CySA+ vs PenTest+: which one should you get after Security+?

Every exam figure below was read off CompTIA’s own certification and continuing education pages on October 27, 2026, and each is linked to the page it came from.

The two exams side by side

On paper the two are close to twins. Both give you 165 minutes, both pass at 750 on a 100 to 900 scale, and CompTIA recommends a similar amount of experience for each: about four years for CySA+, three to four for PenTest+. Neither page lists a formal prerequisite.

On question types: the PenTest+ page states a mix of multiple-choice and performance-based questions. The CySA+ V4 page does not state the question types, so we make no claim about them for CS0-004.

What each exam covers

In CompTIA’s words, CySA+ validates your ability to detect, analyze, and respond to threats in security operations and vulnerability management roles. PenTest+ validates your ability to identify, mitigate, and report system vulnerabilities. The domain weights show how differently that plays out.

The overlap is vulnerabilities. CySA+ gives vulnerability management 26 percent of the exam, and PenTest+ gives vulnerability discovery and analysis 17 percent. The difference is the angle. CySA+ asks you to prioritize and fix what a scan finds, then watch for and respond to attacks. PenTest+ asks you to plan an engagement, find the weakness, and use it: attacks and exploits alone is 35 percent of PenTest+, the largest single domain on either exam.

Which one to get

CySA+ if you defend. If your days are alerts, SIEM and EDR consoles, vulnerability scans, and incident tickets, CySA+ describes that work. CompTIA’s recommended experience names SOC analyst and vulnerability analyst roles, and that is where most security jobs sit.

PenTest+ if you test. If you scope engagements, run reconnaissance, exploit findings, and write them up for a client, PenTest+ describes that work. CompTIA’s recommended experience names the penetration tester role, with Network+ and Security+ level knowledge behind it.

If a job posting or contract names one, get that one. It does not matter which exam is a better fit if the paperwork asks for the other. And if a posting names CEH as the alternative to PenTest+, our CEH vs PenTest+ comparison covers that choice.

The renewal rule: each one renews the other

CompTIA’s higher level certification renewal page lists CySA+ as fully renewing PenTest+, Security+, Network+, and A+, and PenTest+ as fully renewing CySA+, Security+, Network+, and A+. So if you hold one and pass the other, the first renews, and Security+ renews with it if you hold that too. CompTIA waives the CE fee on a certification it fully renews this way and aligns its expiration date to the new certification’s.

Two conditions from the same page. First, you have to earn the new certification during your existing one’s three year renewal cycle. Second, the shortcut only works when you pass the exam: CompTIA’s footnote says renewing CySA+ does not automatically renew PenTest+, and the same the other way around. What it does allow is applying the CEUs you log for one to the other. Both need 60 CEUs per cycle, so one set of activities can count toward both. Our CySA+ renewal guide covers which activities count and how many CEUs each is worth.

Which exam versions are live

For CySA+, study CS0-004 unless you are already deep into CS0-003 material and can test in English before December 22, 2026. For PenTest+, PT0-003 is the only live exam, and CompTIA had not announced a successor on its page as of October 27, 2026.

Should you get both?

If your work spans both sides, the renewal rule makes the second one cheap to keep. Pass one, then pass the other inside its three year window, and the first renews with its CE fee waived. After that, one set of 60 CEUs can be applied to both. If you only need one for a job, though, there is no requirement in CompTIA’s pages that pushes you to the other.

FAQ

Not sure which side fits? The first module of our CySA+ course, Security operations, is free, and so is the first module of our PenTest+ course, Engagement Management. Try both and see which work you want to do.