CySA+ CS0-003 vs CS0-004: what changed in V4, and which one to book

The short answer

If you sit CySA+ in English after 22 December 2026, you are taking CS0-004. If you sit it in Japanese, Portuguese or Spanish, CS0-003 stays available until 23 March 2027, and CompTIA lists those languages for V4 only as coming soon. Either way the exam looks the same on the day: up to 85 questions in 165 minutes, multiple choice mixed with performance-based questions, and 750 on a scale of 100 to 900 to pass.

What changes is where the marks are. Vulnerability Management falls from 30% to 26% of the exam, Incident Response and Management rises from 20% to 24%, Security Operations moves from 33% to 34% and Reporting and Communication from 17% to 16%. Security Operations also gains an objective that did not exist in V3: the use of AI in security operations.

What stays the same

The four domains keep their names and their order, and the question ceiling, the time limit and the pass mark are identical. The exam is still vendor-neutral and still written for working analysts: CompTIA recommends about four years in a SOC analyst or vulnerability analyst role for V4, where V3 recommended Network+ or Security+ knowledge and at least four years of hands-on experience as an incident response or SOC analyst. Most of what you learnt for V3, from reading logs to prioritising scan findings and ordering a response, carries straight over.

What V4 adds or states more explicitly

The new objective asks you to summarise concepts related to the use of AI in security operations: use cases, risks and governance considerations. In practice that means knowing where AI helps an analyst, such as enrichment and summarisation, the risks it brings, such as prompt injection, fabricated output, data exposure and over-reliance, and the controls that keep a human accountable for consequential actions.

Several existing areas are worded more concretely. The V4 summary names endpoint detection and response alongside SIEM, packet analysis tools and threat intelligence platforms; it asks you to analyse suspicious activity across networks, endpoints, cloud and identity systems; it frames process improvement around automation and workflows; it ties vulnerability prioritisation to scoring systems, threat intelligence and business context; and it asks for reporting metrics such as detection time, response time and remediation effectiveness, together with post-incident reviews.

Read the objective summaries carefully

The comparison above comes from the objective summaries CompTIA publishes on each version’s exam page. The V3 summary named specific tools and models, such as Wireshark, VirusTotal, Python and PowerShell scripting, the Diamond Model, OSSTMM and the OWASP testing guide. The V4 summary is shorter and gives MITRE ATT&CK and the Cyber Kill Chain as examples of attack methodology frameworks. A shorter summary is not proof that a topic was removed, so check the full CS0-004 objectives document before you drop anything from your notes.

How to adjust a study plan written for CS0-003

Move some of the time you would have spent on vulnerability management into incident response: ordering containment, evidence handling, escalation and root-cause work now carry more of the score. Keep vulnerability management solid, because at 26% it is still the second largest domain. Add the AI objective as a short, distinct topic, focused on use cases, risks and governance rather than on how models work. And keep practising performance-based questions, because the format that rewards reading evidence quickly has not changed.

CertSprint’s CySA+ bank is aligned to CS0-004, including questions on the new AI objective, and still covers CS0-003, which shares the same four domains. Your domain scores tell you where your reasoning is slowest, which matters more after a reweighting than before it.

Frequently asked