CySA+ CS0-003 to CS0-004: What Changed and Why

If you researched CySA+ a while ago, you may have studied — or bought materials for — CS0-003. That version has retired. CompTIA replaced it with CS0-004 (V4) on June 23, 2026. This article explains exactly what changed, what stayed the same, and how to make sure you're studying the right version.

For the full current picture, see the complete CySA+ guide. This piece focuses on the transition.

The retirement, briefly

CS0-004 launched on June 23, 2026, and CS0-003 retired the same day — a same-day switchover with no overlap period. From that date, CS0-004 is the only version you can sit. The practical implication: if you were preparing for CS0-003 and hadn't tested by June 23, 2026, you're now preparing for CS0-004, and CS0-003 study materials no longer match the current blueprint.

What stayed the same

The format is identical, which is reassuring if you'd already started:

• Up to 85 questions in 165 minutes.
• Multiple-choice and performance-based questions.
• Passing score of 750 on a 100–900 scale.
• The same four domain names: Security Operations, Vulnerability Management, Incident Response and Management, and Reporting and Communication.
• The core skills CySA+ has always tested — threat hunting, log analysis, vulnerability scanning, and incident response — are all still there.

So your foundational analyst knowledge carries over. The changes are about emphasis and new content.

What changed: domain weights

CS0-004 rebalanced the four domains:

The headline shift: Incident Response gained four points (the largest single change) while Vulnerability Management dropped four. In practice, CS0-004 places more emphasis on what happens during and after an incident, and somewhat less on the mechanics of vulnerability scanning and prioritization.

What changed: new content

This is where CS0-004 really differs, reflecting how SOCs work in 2026:

• Artificial intelligence. The biggest substantive addition. CS0-003 didn't address AI at all. CS0-004 introduces AI in security operations — using AI tooling for analysis and investigation, understanding its risks, and recognizing AI-enabled threats.
• Cloud-native and hybrid environments. Cloud resources are now explicitly part of incident scoping and vulnerability management, reflecting how much infrastructure is hybrid.
• Automation and SOAR. Expanded emphasis — SOAR playbooks for enrichment, ticketing, containment, and notification; reading scripts, JSON, and command output; and knowing when automation should require human approval.
• Zero trust and modern attack methodologies. Updated to reflect current architecture and threats.

How to study if you're coming from CS0-003

Three moves make the transition efficient:

1. Keep your fundamentals. Threat hunting, log analysis, vulnerability scanning, and incident response basics all carry over. Confirm them and move on.
2. Front-load the new content. Give real attention to AI in security operations, cloud/hybrid scenarios, and automation/SOAR — this is where CS0-003 veterans have gaps.
3. Shift weight toward incident response. With IR up to 24%, rehearse the full incident lifecycle end to end. Our PBQ and hands-on guide shows how.

Make sure your materials are current

The single biggest mistake in this transition is studying from CS0-003 materials. They'll cover the shared fundamentals but miss the AI, cloud, and automation content entirely — and unauthorized "brain dumps" also violate CompTIA's candidate agreement, which can cost you your certification. Use current, official CS0-004 resources.

Study the current version: CompTIA CySA+ CertMaster Learn (CS0-004) covers the updated objectives, and CertMaster Labs (CS0-004) build the hands-on skills for the new content. As an Authorized CompTIA Partner, we carry official, current versions. Deciding whether CySA+ is the right step now? See is CySA+ worth it.

FAQ

Can I still take CS0-003? No. CS0-003 retired on June 23, 2026, the same day CS0-004 launched. CS0-004 is the only current version.

Is my existing CySA+ certification still valid? Yes. An earned CySA+ certification remains valid for its three-year term regardless of the exam version you passed. The version change affects new candidates.

Is CS0-004 harder than CS0-003? The format and difficulty level are comparable, but the new AI, cloud, and automation content — plus more incident response weight — means experienced CS0-003 candidates have new material to learn.

What's the most important new topic? Artificial intelligence in security operations is the flagship addition, alongside expanded cloud/hybrid and automation content.

Can I study from my old CS0-003 materials? Only for the shared fundamentals, and cautiously. They miss the new content, so use current CS0-004 resources for the exam you'll actually sit.