CS0-004 vs CS0-003: which CySA+ to take

CS0-004 is the current version of CompTIA CySA+ and CS0-003 is the one being retired. They are the same certification at the same level and for the same target role, and CompTIA’s V4 materials give the same headline numbers (85 questions, 165 minutes, 750 on 100 to 900). Per CompTIA, the English CS0-003 exam retires on December 22, 2026. A candidate who is ready before then and has studied V3 material can sit CS0-003, and everyone else should study for CS0-004.

Dates

The V3 dates come from CompTIA’s CySA+ page; the launch date comes from the V4 page. Both pages are the authority and dates can move.

What is confirmed about CS0-004

• Up to 85 questions, 165 minutes, passing score 750 on a scale of 100 to 900.
• Four domains: Security Operations (34%), Vulnerability Management (26%), Incident Response and Management (24%) and Reporting and Communication (16%).
• Recommended experience of about four years as a SOC analyst or vulnerability analyst.

Details are on the exam format page.

What changed

CompTIA’s V4 page does not publish a side-by-side comparison with V3, and it does not give V3 domain weights. Weight comparisons found on third-party sites are therefore not repeated here. CompTIA’s own CySA+ V4 blog lists these as new or expanded: dedicated AI coverage, EPSS-based prioritization, software bill of materials (SBOM) and supply chain risk, and ZTNA and SASE in architecture. Two changes are visible from the objectives summary itself:

1. A new AI objective. Under Security Operations, V4 includes an objective on summarizing how AI is used in security operations: use cases, risks and governance. Expect questions such as where AI-assisted triage helps, where it can mislead an analyst, and what controls should surround it. See AI governance and risk for the vocabulary.
2. Scope of the analyst’s work. The summary lists identity systems and cloud alongside networks and endpoints as places to look for malicious activity, and lists automation and workflow improvement as an objective of its own. Reporting is split into vulnerability-management reporting and security-operations/incident-response reporting.

The official objectives PDF was not available when this page was written, so finer sub-objective differences are not claimed. Download the V4 objectives from CompTIA and read them against any V3 notes you own.

Which version to take

Books, videos and practice banks written for V3 will miss the AI objective and may weight topics differently, so a V3-trained candidate moving to V4 should add that material rather than start over. The core, such as SIEM and EDR triage, CVSS-based prioritization, the incident response phases and ATT&CK, carries across.

A pass on either version gives the same certification with a three-year validity; see renewal and retakes. Once CS0-003 retires it can no longer be taken, so a failed late attempt means moving to V4 regardless.

Study consequence

Move quickly on the topics unique to V4: AI use cases, risks and governance, and the identity and cloud indicators. Then follow the study plan and test with the sample questions. Overall changes across vendors are tracked on exam changes.

Practical checklist before booking

1. Confirm today’s date against the V3 retirement dates above. A booking made close to December 22, 2026 leaves little room for a retake on CS0-003: the third and later attempts need a 14-day wait, and scheduling can push them past the retirement.
2. Check which language is needed. The translations of V3 retire later (March 23, 2027), while V4 is listed in English with other languages announced as coming.
3. Match the study material to the version. Read the objectives document for the exam you book, not the one you studied earlier.
4. If an employer reimburses the fee, ask whether the approval covers a retake on the newer version should the first attempt fail.