Security+ → CySA+ → CASP+: the CompTIA stack actually considered

CompTIA markets its three security certs — Security+ (SY0-701), CySA+ (CS0-003), and CASP+ (CAS-005) — as a progression from foundational to advanced. The marketing sells the image of a clean ladder you climb one rung at a time. The reality is messier. One cert is worth it for almost everyone in security. One is situationally useful. One is usually a mistake unless you have a specific reason.

I have coached candidates through all three over the past five years. Here is the honest take.

The three certs at a glance

All three are performance-based-question format (multiple choice + PBQs). All three are vendor-neutral. All three are DoD 8140-listed for specific roles.

Security+: take it

Security+ (SY0-701) is the foundational security cert that almost everyone in security should take. About 1.1 million people hold it worldwide, making it the single most recognized baseline security credential. It is the entry ticket for:

• Most government and contractor security roles (DoD 8140 IAT Level II)
• Junior SOC analyst, security engineer, and IT security roles
• Visible credentialing for anyone pivoting into security from IT

I wrote a longer piece on SY0-701's unique 65/35 scenario/direct-recall format earlier this month. The short version: 90 questions, 90 minutes, roughly 58 scenarios and 32 direct-recall items, 750/900 pass. Prep time for someone with basic IT background: 60–90 hours across 6 weeks.

Security+ is worth $404 + 80 hours for almost any IT professional. It is the security credential that carries weight in non-technical hiring manager circles. If your next role is security-adjacent, take it.

CySA+: take it if blue team, skip if not

CySA+ (CS0-003) focuses on the SOC analyst / incident responder role. It is genuinely more technical than Security+ — the question patterns assume you are in front of SIEM output, IDS alerts, and incident tickets.

Blueprint:

• Security operations — 33%
• Vulnerability management — 30%
• Incident response and management — 20%
• Reporting and communication — 17%

If your job is — or will be — SOC analyst, incident responder, threat hunter, or security engineer with IR responsibilities, CySA+ is worth the ~80-hour study investment and $404 fee. It maps tightly to the day-job skills.

If your job is security architect, compliance, GRC, or you work in a management track, CySA+ is not the right credential. You want CISSP or CCSP instead. CySA+ on an architect's resume signals "tactical operator" which may work against you for architect-level roles.

Fair substitute: GIAC GCIH (Certified Incident Handler) is a deeper alternative in the same space for people who are already past Security+ and want to deepen into IR. More expensive ($1,000+), more recognized among security professionals, but overkill for a junior SOC analyst. CySA+ is the reasonable mid-tier option.

Market signal for CySA+: 580 US job postings in the last 90 days mentioned it. CISSP mentioned: 2,400. CySA+ is niche compared to the big certs, but for the specific SOC role it's appropriate.

CASP+: usually a mistake

CASP+ (CAS-005, launched Dec 2024) is where I give the most cautionary advice. CompTIA positions it as an advanced security cert — the top of the CompTIA stack. In practice, it sits in a no-man's-land between Security+ (too foundational) and the real industry-standard advanced certs (CISSP, CCSP, OSCP).

The problem: hiring managers at the level CASP+ targets (senior security engineers, lead security architects) usually list CISSP, not CASP+. The Department of Defense lists CASP+ for IAT Level III and some IAM roles, but most non-DoD roles have moved on to CISSP as the expected advanced credential.

When CASP+ makes sense:

• DoD or defense contractor role that specifically requires CASP+
• You already have Security+ and CySA+, want to stay in the CompTIA stack for renewal-efficiency reasons (CASP+ passes CEU requirements for the lower certs)
• You are pre-CISSP experience and want an advanced credential while building the 5-year CISSP experience requirement

When CASP+ is a mistake:

• You are trying to signal "senior security engineer" to non-DoD employers
• You have the CISSP experience requirement (5 years)
• Your target role specifically lists CISSP or CCSP

In my coaching cohort, about 60% of people who took CASP+ retrospectively wished they had gone for CISSP. About 90% of DoD-track candidates who took CASP+ were satisfied with the choice. The split is almost entirely about your sector.

Market signal for CASP+: 340 US postings in the last 90 days mentioned CASP+. Most are DoD or DoD-contractor roles. If you search outside government, the cert is rarely named.

The right stack

If you are entering security: Security+ first. Land a SOC or junior security role. Stop here for 1–2 years until you know your direction.

If you are SOC-track: Security+ → CySA+ → eventually GCIH or CISSP depending on depth vs breadth

If you are architect-track: Security+ → (skip CySA+ and CASP+) → CISSP when you hit 5 years experience

If you are DoD-contractor-track: Security+ → CySA+ (for IAT II+) → CASP+ (for IAT III) → eventually CISSP for management roles

If you are red-team track: Security+ → eventually OSCP. CySA+ and CASP+ are the wrong direction entirely.

What the CompTIA stack gets right

Predictable formats. Transparent blueprints. Renewable with reasonable CEU requirements. Vendor-neutral (so skills transfer across employers and tech stacks). The stack as a whole is a legitimate foundation for a security career.

What it gets wrong

The positioning of CASP+ as "advanced." It is not the advanced security cert of 2026. CISSP is. Employers treat CASP+ as equivalent to or slightly below CISSP in most cases, and CISSP is both more recognized and opens more doors.

CompTIA has a commercial interest in selling three certs per candidate. Your career has no such interest. Take the ones that match your track. Skip the ones that do not.

One last number: the three-cert stack costs about $1,317 in exam fees alone, plus 240 study hours, plus ongoing renewals. Compared to CISSP alone at $749 + 200 hours, the stack needs to justify its premium. For most career tracks, it does not. Pick what fits.