CompTIA CySA+ (CS0-004): The Complete Guide

CySA+ is CompTIA's certification for cybersecurity analysts — the people who staff security operations centers, hunt threats, manage vulnerabilities, and drive incident response. This guide gathers the current exam facts, walks through what each domain expects, and points you toward focused resources for the parts candidates find hardest. The linked articles go deeper; this is the map.

The most important thing to get straight up front: the current version is CS0-004 (V4), which launched on June 23, 2026. It replaced CS0-003 on the same day — a same-day switchover with no overlap. If you're starting now, CS0-004 is the exam to prepare for, and using CS0-004-aligned materials matters because the objectives were refreshed.

What CySA+ validates

CySA+ confirms you can operate as a working cybersecurity analyst: continuously monitor systems, detect and analyze indicators of malicious activity, manage a vulnerability program, execute incident response, and produce reporting that turns technical findings into decisions. It's a hands-on, behavioral-analytics–focused certification — the emphasis is on doing SOC work, not reciting definitions.

Unlike entry-level Security+, CySA+ is intermediate: it assumes you already understand networking and foundational security, and it tests whether you can actually operate in a security team.

The current exam at a glance

The format is unchanged from CS0-003 — what changed is the content and the domain weighting. For a fuller breakdown, see the exam format guide.

The four domains and their weights

CS0-004 keeps the four domain names from CS0-003 but rebalances their weights:

1. Security Operations — 34%. The largest domain (up from 33%): monitoring, detecting and analyzing malicious activity, threat intelligence, and the tools of a modern SOC.
2. Vulnerability Management — 26%. Down from 30%: scanning, analysis, prioritization, and remediation of vulnerabilities.
3. Incident Response and Management — 24%. Up from 20% — the biggest single change: the full incident lifecycle, from detection through recovery and post-incident review.
4. Reporting and Communication — 16%. Down from 17%: turning findings into clear, actionable reporting for stakeholders.

The practical takeaway: CS0-004 puts more emphasis on what happens during and after an incident, and somewhat less on the mechanics of vulnerability scanning. We break all four down in the domains guide.

What's new in CS0-004

The refresh modernizes CySA+ around how SOCs actually work in 2026:

• Artificial intelligence. The biggest substantive addition. CS0-003 didn't address AI at all; CS0-004 introduces AI in security operations — using AI tooling for analysis and investigation, understanding its risks, and recognizing AI-enabled threats.
• Cloud-native and hybrid environments. Cloud resources are now part of incident scoping and vulnerability management, reflecting hybrid infrastructure.
• Automation and SOAR. More emphasis on automation concepts — SOAR playbooks for enrichment, ticketing, containment, and notification, plus knowing when automation should require human approval.
• Zero trust and modern attack methodologies. Updated to reflect current security architecture and threats.

If you studied CS0-003, most fundamentals carry over, but these additions are where you'll want to focus. Our CS0-003 to CS0-004 guide covers exactly what changed.

Do you need prerequisites?

No certification is required to register. CompTIA recommends roughly four years of hands-on experience in a SOC analyst or vulnerability analyst role, and assumes Security+ level knowledge of networking, security concepts, and defensive tooling. There's no enforced prerequisite, but candidates without that foundation tend to struggle — this is an intermediate exam that rewards real experience.

How to prepare

CySA+ punishes pure theory. The performance-based questions assume you've actually touched the tools — a SIEM, a packet capture, a vulnerability scanner, threat intelligence platforms. A realistic plan blends structured learning with serious hands-on practice.

• Follow a structured schedule. See the CySA+ study plan.
• Build hands-on and PBQ readiness. The PBQ and hands-on prep guide covers building a mini-SOC lab.
• Choose materials deliberately. Our study resources overview compares CertMaster Learn, Labs, Practice, and Perform.

Careers and the pathway

CySA+ maps to roles like SOC analyst (Tier 1–2), cyber defense analyst, incident responder, vulnerability analyst, and security operations engineer. It's DoD 8140-aligned for roles including Cyber Defense Analyst and Incident Responder, which matters for government and contractor positions.

In the security pathway, CySA+ is the defensive, blue-team step after Security+, and it leads toward the expert-level SecurityX. If you lean offensive instead, PenTest+ is the parallel step. See the certification roadmap for the full picture. We dig into roles and value in is CySA+ worth it.

Keeping the certification current

CySA+ is valid for three years and renews through continuing education — 60 CEUs, or automatically by earning a higher certification like SecurityX. Full details are in how to renew CySA+. Note that earning CySA+ also renews Security+, Network+, and A+ beneath it.

Getting started

The official self-paced course covers every objective in order and is a solid backbone, especially paired with hands-on labs.

Start here: CompTIA CySA+ CertMaster Learn (CS0-004). To turn study into real SOC skill, add the hands-on CertMaster Labs (CS0-004) — or get learning and labs integrated in one environment with CertMaster Perform (CS0-004). When you're ready to confirm readiness, CertMaster Practice (CS0-004) adapts to your weak areas. As an Authorized CompTIA Partner, we carry official materials only.

When you're ready to book, you'll redeem a CySA+ exam voucher at Pearson VUE.

A note on voucher eligibility: Voucher eligibility depends on your exam testing location, per CompTIA policy. Testing in an emerging-market region? We don't sell those here — contact us.

FAQ

Is CS0-004 the current version of CySA+? Yes. CS0-004 (V4) launched on June 23, 2026, and CS0-003 retired the same day. CS0-004 is the only version now available.

How many questions, and how long? Up to 85 questions in 165 minutes, mixing multiple-choice with performance-based questions.

What score do I need to pass? 750 on a 100–900 scaled range.

What changed from CS0-003? The format is the same, but domain weights were rebalanced (Incident Response grew the most), and CS0-004 adds AI, cloud-native/hybrid, automation/SOAR, and zero trust content.

Do I need Security+ first? Not formally, but CySA+ assumes Security+ level knowledge plus about four years of hands-on SOC or vulnerability analyst experience.

How long is the certification valid? Three years, renewable through 60 CEUs or by earning a higher-level certification like SecurityX.