CompTIA is retiring CySA+ V3. If you are studying for it right now, or weighing up booking, there is a real decision to make in the next few months — and unlike most version changes, this one has firm published dates rather than the usual "estimated" hand-waving. Here is what changes, what does not, and which version you should actually sit.
The short answer
The English V3 exam (CS0-003) retires on 22 December 2026. V4 (CS0-004) has been live since 23 June 2026, so both are sittable until then. If you are ready to test within the next few weeks and you have been revising V3 material, sit V3 and be done. If you are starting now, or your test date would land close to December, go straight to V4 — the exam format is identical, the syllabus shift is modest, and you avoid any risk of your booking colliding with the retirement.
- V4 exam code CS0-004, live since 23 June 2026
- V3 exam code CS0-003, live since 6 June 2023
- English learning products retire 22 November 2026
- English V3 exam retires 22 December 2026
- Translated V3 exams retire 23 March 2027
- Format (both versions) maximum 85 questions, 165 minutes, multiple-choice and performance-based
- Pass mark (both versions) 750 on a scale of 100–900
Those dates come from CompTIA's own certification pages. Always confirm the exam code on your booking confirmation before you sit — the code, not the version name, is what determines which exam you get.
What actually changes
Less than the version bump suggests. Both exams run to the same four domains, the same length, the same time limit and the same pass mark. What moved is the weighting:
| Domain | V3 (CS0-003) | V4 (CS0-004) | Change |
|---|---|---|---|
| Security operations | 33% | 34% | +1 |
| Vulnerability management | 30% | 26% | −4 |
| Incident response and management | 20% | 24% | +4 |
| Reporting and communication | 17% | 16% | −1 |
The headline is a four-point transfer from vulnerability management into incident response. In practice that is roughly three or four questions moving across on an 85-question paper — enough to change where you spend revision time, not enough to make V3 study wasted.
If you have already been revising V3, the useful adjustment is to push harder on the incident-response lifecycle — detection, containment, eradication, recovery, and the evidence handling and post-incident work around it — and to stop over-investing in scanner tuning and vulnerability scoring beyond what you need.
What V4 adds
Two additions are worth naming because they reflect how the analyst role has actually changed:
- AI in security operations. CompTIA's V4 objectives include summarising concepts related to the use of AI in security operations — its use cases, its risks, and the governance considerations around it. This is the clearest signal of intent in the whole refresh: an analyst is now expected to reason about AI as part of the toolchain, not just about the tools it sits inside.
- Cloud and hybrid environments. V4 asks you to apply security practices across cloud and hybrid environments. Monitoring and investigation are framed across networks, endpoints and cloud rather than treating cloud as a separate topic bolted on at the end.
Other content changes are described in CompTIA's full objectives document, which is worth downloading from their site if you want the line-by-line detail — the summary pages do not carry it.
Which version should you sit?
Sit V3 if…
- You are already deep into V3 material and could realistically test within the next few weeks.
- You have a voucher or a booking that is already tied to CS0-003.
- Your employer's training budget or course enrolment is built around the V3 syllabus this cycle.
One caution on timing: English learning products retire a month before the exam does, on 22 November 2026. If you are relying on official CompTIA courseware rather than third-party material, that is your real deadline, not December.
Sit V4 if…
- You are starting from scratch now. There is no reason to learn a syllabus that expires within months.
- Your likely test date is November or December. Booking close to a retirement date is how people end up rescheduling into a version they did not revise for.
- You want the AI and cloud material on your certificate, which is increasingly what hiring managers are scanning for.
Does a V3 certification stop counting?
No. This is the single most common worry about any version change and the answer is consistent across CompTIA's certifications: a certification you earn under CS0-003 remains valid for its full three years. It does not downgrade, expire early, or become "the old one" on your record. Retirement affects which exam you can sit, not what you already hold.
Renewal works the same way it always has — you keep the certification current through CompTIA's continuing education programme, and when you do eventually recertify you will do so against whatever version is live at that point.
Where CySA+ sits
CySA+ is CompTIA's analyst-level security certification, positioned above Security+ and aimed at people doing detection, monitoring, vulnerability management and incident response rather than general security fundamentals. CompTIA suggests around four years in a SOC analyst or vulnerability analyst role as the experience level V4 is pitched at — which is a guide, not a gate, but it does tell you the paper assumes you have seen real alerts and real triage.
If Security+ still feels like a stretch, start there: it is the broader baseline, and CySA+ assumes most of it.
Practise against the V4 domains. PassNova's CompTIA CySA+ bank is 260 questions weighted to the V4 split, with a clear explanation on every answer — free to try, no sign-up.
How to use the remaining months
- Decide your version this week, then stop revisiting it. The decision costs more in hesitation than either option costs in study time.
- Book the exam before you feel ready. A dated booking is the single most reliable predictor of actually sitting. With a retirement in play, an undated intention tends to drift past the deadline.
- Weight your revision to the paper. Security operations and vulnerability management are 60% of V4 between them. Incident response has grown and is where the marks moved.
- Practise performance-based questions specifically. They carry disproportionate weight and are the part people run out of time on — 165 minutes goes quickly when a PBQ needs real analysis.
- Check the exam code on your confirmation. CS0-003 is V3, CS0-004 is V4. That string is the only thing that definitively tells you which paper you have booked.
Frequently asked questions
When exactly does CySA+ V3 retire?
The English CS0-003 exam retires on 22 December 2026. English learning products retire earlier, on 22 November 2026, and translated versions of the exam run until 23 March 2027.
Can I still sit CS0-003 now?
Yes. Both versions are available until the December retirement date. Confirm the exam code on your booking so you know which one you are sitting.
Is CySA+ V4 harder than V3?
Not structurally. Both are a maximum of 85 questions in 165 minutes with a 750 pass mark on a 100–900 scale. V4 shifts about four percentage points of weighting from vulnerability management into incident response and adds AI and cloud/hybrid material, so it is a different emphasis rather than a higher bar.
Does my CySA+ certification expire when V3 retires?
No. A certification earned under CS0-003 stays valid for its normal three-year term and is renewed through continuing education in the usual way. Retirement governs which exam can be booked, not certifications already held.
What is the difference between CS0-003 and CS0-004?
They are the exam series codes for V3 and V4 respectively. CS0-003 launched on 6 June 2023; CS0-004 launched on 23 June 2026.
Should I wait for V4 translations?
V4 launched in English, with French, Japanese, Spanish and Portuguese listed as coming soon. If you need to sit in one of those languages, translated V3 exams remain available until 23 March 2027, which is the longest runway of any of these dates.
One point of clarity: PassNova is a practice and revision site. We are not a CompTIA delivery partner and we do not award the certification — you book and sit the exam through Pearson VUE. Dates and exam details in this article come from CompTIA's own certification pages and were checked on 28 August 2026; confirm them on the official CySA+ page before you book, as awarding bodies do move these.