CySA+
CS0-004
1Security Operations
34%
2Vulnerability Management
26%
3Incident Response and Management
24%
4Reporting and Communication
16%
Certification comparison
CySA+ vs PenTest+
They’re two sides of the same level. CySA+ is defense: finding and responding to attacks. PenTest+ is offense: finding and exploiting weaknesses, with permission, before an attacker does.
Last updated
Side by side
The two exams at a glance
Every figure comes from the vendor’s own pages, through our exam guides, and is checked every week.
| CompTIA CySA+ | CompTIA PenTest+ | |
|---|---|---|
| Vendor | CompTIA | CompTIA |
| Exam code | CS0-004, CS0-003 | PT0-003 |
| Level | Advanced | Advanced |
| Written for | Security analyst or engineer | Security analyst or engineer |
| Questions | Up to 85 | Up to 90 |
| Time | 165 min | 165 min |
| Passing score | 750 / 900 | 750 / 900 |
| Exam cost | Varies by countryCompTIA shows the price for your country before you pay | Varies by countryCompTIA shows the price for your country before you pay |
| Experience | About 4 years as a SOC or vulnerability analystRecommended experience | 3–4 years in penetration testingRecommended experience |
| Renewal | Every 3 years: 60 CEUs | Every 3 years: 60 CEUs |
| Exam outline | 4 domainsLargest: Security Operations (34%) | 5 domainsLargest: Attacks and Exploits (35%) |
| What’s changing | CS0-003 retires on December 22, 2026 | No change announced |
Levels are our own rating, from the level each vendor gives its exam. How we check our facts
Exam domains
What each exam covers
Each domain’s share of the exam, as the vendor publishes it. Where one exam has two versions on sale, this is the newer one.
PenTest+
PT0-003
1Engagement Management
13%
2Reconnaissance and Enumeration
21%
3Vulnerability Discovery and Analysis
17%
4Attacks and Exploits
35%
5Post-exploitation and Lateral Movement
14%
Which one
Which should you take?
Choose CySA+ if
you want to work in a security operations team: monitoring, investigating and responding.
Choose PenTest+ if
you want to test systems for a living: penetration testing and vulnerability assessment.
Which one first?
Either order works, and you don’t need both. CompTIA places both after Security+ and before its expert-level SecurityX.
Beyond the numbers
What really differs
Defense against offense
CySA+ teaches you to read what an attack leaves behind and to manage vulnerabilities across an organization. PenTest+ teaches you to plan an engagement, find a way in and report what you found.
The tools
CySA+ leans on monitoring, log analysis and scanning tools. PenTest+ leans on reconnaissance, exploitation and scripting.
Why some take both
Defenders are better when they know how attacks work, and testers write better reports when they know what defenders need. That’s why some people earn both.
FAQs
Got Questions? We’ve Got Answers.
Find quick answers or contact our support team.
Should I take CySA+ or PenTest+ first?
Either order works, and you don’t need both. CompTIA places both after Security+ and before its expert-level SecurityX.
Which is harder, CySA+ or PenTest+?
They sit at the same level: we rate both advanced. What differs is what they cover, so the harder one is usually the one further from your own experience.
What experience do I need for CySA+ and PenTest+?
CySA+: CompTIA recommends about 4 years as a SOC or vulnerability analyst. It isn’t required to sit the exam. PenTest+: CompTIA recommends 3–4 years in penetration testing. It isn’t required to sit the exam.
Which costs more, CySA+ or PenTest+?
The answer is the same for both: varies by country. CompTIA shows the price for your country before you pay.
