Cybersecurity certification roadmap: from first cert to CISSP

How to read this cybersecurity certification roadmap

This cybersecurity certification roadmap takes you from no experience to a senior credential in four stages. Each stage lists the certifications that fit, and the experience the issuer recommends or requires. We checked every experience rule on comptia.org and isc2.org in November 2026.

One distinction matters more than any other. CompTIA recommends experience but does not require it: anyone can book Security+ or CySA+. ISC2 requires experience for SSCP and CISSP before you are fully certified. That changes when each one makes sense.

You do not need every certification on the map. Most people need one per stage, chosen for the job they want next.

The roadmap at a glance

Experience rules change with new exam versions. Check the issuer's page for the version you will sit.

Cybersecurity certifications for beginners (stages 0 and 1)

If you have never worked in IT, start here. Security work assumes you already understand how computers, operating systems and networks behave. Beginner certifications prove that.

• CompTIA A+ is the standard first certification for IT support. It takes two exams and covers hardware, operating systems, networking and security basics. Our A+ study guide has a 12-week plan.
• CompTIA Network+ covers networking concepts, implementation, operations, security and troubleshooting. Networking is the part of security that beginners most often skip and later regret.
• ISC2 Certified in Cybersecurity (CC) is an entry-level security credential with no work experience required. It is a lighter introduction to security concepts than Security+.
• CompTIA Tech+ is a basic IT literacy exam: up to 70 questions in 60 minutes. It suits people who are not sure IT is for them yet. Most career changers can skip it and start with A+.

Our recommendation: if you have no IT background, take A+ or Network+ first, then Security+. If you already work in IT support, skip straight to Network+ or Security+. A CCNA is a strong alternative to Network+ if you want deeper, Cisco-based networking; see our CCNA vs Network+ comparison.

Entry level cybersecurity certifications: Security+ and its alternatives (stage 2)

Security+ is a common first security certification and is widely listed in job and government contract requirements. It is vendor-neutral and covers threats, security architecture, security operations and governance. The exam has up to 90 questions in 90 minutes, and you need 750 on a scale of 100 to 900.

Timing matters right now. SY0-701 is the current exam, and SY0-801 launches on November 17, 2026. The English SY0-701 exam stays available until June 11, 2027. Both lead to the same Security+ certification. If you are just starting, plan for SY0-801; if you are already deep into SY0-701 study, finish and test before it retires.

The main alternative is ISC2's SSCP, which requires one year of work experience. If you have that year in security operations, it is a reasonable choice. Without it, Security+ is the simpler route, because CompTIA has no experience gate.

Try a few questions on our free Security+ practice test to see where you stand.

Specialist certifications: CySA+, PenTest+ and SecAI+ (stage 3)

After Security+, pick a direction. The specialist exams are longer and harder, and CompTIA's recommended experience jumps to three or four years.

• CySA+ is for defenders: SOC analysts, threat hunters and vulnerability analysts. The new V4 exam (CS0-004) launched June 23, 2026, with up to 85 questions in 165 minutes and a passing score of 750. Its domains are Security Operations (34%), Vulnerability Management (26%), Incident Response and Management (24%) and Reporting and Communication (16%). The English V3 exam retires December 22, 2026.
• PenTest+ is for offensive work. PT0-003 has up to 90 questions in 165 minutes, also with a 750 passing score.
• SecAI+ is CompTIA's newest exam in this group, focused on security and AI, launched February 17, 2026. It has up to 60 questions in 60 minutes.

CompTIA treats CySA+ and PenTest+ as higher-level certifications: earning either one also renews your Security+.

Senior certifications: CISSP and SecurityX (stage 4)

CISSP is ISC2's senior security certification, aimed at experienced practitioners, managers and architects. Full certification requires five years of cumulative, full-time experience in at least two of the eight CISSP domains. One year can be waived. If you pass without the experience, you become an Associate of ISC2 and have six years to earn it.

The exam uses computerized adaptive testing with 100 to 150 questions in three hours, and you need 700 out of 1000. ISC2 lists the standard registration at US$749 in the Americas. See our CISSP requirements guide before you book.

SecurityX (formerly CASP+) is CompTIA's expert-level exam, aimed at senior engineers and architects who stay hands-on. CompTIA recommends ten years of IT experience, including five in security. It is scored pass/fail with no scaled score.

Our view: CISSP fits people moving toward management, governance or architecture. SecurityX fits people who want a technical senior credential.

What the roadmap costs

Exam fees add up across four stages, so budget before you start. ISC2 publishes its prices; CompTIA's store loads prices dynamically, so for CompTIA we rely on figures reported by CompTIA partner Total Seminars after the mid-2026 price change (US list prices; other countries differ).

Renewal costs matter too. CompTIA charges a continuing education fee per three-year cycle (US$150 for Security+, CySA+ and PenTest+, US$75 for A+), and ISC2 charges CISSP holders an annual maintenance fee of US$135. Because a higher-level CompTIA certification renews the lower ones, you usually pay only for the top certification you hold. Our Security+ renewal guide explains the options.

Three sample paths

Certifications open doors, but jobs build the experience that CISSP and the senior roles require. Plan your certifications around the next job you want, not around collecting badges.