CySA+ vs PenTest+
These two sit at the same level in CompTIA's line and point in opposite directions. CySA+ is blue team, PenTest+ is red team.
CompTIA CySA+
$425
CS0-003 retires on 22 December 2026, and is bookable until then. CS0-004 replaces it. We have not written questions for it yet.
The choice is not about difficulty. It is about which chair you want to sit in, because the day-to-day work of the two roles has almost nothing in common.
Side by side
| CySA+ | PenTest+ | |
|---|---|---|
| Exam cost | $425. | $425. |
| Experience assumed | Security+ and four years of hands-on security work. | Network+, Security+ and three to four years of penetration testing exposure. |
| Direction | Defensive. Detect, triage, respond. | Offensive. Scope, exploit, report. |
| What it tests | Log and scan interpretation, threat hunting, incident response. | Planning and scoping, reconnaissance, exploitation, reporting. |
| Tooling expected | SIEM output, vulnerability scanners, packet captures. | Nmap, Burp, Metasploit, scripting in Python and Bash. |
| Legal and scoping content | Light. Governance appears but is not the focus. | Heavy, and it is a whole domain. Rules of engagement matter. |
| Study time | Eight to twelve weeks. | Ten to fourteen weeks, more without lab practice. |
| Difficulty | Analysis under time pressure. Hard to fake without exposure. | Broad tooling knowledge plus scoping. Hands-on labs are not optional. |
| Typical roles | SOC analyst, threat hunter, incident responder. | Penetration tester, vulnerability analyst, red team operator. |
| Job market size | Considerably larger. Most security hiring is defensive. | Smaller and more competitive, with higher ceilings. |
Which one to take first
CySA+ if you want to be employed sooner. Defensive roles outnumber offensive ones several times over, and a SOC is where most security careers actually start.
PenTest+ if you already know you want offensive work and have done lab practice to prove it to yourself. It is a poor first security certification and a reasonable second one.
If you genuinely cannot choose, that is a signal to take CySA+. Defensive work exposes you to the offensive side constantly, and analysts move into testing far more often than testers move into analysis.
When the answer is the other one
Take PenTest+ instead if you already do offensive work
Somebody who runs engagements does not need a defensive certification to prove it. CySA+ would certify skills adjacent to your job rather than the ones in it, and PenTest+ carries the scoping and reporting content that separates a professional tester from somebody who owns a copy of Metasploit.
Take eJPT instead if you want offensive work and are new
PenTest+ is multiple choice with performance items. eJPT is a fully practical assessment against a real lab network, costs less, and proves you can actually do the work rather than describe it. For a first offensive credential it is the more honest signal.
Take neither if you do not yet hold Security+
Both of these assume the vocabulary and reasoning Security+ teaches, and both are considerably more expensive. Starting here means learning two things at once under exam pressure, which is the usual reason people fail an intermediate certification twice.
The short version
CySA+ for the larger job market and the more common career start.
PenTest+ for people already committed to offensive work, and after Security+ rather than before it.
Frequently asked questions
Which is harder, CySA+ or PenTest+?
They are comparable in level. PenTest+ demands broader tooling knowledge and hands-on lab practice; CySA+ demands the ability to interpret real output under time pressure. Neither is meaningfully easier.
Can I take PenTest+ without Security+?
Nothing enforces it, but it is a poor idea. PenTest+ assumes you already understand the controls you are testing, which is what Security+ covers.
Which pays more?
Penetration testing has a higher ceiling and fewer positions. Defensive analysis has more openings at every level. Neither certification sets a salary on its own.
Answer a few from each.
Free sample questions for both, with the full explanation on every answer. Nothing tells you which exam suits you like sitting a few of its questions.