CompTIA Security+ 2026: SY0-701 vs SY0-801 dates, format, how to book and practice

Network cables plugged into a switch
Photo: ProjectManhattan, CC BY-SA 3.0, via Wikimedia Commons

CompTIA Security+ is a vendor-neutral certification for core cybersecurity work: assessing security, protecting cloud and on-premises systems, governance and risk, and responding to incidents. There is no fixed exam date; you buy a voucher and book your own slot. What matters most in late 2026 is the version change. As of 20 October 2026, CompTIA's pages say the current exam is SY0-701 (V7), the new SY0-801 (V8) is expected to launch on or around 17 November 2026, and the English SY0-701 retires on 11 June 2027. This guide explains which to take, how to book, the pattern, the syllabus and a study plan.

Security+ at a glance

Conducting body CompTIA
What it is for Baseline certification for security roles
Exam codes SY0-701 (V7, live); SY0-801 (V8, expected on or around 17 November 2026)
Mode Computer-based, at a Pearson VUE test centre or online
Questions Up to 90: multiple choice and performance-based
Time 90 minutes
Marking Scaled 100–900; 750 to pass; no negative marking
Languages SY0-701: English, Japanese, Portuguese, Spanish, Thai. SY0-801: English at launch
Recommended experience Network+ and two years in a security or systems administrator role (not required)
Official website comptia.org

Test dates and booking: SY0-701 or SY0-801?

Dates from CompTIA's pages, checked 20 October 2026:

SY0-701 (V7) SY0-801 (V8)
Launch 7 November 2023 Expected on or around 17 November 2026
Retirement English: 11 June 2027. Japanese, Portuguese, Spanish and Thai: 13 August 2027 Not stated
Questions and time Up to 90, 90 minutes Up to 90, 90 minutes
Pass mark 750 of 900 750 of 900

How to choose. Both versions lead to the same Security+ certification. If you have been studying V7 and can sit before 11 June 2027 (English), finish with V7: its objectives and study material are settled. If you are just starting, V8 is the version that will remain after mid-2027; check that your study material is written for SY0-801. V8's domain weights differ (see below).

Vouchers are sold through the "Buy now" links on CompTIA's pages. No price was printed on the V7 page on 20 October 2026, so check the price when you buy.

How to book

  1. Decide on SY0-701 or SY0-801 using the dates above.
  2. Buy a voucher from the Security+ page.
  3. Create a CompTIA account with your legal name as on your ID.
  4. Schedule with Pearson VUE: a test centre or online.
  5. Save the confirmation and, for online testing, run the system check in advance.

Keep ready: a government photo ID matching your account name; for online testing, a private room, webcam and stable connection.

Exam pattern

Questions Maximum 90, mixing multiple choice and performance-based tasks
Time 90 minutes on one clock; domains are not timed separately
Scoring Scaled 100–900, 750 to pass; CompTIA does not publish how many correct answers that needs
Performance-based items May be worth more than multiple choice and may give partial credit
Unscored items A form may include some, not labelled
Negative marking None

Syllabus

Domain SY0-701 weight SY0-801 weight
General Security Concepts 12% 16%
Threats, Vulnerabilities, and Mitigations (V8: "and Attacks") 22% 24%
Security Architecture 18% 19%
Security Operations 28% 27%
Security Program Management and Oversight 20% 14%

SY0-701 topics in brief:

  • General Security Concepts: control types, the CIA triad, AAA, zero trust, change management, cryptography and PKI.
  • Threats, Vulnerabilities, and Mitigations: threat actors, attack surfaces, vulnerability types, indicators of malicious activity, mitigations.
  • Security Architecture: cloud, IoT, ICS and infrastructure as code; secure enterprise infrastructure; data protection; resilience and recovery.
  • Security Operations: hardening, vulnerability management, monitoring and tools, identity and access management, incident response.
  • Security Program Management and Oversight: governance, risk management, third-party risk, compliance, audits and awareness.

Our Security+ syllabus page and our mock test follow SY0-701. For V8 objectives, use the SY0-801 page.

A six-week plan

Week 1: sit a full Security+ mock test cold, 90 minutes, to find your weakest domain. Read the official objectives for your version.

Weeks 2–3: Security Operations and Threats (half of SY0-701 between them). Make tables: attack, indicator, mitigation. Learn the incident response steps in order.

Week 4: Security Architecture and General Security Concepts: cryptography (symmetric versus asymmetric, hashing, signatures, certificates), network segmentation and cloud models.

Week 5: governance and risk: policies, risk terms, business impact analysis, third-party risk. Sit a second full mock and review it by domain (see how to analyse a mock test).

Week 6: practise performance-style tasks (reading logs, placing controls on a network diagram, matching attacks to mitigations), sit a final mock, then rest.

Pace: 90 minutes for up to 90 questions is about a minute each, but performance-based tasks take longer; move through the multiple-choice items steadily to bank time.

Frequently asked questions

When does Security+ SY0-701 retire?

The English SY0-701 retires on 11 June 2027, and the Japanese, Portuguese, Spanish and Thai versions on 13 August 2027 (CompTIA V7 page, checked 20 October 2026).

When does Security+ SY0-801 launch?

CompTIA says SY0-801 (V8) is expected to launch on or around 17 November 2026, in English.

What is the Security+ passing score?

750 on a scale of 100 to 900, for both SY0-701 and SY0-801. CompTIA does not publish how many correct answers that equals.

Is there negative marking in Security+?

No. Wrong answers do not take marks away, so answer every question.

How many questions are on the Security+ exam?

A maximum of 90, mixing multiple choice and performance-based questions, in 90 minutes.

Do I need Network+ before Security+?

No. CompTIA recommends Network+ and two years of security or systems administration experience, but neither is required.