# Certifications
CySA+ V3 vs V4: what changed in CS0-004
CompTIA’s Cybersecurity Analyst exam (CySA+) moved to a fourth version in 2026. V4, exam code CS0-004, launched on June 23, 2026[CompTIA]. The previous version, V3 (CS0-003), stays available for a transition period, and CompTIA says the English-language V3 exam is scheduled to retire in December 2026[CompTIA].
Does the exam itself change?
Not in format. Both versions list a maximum of 85 questions mixing multiple-choice and performance-based items, 165 minutes, and a passing score of 750 on a 100–900 scale[CompTIA][CompTIA].
Recommended experience is similar: about four years in a SOC analyst or vulnerability analyst role for V4; for V3, Network+, Security+ or equivalent knowledge plus at least four years as an incident response or SOC analyst, or equivalent. Neither is a formal requirement, but both make clear that CySA+ is not designed as a first certification.
How do the domain weights change?
| Domain | V3 (CS0-003) | V4 (CS0-004) |
|---|---|---|
| Security operations | 33% | 34% |
| Vulnerability management | 30% | 26% |
| Incident response and management | 20% | 24% |
| Reporting and communication | 17% | 16% |
The four domains are the same. Weight moves from vulnerability management towards incident response.
What is new in V4?
CompTIA’s own summary of V4 lists three expanded focus areas[CompTIA]:
- AI in security operations: AI-assisted threat detection, AI governance concepts, model poisoning and manipulation risks, AI-generated outputs and hallucinations, and responsible use of AI in security operations.
- Zero Trust and modern architecture: more emphasis on Zero Trust Network Architecture, identity-based controls and cloud-centric environments.
- Advanced vulnerability prioritisation: the Exploit Prediction Scoring System (EPSS), Software Bill of Materials (SBOM), risk-based vulnerability management and threat-informed prioritisation.
That lines up with the weight change above: less on finding vulnerabilities, more on deciding which matter and responding to incidents.
Which version should you take?
Our editorial judgment:
- Study for V4 unless you are already close to exam-ready on V3. With V3’s English exam due to retire in December 2026, starting V3 now leaves very little margin.
- Sit V3 only if you have finished V3 preparation and can test before the retirement month. The format and passing score are the same, so there is no format advantage to either.
- Check the voucher price on the CompTIA store before buying; we could not capture an official price on our check date (see the CySA+ record).
If you are earlier in your career, CompTIA’s recommended experience suggests building towards CySA+ rather than starting with it. The training planner shows sequenced options by starting point.
Certification records used here
- CompTIA CySA+ (Cybersecurity Analyst) checked 2026-10-22
Sources
- CompTIA: www.comptia.org/en-us/certifications/cybersecurity-analyst/ — checked 2026-10-22, direct HTTP fetch
- CompTIA: www.comptia.org/en-us/certifications/cybersecurity-analyst/v3/ — checked 2026-10-22, direct HTTP fetch
- CompTIA: www.comptia.org/en-us/certifications/cybersecurity-analyst/v4/ — checked 2026-10-22, direct HTTP fetch
- CompTIA: www.comptia.org/en-us/blog/what-is-comptia-cysa-certification/ — checked 2026-10-22, direct HTTP fetch
Related guides
Security+ V7 vs V8: which exam should you take?
Security+ V8 (SY0-801) launches November 17, 2026 and V7 retires June 11, 2027. What changes in the domains, what stays the same, and how to choose.
Practical SOC certifications compared: BTL1, CCDL1, HTB CDSA and TryHackMe SAL1
Four hands-on blue-team certifications side by side: exam format, time limit, price, what is included and retakes — from each provider's official page.
SOC analyst training paths by starting point, with real costs
Worked SOC analyst training plans for career changers, IT staff and junior analysts: what to take in which order, and what the verified prices add up to.