CySA+ CS0-003 vs CS0-004: which version should you take?
By 8140.study · Published 2026-10-29 · Last updated 2026-10-29
Everything below was read off CompTIA’s own pages on October 29, 2026: the CySA+ V3 page, the CySA+ V4 page, the CySA+ overview page, and CompTIA’s retake and renewal policies. Each figure is linked where it is used.
The dates that decide it
| Date | What happens |
|---|---|
| June 23, 2026 | CS0-004 (V4) launched |
| November 22, 2026 | English CS0-003 learning products retire |
| December 22, 2026 | English CS0-003 exam retires |
| March 23, 2027 | Japanese, Portuguese, and Spanish CS0-003 exams retire |
The earliest date on that list is the one that catches people out. CompTIA’s overview page says the English V3 learning products retire on November 22, 2026, a month before the exam does. If you were planning to buy CompTIA’s own V3 study material, that is your real deadline.
If you test in Japanese, Portuguese, or Spanish, V3 stays open until March 23, 2027. The V4 page lists its languages as English, with French, Japanese, Spanish, and Portuguese coming soon, with no date given for the translations.
The exam format is the same
| CS0-003 | CS0-004 | |
|---|---|---|
| Maximum questions | 85 | 85 |
| Time limit | 165 minutes | 165 minutes |
| Passing score | 750 (scale of 100 to 900) | 750 (scale of 100 to 900) |
| Question types | Multiple-choice and performance-based | Not stated by CompTIA |
| Recommended experience | Network+, Security+, or equivalent knowledge, with at least 4 years of hands-on experience as an incident response analyst, SOC analyst, or equivalent | About 4 years in a SOC analyst or vulnerability analyst role |
The V3 page says its exam is a mix of multiple-choice and performance-based questions. The V4 page gives the question count but does not say which types are included, so we make no claim either way for CS0-004. The recommended experience also shifted: V4 names SOC and vulnerability analyst roles and drops the mention of Network+ and Security+, which is a recommendation in both cases rather than a requirement. Every current detail, with its source, is on our CySA+ certification page.
Domain weights: CS0-003 vs CS0-004
| Domain | CS0-003 | CS0-004 | Change |
|---|---|---|---|
| Security operations | 33% | 34% | +1 point |
| Vulnerability management | 30% | 26% | -4 points |
| Incident response and management | 20% | 24% | +4 points |
| Reporting and communication | 17% | 16% | -1 point |
Incident response gains the most, from 20 to 24 percent, and vulnerability management loses the most, from 30 to 26. Security operations stays the biggest domain on both. If you are moving from V3 material to V4, that is the practical change: a few more hours on the incident response process and techniques, a few fewer on scanning and scan output.
What the V4 summary adds
CompTIA publishes a short objectives summary on each version page. Comparing the two summaries shows where V4 put its emphasis. This is a comparison of summaries, not of the full objectives documents, so a topic that the V4 summary no longer names may still be on the exam.
| Area | CS0-004 | CS0-003 |
|---|---|---|
| AI in security operations | A new Security Operations heading: "Summarize concepts related to the use of AI in security operations," covering use cases, risks, and governance. | No AI heading in the V3 summary. |
| Where suspicious activity is found | Indicators across networks, endpoints, cloud, and identity systems. | Network, host, and application indicators, plus social engineering. |
| Tools named | SIEM, EDR, packet analysis tools, and threat intelligence platforms. | Wireshark, SIEM, and VirusTotal, with scripting in Python and PowerShell. |
| Vulnerability prioritization | Risk-based approaches using scoring systems, threat intelligence, and business context. | CVSS, validating findings, exploitability, asset value, and zero-days. |
| Reporting metrics | Dashboards, post-incident reviews, and metrics such as detection time, response time, and remediation effectiveness. | Compliance reports, action plans, inhibitors to remediation, metrics, and KPIs. |
The clearest addition is AI. V4 has a Security Operations objective on the use of AI in security operations, covering use cases, risks, and governance, and V3 has nothing equivalent in its summary. The other shift is toward cloud and identity: V4 looks for suspicious activity across cloud and identity systems as well as networks and endpoints, and its skills list includes applying security practices across cloud and hybrid environments. If you work in a SOC that already runs EDR and cloud logging, V4 reads closer to the job.
Which version you should take
Take CS0-004 if you are starting now, if you are less than about halfway through your V3 material, or if you are not sure you can test before December 22, 2026. V4 is the version CompTIA’s own learning products continue to support after November 22, 2026, and its objectives cover AI, cloud, and identity in ways V3’s summary does not.
Take CS0-003 if you are nearly done with V3 material, you are scoring well on practice tests, and you can book a date early enough to leave room for a retake. That last condition matters more than it looks. Under CompTIA’s retake policy there is no waiting period between a first and second attempt, but a third attempt needs a wait of at least 14 days after the second, and you pay the full exam price every time. Fail twice in December and that wait can push a third attempt past the retirement date, which leaves you switching to V4 material at the worst possible moment.
Either way, the certification you earn is CySA+. CompTIA lists both as versions of the same certification on its CySA+ page. If you are still deciding whether CySA+ is the right next step at all, our Security+ vs CySA+ guide covers that question.
How the version affects renewal
Your CySA+ is valid for three years from the date you earned it, whichever version you passed. One renewal route does depend on the version. CompTIA lets you renew by passing the latest release of the exam during your cycle, as long as it is a newer version than the one you passed, and the CE fee is waived when you do.
So a CS0-003 pass can later be renewed by passing CS0-004. A CS0-004 pass cannot be renewed that way until CompTIA releases a newer version, and CompTIA has not announced one. That is a minor point and not a reason to pick V3 on its own. The CEU totals, fees, and shortcuts are in our CySA+ renewal guide.
FAQ
Should I take CySA+ CS0-003 or CS0-004?
CS0-004 for most people. It is the current version, launched June 23, 2026. Take CS0-003 only if you are nearly finished studying for it and can test early enough to retake before the English exam retires on December 22, 2026.
When does CySA+ CS0-003 retire?
The English exam retires on December 22, 2026. The Japanese, Portuguese, and Spanish exams retire on March 23, 2027. CompTIA says the English V3 learning products retire earlier, on November 22, 2026.
What is the difference between CS0-003 and CS0-004?
The format is the same: up to 85 questions, 165 minutes, and a passing score of 750 on a scale of 100 to 900. The domain weights moved, with incident response rising from 20 to 24 percent and vulnerability management falling from 30 to 26. CompTIA's V4 summary adds an objective on AI in security operations and puts more weight on cloud and identity.
Is CySA+ CS0-004 harder than CS0-003?
CompTIA's exam pages give no pass rates and no difficulty comparison. What they do publish is the same question limit, time limit, and passing score for both versions. The difference is in what is covered, so the version that is easier for you is the one your study material matches.
Does CS0-004 have performance-based questions?
CompTIA's V4 page gives a maximum of 85 questions but does not say which question types are included, as of October 29, 2026. The V3 page states that CS0-003 is a mix of multiple-choice and performance-based questions.
Is my CySA+ still valid if I passed CS0-003?
Yes, for three years from the date you earned it. CompTIA ties the renewal cycle to the date you earned the certification. You can renew with CEUs, or by passing CS0-004 during your cycle, which also waives the CE fee.
Studying for CS0-004? Our CySA+ course is built on the CS0-004 objectives, and its first module, Security operations, is free.