CompTIA CySA+ CS0-004 (V4) is the current version of the CySA+ exam, launched on June 23, 2026. CS0-003 (V3) is the previous version and retires in English on December 22, 2026. Both award the identical CySA+ certification with the same format and 750 passing score. The difference is content: V4 adds an AI in security operations objective, names 13 new SOC tools, shifts 4 points of weight from Vulnerability Management to Incident Response, and removes V3’s web-vulnerability controls objective.
Verdict: CS0-004 is the right exam for nearly every candidate. Sit CS0-003 only if you are already exam-ready on the V3 objectives and can test by early December 2026.
At A Glance
| Current version | CS0-004, launched June 23, 2026 |
| CS0-003 retirement | December 22, 2026 (English); March 23, 2027 (Japanese, Portuguese, Spanish) |
| Difficulty | Intermediate (CompTIA classification); editorial rating 3.5/5 |
| Pass rate | Not published by CompTIA; any online figure is unofficial |
| Prep time | 30 to 55 hours per CompTIA (CompTIA CySA+ V4 FAQ); more without daily SOC experience |
The sections below cover the retirement timeline, the domain weight changes, every objective V4 added, removed, or moved, how difficulty compares, and how to carry CS0-003 study materials over to CS0-004.
When is the CySA+ CS0-003 retirement date, and when was CS0-004 released?
CompTIA CySA+ V3 retires in English on December 22, 2026. The Japanese, Portuguese, and Spanish versions retire on March 23, 2027. The CySA+ 004 release date was June 23, 2026.
Both versions are bookable in English for 182 days. December 1 is a planning date, not a CompTIA deadline.
| Milestone | Date |
| CS0-003 (V3) launch | June 6, 2023 |
| CS0-004 (V4) launch | June 23, 2026 |
| CS0-003 retires (English) | December 22, 2026 |
| CS0-003 retires (Japanese, Portuguese, Spanish) | March 23, 2027 |
| English overlap window | 182 days |
How much time is left to pass CS0-003?
As of September 29, 2026, 84 days (12 weeks) remain before the English retirement.
- A first attempt by December 1, 2026 leaves 21 days for a retake. Retake rules are covered in the FAQ.
- US candidates should factor in Thanksgiving week (November 26, 2026) when booking.
- The version you sit is set by your appointment date, not your voucher purchase date.
What stays the same in CS0-003 vs CS0-004?
| Attribute | CS0-003 (V3) | CS0-004 (V4) |
| Max questions | 85 | 85 |
| Question types | Multiple-choice + PBQs | Multiple-choice + PBQs |
| Duration | 165 minutes | 165 minutes |
| Passing score | 750 (100 to 900) | 750 (100 to 900) |
| Domains | 4 | 4 (same names) |
| Objectives | 15 | 15 |
| Credential earned | CompTIA CySA+ | CompTIA CySA+ |
| Validity | 3 years | 3 years |
| Languages | English, Japanese, Portuguese, Spanish | English only (French, Japanese, Spanish, Portuguese listed as coming soon) |
| Recommended experience | Network+, Security+ or equivalent, plus 4 years as an IR or SOC analyst | 4 years as a SOC analyst (level 2) or vulnerability analyst |
The experience wording is the only format-level change. V4 names a seniority level (SOC Level 2) instead of generic analyst experience.
Discover More: A Complete Guide to CompTIA IT Certification Roadmap – 2026
How did CySA+ domain weights change from V3 to V4?
Incident Response gained 4 points and Vulnerability Management lost 4. In practical terms, roughly 4 questions moved from Vulnerability Management to Incident Response.
Estimated question counts apply each domain weight to the 85-question maximum.
| Domain | V3 | V4 | Change | Est. questions V3 to V4* |
| 1.0 Security Operations | 33% | 34% | +1 | ~28 to ~29 |
| 2.0 Vulnerability Management | 30% | 26% | -4 | ~26 to ~22 |
| 3.0 Incident Response and Management | 20% | 24% | +4 | ~17 to ~20 |
| 4.0 Reporting and Communication | 17% | 16% | -1 | ~14 to ~14 |
*Estimates apply each weight to the 85-question maximum. CompTIA does not publish per-domain question counts, and unscored items may appear.
What is new in the CompTIA CySA+ V4 CS0-004 exam?
Everything below comes from the official CS0-004 exam objectives PDF (Document Version 2.0), compared against the CS0-003 objectives. Every item listed was not named in V3.
Domain 1: Security Operations (34%)
- 1.6 AI in security operations (entirely new objective):
- Risks: hallucinations, data exposure, model poisoning, malicious prompts
- Governance: legal or regulatory compliance and AI usage policies
- Use cases: artifact comparison, log analysis, document creation, incident investigation, event correlation, automation
- 1.2 New indicator categories: cloud-related, identity-based, and email-related. Named items include LOLBins, typosquatting, URL shorteners, IAM account compromise, and business email compromise (BEC).
- 1.3 Thirteen newly named tools: CyberChef, Snort, Suricata, Zeek, OTX, MISP, OpenCTI, XDR, MDM, GeoIP, YARA, MXToolbox, and OpenUBA.
- 1.3 New file formats: YAML and EVTX.
- 1.4 New threat intelligence concepts: heat maps, Pyramid of Pain, attribution, atomic vs. behavioral IoCs, STRIDE threat modeling, threat mapping, cyber deception.
- 1.5 New efficiency items: playbook/runbook creation, infrastructure as code (IaC), rule/alert tuning, dashboard creation.
Domain 2: Vulnerability Management (26%)
- 2.2 New tools: Masscan, Nuclei, Trivy, Checkov, and the breach attack simulation (BAS) tools Atomic Red Team and Caldera. Named tools rise from 16 in V3 to 18 in V4.
- 2.3 New prioritization inputs: EPSS alongside CVSS, active exploitation and threat intelligence, patch/remediation availability, and validation of remediation.
- 2.4 New risk and AppSec concepts: risk appetite, inherent risk, residual risk, SAST, DAST, SAMM, supply chain risk, software composition analysis (SCA), and SBOM.
- Terminology trap: The official objectives call EPSS the “First Exploitability Prediction Scoring System.” The correct name is the Exploit Prediction Scoring System (FIRST EPSS), a probability score for whether a CVE will be exploited in the next 30 days. FIRST is the organization that maintains it, not part of the name. Use the correct name in interviews.
Domain 3: Incident Response and Management (24%)
- 3.2 is now a single “summarize the process” objective covering seven phases, from preparation through post-incident.
- 3.3 New techniques: establishing a timeline, determining severity and impact, log augmentation and enrichment, release from isolation, corrective action development.
Domain 4: Reporting and Communication (16%)
- 4.1 New items: risk scorecards, plus contractual agreements and patch availability as inhibitors to remediation.
- 4.2 New items: shift/incident handover, internal threat intelligence reports, operational security awareness, and new metrics:
- False-positive rate
- True-positive rate
- Mean time to close
- Phishing campaign click rate
What did CompTIA remove or move in CySA+ V4?
| CS0-003 content | Status in CS0-004 |
| Objective 2.4: recommend controls for XSS, injection, CSRF, SSRF, directory traversal, LFI/RFI, and similar web flaws | No standalone objective. Mitigation is now generic: attack surface management, secure coding, patching, exceptions, compensating controls. |
| Debuggers (Immunity debugger, GDB) | Removed from 2.2 |
| Arachni, Pacu | Removed from 2.2 |
| OSSTMM, OWASP Testing Guide | Removed from 3.1, which now lists only Cyber Kill Chain, Diamond Model, and MITRE ATT&CK |
| Zero-day as a prioritization criterion | Not named in 2.3 |
| “Single pane of glass” | Removed from 1.5 |
| Static vs. dynamic scanning | Replaced by SAST/DAST under 2.4 |
| DKIM, DMARC, SPF as named email analysis techniques | Only MXToolbox is named in 1.3; the three protocols remain in the acronym list |
| Business continuity, disaster recovery, forensic analysis | Not named in Domain 3 |
| SOAR | Moved from tools (V3 1.3) to automation and orchestration (V4 1.5) |
| Critical infrastructure (OT, ICS, SCADA) | Moved from vulnerability scanning (V3 2.1) to architecture (V4 1.1) |
| Threat modeling | Moved from vulnerability management to 1.4, now with STRIDE |
Treat removed items as de-emphasized, not safe to skip. The V4 acronym list still includes OWASP, OSSTMM, LFI, RFI, GDB, BC, DR, DKIM, DMARC, and SPF. CompTIA also states that exams may include examples not listed in the objectives document.
Read MOre: CompTIA CySA+ in 2026: V3 or V4 Before the Dec 22 Cutoff?
Is CompTIA CySA+ CS0-004 harder than CS0-003?
CompTIA publishes no comparative difficulty data. The objectives show a shift in what is hard, not a higher passing bar.
| Factor | CS0-003 | CS0-004 |
| “Given a scenario” objectives (likeliest PBQ sources) | 7 of 15 | 6 of 15 |
| Domain that lost a scenario objective | Not applicable | Vulnerability Management (web controls objective removed) |
| Incident Response scenario objective | “Perform IR activities” | “Implement IR techniques” (broader: 20+ named techniques) |
| Named vulnerability tools (2.2) | 16 | 18 |
| AI coverage | None named | Objective 1.6, at “summarize” level |
| Recommended experience | 4 years analyst | 4 years SOC Level 2 |
- Verdict: CompTIA CySA+ CS0-004 favors candidates with hands-on SOC and incident response workflow experience. CS0-003 favored deeper web application vulnerability knowledge. Format and passing score are identical.
Who should still take CS0-003 before it retires?
| Your situation | Take | Reason |
| Exam-ready on V3 and able to test by ~December 1, 2026 | CS0-003 | Leaves a retake window before December 22 |
| Studying V3 but not exam-ready before December 22 | CS0-004 | Use the mapping table below to bridge |
| Starting from zero | CS0-004 | No deadline; objectives match current SOC tooling |
| Testing in Japanese, Portuguese, or Spanish | CS0-003 until March 23, 2027, or CS0-004 in English | CS0-004 has no non-English version yet |
| Already hold CySA+ from CS0-003 | No action needed | Valid for its full 3-year term. For optional renewal via CS0-004, see the FAQ. |
| Targeting a US DoD 8140 role | Either | Same credential. See the FAQ for approval status. |
Can you use CS0-003 study materials for CS0-004?
Yes, for most content. All four domain names are identical, and both versions have 15 objectives. The official Sybex line has already moved on: Wiley lists a CS0-004 Fourth Edition of the Chapple and Seidl study guide (Wiley CySA+ CS0-004 Study Guide), and the companion Practice Tests Fourth Edition contains 1,000 practice test questions.
How do CS0-003 objectives map to CS0-004?
Use this table to match V3 study guide chapters to V4 objective numbers.
| CS0-003 objective | CS0-004 objective | Change |
| 1.1 System and network architecture | 1.1 | Adds OT/ICS/SCADA, secrets management, device management |
| 1.2 Indicators of malicious activity | 1.2 | Adds cloud, identity, and email indicator categories |
| 1.3 Tools and techniques | 1.3 | +13 named tools; SOAR moved out |
| 1.4 Threat intelligence and hunting | 1.4 | Adds Pyramid of Pain, STRIDE, cyber deception |
| 1.5 Efficiency and process improvement | 1.5 | Adds SOAR, IaC, alert tuning |
| None | 1.6 AI in security operations | Entirely new |
| 2.1 Vulnerability scanning | 2.1 | Critical infrastructure moved to 1.1 |
| 2.2 Assessment tool output | 2.2 | 6 tools added, 4 removed |
| 2.3 Prioritize vulnerabilities | 2.3 | Adds EPSS; now includes mitigation |
| 2.4 Recommend controls (web flaws) | Removed | Partly absorbed into 2.3 mitigation strategies |
| 2.5 Vulnerability response and management | 2.4 | Adds SAST/DAST/SAMM, SBOM, SCA, risk concepts |
| 3.1 Attack methodology frameworks | 3.1 | OSSTMM and OWASP Testing Guide removed |
| 3.2 Perform IR activities + 3.3 Preparation and post-incident | 3.2 (process) + 3.3 (techniques) | Restructured by process vs. technique |
| 4.1 Vulnerability management reporting | 4.1 | Adds risk scorecards |
| 4.2 Incident response reporting | 4.2 | Adds handover, internal TI reports, new metrics |
Bridge plan for V3 materials:
- Highlight every item from the “What is new” section in your copy of the V4 objectives PDF.
- Re-weight study hours to 34/26/24/16 across the four domains.
- Reduce time on removed items without dropping them.
- Switch all practice exams to CS0-004-labeled products. V3 question banks overweight Vulnerability Management.
Which free tools cover the new CS0-004 content?
CompTIA’s own V4 sample lab list names Windows with Commando VM, Kali Linux, an open-source UTM appliance, Metasploitable, SIEMs (Graylog, ELK, Splunk), tcpdump, Wireshark, OpenVAS, Nessus, and AWS, Azure, and GCP instances. The newly named tools below are free or open source.
| Tool | V4 objective | What to practice |
| CyberChef | 1.3 | Decode Base64, URL, and hex payloads from phishing samples |
| Zeek, Suricata, Snort | 1.3 | Generate and compare alerts from the same PCAP |
| MISP, OpenCTI, OTX | 1.3, 1.4 | Import IoCs; tag atomic vs. behavioral indicators |
| YARA | 1.3 | Write a rule matching strings in a sample file |
| Windows Event Viewer (EVTX) | 1.3 | Filter logon events for impossible travel patterns |
| Trivy, Checkov | 2.2 | Scan a container image and an IaC template |
| Nuclei, Masscan | 2.2 | Run template-based and high-speed port scans in a lab |
| Atomic Red Team, Caldera | 2.2 | Emulate one MITRE ATT&CK technique and confirm SIEM detection |
Which CS0-003 vs CS0-004 Reddit threads and blog claims are wrong?
Several ranking pages and forum posts contain outdated or incorrect statements. Verify every claim against CompTIA’s official pages before booking.
| Claim you may see | Verified fact |
| “CS0-003 retired on June 23, 2026, with no overlap” | English retirement is December 22, 2026. Both versions have been bookable since June 23. |
| “CompTIA hasn’t confirmed the CS0-003 retirement date” | Confirmed on the official V3 page |
| “JSON log parsing is new in V4” | JSON and XML were already in V3. YAML and EVTX are the new formats. |
| “Zero Trust is new in V4” | V3 already listed zero trust and SASE. CompTIA describes the change as a move from basic Zero Trust concepts to expanded ZTNA and SASE coverage. |
| “The exam costs 404″or”439″ | Outdated or incorrect. See the FAQ for the current price. |
| “A CS0-003 certification must be re-tested on CS0-004” | Not required. The credential is identical and valid for 3 years. |
| “Brain dumps are fine for the new version” | CompTIA states that candidates using them will have their certifications revoked and be suspended from future testing |
Is CySA+ worth it in 2026?
For US candidates, the labor data supports analyst-track credentials. The median annual wage for information security analysts was $129,180 in May 2025, with 21% projected growth from 2025 to 2035 and about 14,100 openings per year (BLS Occupational Outlook Handbook).
- CySA+ maps to the analyst roles in that BLS category: SOC analyst, incident responder, vulnerability analyst, and threat intelligence analyst.
- BLS figures are US-only. Candidates in Europe, Canada, Australia, and India should check national labor statistics for local pay.
Frequently Asked Questions (FAQs)
How much does the CompTIA CySA+ V4 CS0-004 exam cost?
The US retail price for the CS0-004 voucher is $425. Prices differ by country, so check the CompTIA store for your region (UK/EU, Canada, Australia, India). CompTIA also sells bundles that include Retake Assurance.
What happens if you fail the CySA+ exam?
CompTIA requires no waiting period between the first and second attempt, but candidates must wait at least 14 calendar days before a third or later attempt (CompTIA retake policy). Every attempt is charged at full price; CompTIA offers no free re-tests or retake discounts.
Does passing CS0-004 renew an existing CySA+ or Security+?
Yes, on both counts.
- CySA+ renewal: A CS0-003 holder can renew by passing CS0-004 within their three-year renewal cycle. CompTIA renews the certification automatically, and CE fees are waived for this renewal path (CompTIA CE renewal).
- Security+ renewal: Earning CySA+ also renews lower-level certifications, including Security+.
Is CySA+ CS0-004 approved for DoD 8140?
Yes. CompTIA states CySA+ is approved under DoD Directive 8140.03M. This applies to both versions, because both award the same credential.
Where can you take the CySA+ CS0-004 exam?
At a Pearson VUE test center or online through Pearson OnVUE remote proctoring, from any private space (CompTIA online testing guide).
What official study resources exist for CS0-004?
CompTIA lists four CertMaster products with these estimated durations:
| Product | Estimated duration |
| CertMaster Perform | 30-60 hours |
| CertMaster Learn | 25-40 hours |
| CertMaster Practice | 10-20 hours |
| CertMaster Labs | 15-25 hours |
