Skip to content
CertGPS
Comparison

CySA+ or PenTest+: Pick by the Job, Then Let One Renew the Other

CySA+ and PenTest+ share a price, a clock and a pass mark. How their outlines differ, which suits SOC or testing work, and how passing one renews the other.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

CySA+ or PenTest+: Pick by the Job, Then Let One Renew the Other

On paper these two CompTIA exams are almost identical to sit, with the same voucher price, 165 minutes, a 750 pass mark and the same renewal rules. What separates them is which side of an intrusion you work on. CySA+ is for the analyst who spots and contains an attacker, PenTest+ for the tester paid to be one. Choose by the job, and know that passing the second one later renews the first.

Exam facts

CySA+PenTest+
IssuerCompTIACompTIA
Current examCS0-004, launched June 23, 2026; English CS0-003 retires December 22, 2026PT0-003, launched December 17, 2024; retirement estimated 2027
QuestionsUp to 85, multiple-choice and performance-basedUp to 90, multiple-choice and performance-based
Time165 minutes165 minutes
Passing score750 on a 100–900 scale750 on a 100–900 scale
Price (US list)$439 voucher; $579 with one retake$439 voucher; $579 with one retake
Recommended experienceAbout four years as a SOC or vulnerability analystThree to four years as a penetration tester, with Network+ and Security+ knowledge
RenewalThree years; 60 CEUs and a $150 feeThree years; 60 CEUs and a $150 fee

Which job each one describes

CySA+ fits the people who watch and respond: a security operations center (SOC) analyst moving from tier 1 to tier 2, an incident handler, or a vulnerability management analyst who runs the scanners and argues over patch order. PenTest+ fits a junior penetration tester, a consultant running authorized assessments who needs a vendor-neutral credential, or an analyst who wants to move to the offensive side.

Both carry weight in US defense work. CompTIA lists both for DoD 8140, and for PenTest+ it names work roles such as exploitation analyst and cyber defense forensics analyst.

If you're unsure, look at what you'd do on an ordinary Tuesday. Reading a Windows event log to work out what a suspicious PowerShell command did is CySA+ work. Capturing hashes with Responder and following a BloodHound path to domain admin is PenTest+ work. A vulnerability analyst does a little of both, and that's the one reader for whom the choice is close.

The same tools, read from opposite ends

The outlines overlap more than the "defense versus offense" framing suggests. CySA+ objective 2.2 asks you to read output from Nmap, Metasploit, Burp Suite, ZAP, Nessus, OpenVAS, ScoutSuite, Atomic Red Team and Caldera, and every one of those appears in the PenTest+ outline too. Both exams also use the Common Vulnerability Scoring System and the Exploit Prediction Scoring System. In CySA+ objective 2.3 they decide what gets patched first. In PenTest+ the same scores decide what to attack first, under an objective on prioritizing and preparing attacks.

Beyond that shared ground the weights pull apart. Attacks and Exploits is 35% of PT0-003 on CompTIA's PenTest+ page, and the attack objectives lean on Active Directory, with Impacket, Mimikatz, Rubeus and Kerberos attacks named. Eighteen of its 26 objectives begin "Given a scenario". Security Operations is 34% of CS0-004 on CompTIA's V4 page, and it asks you to read JSON, YAML and Windows EVTX files, run indicators through tools such as CyberChef, YARA and Zeek, and take an incident to root cause. Six of its 15 objectives are scenario-based.

Each exam has a paperwork domain the other lacks. PenTest+ opens with engagement management: rules of engagement, statements of work and the structure of a test report. CySA+ closes with reporting and communication: SOC metrics such as mean time to detect and respond, and who a communication plan has to reach during an incident.

Taking both, and what it costs to keep them

CompTIA puts the two at the same level, below SecurityX, and its renewal rules reward holding both. On its page about earning other CompTIA certifications, CompTIA says passing CySA+ fully renews PenTest+, and passing PenTest+ fully renews CySA+, when the new one is earned by exam during the existing certification's three-year cycle. The second exam therefore costs a voucher but saves the $150 renewal fee and 60 CEUs on the first. Renewing one later through continuing education doesn't renew the other automatically, although CompTIA lets you apply the same CEUs to both. With Security+ as well, the pair qualifies you for CompTIA's stackable Network Security Professional designation.

The order follows where you work now. In a SOC, take CySA+ first and PenTest+ if you move into testing; a tester who adds CySA+ later gets the same renewal benefit. Our penetration tester career progression covers what comes after.

One difference matters for later plans. CySA+ is on ISC2's list of credentials that waive a year of CISSP experience, and PenTest+ isn't. If CISSP is the long-term goal, that's a small point in CySA+'s favor.

Our view

Take the one that matches your job now, and if you hold it for a year or two, take the other within the same three-year cycle. A SOC analyst who studies Active Directory attacks for PenTest+ will recognize them in logs, and a tester who learns the reporting side of CySA+ writes better remediation advice. For anyone set on offensive work, though, we'd spend the second budget on a practical exam instead of CySA+. PenTest+ is a 165-minute test, and our PenTest+ vs OSCP comparison covers the step to a 24-hour practical.

Sources