: completing approved training, higher certifications, or the CertMaster CE course. Security+ CE activities can also renew the lower certificates, so continuing up the pathway keeps earlier certifications current.
Is A+ necessary before Security+?
Not strictly. A+ and Network+ build the foundations that Security+ assumes, and career-switchers with zero IT background benefit from them. People already working in IT support or networking usually go straight to Security+ and fill specific gaps as they study — the pathway is recommended, not compulsory.
