Security+ SY0-801 vs SY0-701: what changed, and which should you take?

Short answer: if you can be ready before June 2027, sit SY0-701. The certification you earn is identical, the study material is mature, and you avoid being an early tester of a brand-new exam. Wait for SY0-801 only if your realistic test date is later than that, or you specifically want the new AI-security objectives on your record.

CompTIA releases a new Security+ every three years or so, and Version 8 (exam code SY0-801) is the next one. Here is what's actually changing, the dates that matter, and a simple way to decide which version to book.

The dates that matter

The overlap matters. Unlike some recent CompTIA refreshes where the old exam vanished within weeks, you get a full seven months where you choose the version. That takes most of the pressure off.

What stays exactly the same

• Up to 90 questions, a mix of multiple-choice and performance-based questions (PBQs).
• 90 minutes.
• Passing score of 750 on a 100–900 scale.
• Five domains — the same five names (one gets a small rename), just reweighted.
• The certification itself. Pass either exam and you hold "CompTIA Security+", valid for three years, renewable the same way. Employers and DoD 8140 requirements see the cert, not the exam code.

Domain weights: 701 vs 801

Read the direction, not just the numbers: CompTIA moved weight away from governance and paperwork (Domain 5) and toward fundamentals and attacks (Domains 1 and 2). The exam is getting slightly more technical and slightly less managerial. Domain 2 also drops "Mitigations" from its name because the mitigation content moved into Security Operations.

What's new in SY0-801

1. AI gets its own objective

This is the headline change. Domain 2 adds an objective on security risks associated with artificial intelligence: prompt injection, training-data poisoning, model manipulation and jailbreaking, hallucinations, sensitive-data leakage through AI tools, bias, and model evasion. Domain 4 adds AI-assisted workflows to the automation-and-orchestration objective, and LLMs appear as an attack surface alongside the usual web and application targets. If you've looked at CompTIA's newer SecAI+ exam, this is a lighter version of the same thinking.

2. Modern threat vectors

The threats list catches up with how people actually get breached today: QR-code phishing ("quishing"), RCS and collaboration-tool messaging, malicious browser extensions, stolen session tokens, living-off-the-land techniques, deepfakes, MFA-bypass tricks, hardcoded secrets in code, stale credentials, and shadow IT treated as a vulnerability in its own right.

3. Current architecture and identity terms

Expect newer vocabulary: Security Service Edge (SSE) largely replaces the SASE/SD-WAN framing, cloud security posture management (CSPM), passkeys and backup codes, just-in-time access, canary accounts, secrets scanning, and BIMI alongside SPF/DKIM/DMARC for email.

4. Incident response and risk get more practical

Threat frameworks (MITRE ATT&CK, the Cyber Kill Chain, the Diamond Model) are named explicitly, incident response adds negotiation and mandatory reporting, and the vendor section picks up RFP/RFI/RFQ, vendor lock-in and legal hold.

What's been removed

Roughly as much came out as went in, which is why the exam doesn't get longer. Topics that are gone or trimmed from the objectives include blockchain, key stretching, RFID cloning, birthday/collision attacks, named injection attacks as standalone vulnerabilities (SQLi/XSS are now covered under broader application attacks), VM escape, bloatware, ICS/SCADA/RTOS/embedded-system detail, software-defined networking, containers, jump servers, proxies and load balancers as architecture topics, ABAC, PAM vaulting and ephemeral credentials, risk-appetite categories, KRIs, BPAs and governance boards.

"Removed from the objectives" doesn't mean "irrelevant to your career" — it means CompTIA won't write a question that hinges on it.

What moved (easy to miss)

• Mitigation techniques moved from Domain 2 into Domain 4 (Operations).
• CVSS and CVE scoring moved into the threat-actor / vulnerability objectives in Domain 2.
• Data roles (owner, controller, processor, custodian) moved into Domain 3 (Architecture).
• RTO, RPO, MTTR and MTBF moved from risk management into resilience (Domain 3).
• Deception technology (honeypots, honeytokens) moved into Domain 4.

If you're studying from an older book, the content is still right; it's just filed under a different domain, which matters for how you budget study time.

SY0-701 or SY0-801: a simple decision rule

Sit SY0-701 now if…

• You can realistically test before June 11, 2027. That's seven months — enough for almost any study plan.
• You're already studying. Switching versions mid-prep throws away momentum for no gain in the credential.
• A job, clearance, or school deadline needs the cert soon. Don't gamble on a brand-new exam's early quirks.
• You want the most practice material. SY0-701 has three years of practice tests, videos and study groups behind it. SY0-801 material will be thin for its first few months, and some of it will be guesswork.

Wait for SY0-801 if…

• You're starting from zero and your test date lands after mid-2027 anyway.
• AI security is central to the role you want. Having "V8" on your transcript signals current knowledge, and the AI objectives are useful on their own.
• You'd rather the governance domain be smaller. If Domain 5 is your weak spot, SY0-801 shrinks it from 20% to 14%.

How to prepare for either version

1. Pick a version and book a date. A deadline beats intentions. Decide now, using the rule above.
2. Study from the official objectives PDF for your version, not from a table of contents. Every question on the exam maps to a line in that document.
3. Drill the biggest domain first. Security Operations is 27–28% on both versions; a strong Domain 4 carries a lot of the score.
4. Practice PBQs, not just multiple choice. Firewall rules, log analysis and attack identification show up as hands-on items on both versions.
5. Take full timed mocks until you're consistently above 80%. The 90-minute clock is tighter than it sounds with PBQs.

CrushCert's Security+ bank currently maps to SY0-701, and we're building the SY0-801 track on the official V8 objectives now. We'll keep full SY0-701 coverage through its June 2027 retirement, so whichever version you choose, you'll practice against the right objectives. See the Security+ practice test page for the current state.

Frequently asked questions