The quick answer
If you'll test before Security+ V8 comes out, you're taking SY0-701. CompTIA expects SY0-801 on or around November 17, 2026, and the English SY0-701 exam retires June 11, 2027. Between those dates both are open, so let your test date and the material you've already studied make the call.
- Nov 17, 2026SY0-801 expected launch, on or around this date
- Jun 11, 2027Last day to take SY0-701 in English
- 90 / 90 / 750Max questions, minutes and passing score, on both versions
- Nov 30, 2026First Accumentum Security+ start on the V8 course
A lot of what's been written about SY0-801 was based on early drafts. This guide is built from CompTIA's own exam pages and the two official objectives documents, SY0-701 version 7.0 and SY0-801 version 2.0, checked on October 9, 2026. Where CompTIA hasn't confirmed something, you won't find it here.
Here's the short version. The exam keeps its shape. It's still five domains, 90 minutes and a 750 to pass. What changes is how much each domain counts, where a lot of topics now live, and one brand new objective on artificial intelligence.
Dates to plan around
- SY0-701 launched.
- On or around November 17, 2026SY0-801 is expected to launch. CompTIA lists English as its only language so far.
- First Accumentum Security+ start on our V8 (SY0-801) course. Every start after this one is V8 too.
- SY0-701 retires in English.
- SY0-701 retires in Japanese, Portuguese, Spanish and Thai.
- About three years after launchCompTIA's estimate for when V8 itself retires.
So English candidates get a window of almost seven months where either exam counts. If you test in one of the other four languages, you have two more months on SY0-701.
Watch the words "on or around." CompTIA calls November 17 the expected date, and expected dates can slip. Don't plan a V8 test for launch week until you can actually see a seat to book. June 11, 2027 is the firm date, so build your plan around that one.
The two exams side by side
| Detail | SY0-701 (V7) | SY0-801 (V8) |
|---|---|---|
| Launch | November 7, 2023 | On or around November 17, 2026 |
| Retirement | June 11, 2027 in English. August 13, 2027 in Japanese, Portuguese, Spanish and Thai | Estimated three years after launch |
| Questions | Maximum of 90 | Maximum of 90 |
| Question types | Multiple choice and performance-based | Multiple choice and performance-based |
| Time | 90 minutes | 90 minutes |
| Passing score | 750 on a 100 to 900 scale | 750 on a 100 to 900 scale |
| Languages | English, Japanese, Portuguese, Spanish, Thai | English |
| Recommended experience | Network+ and two years in a security or systems administrator role | Two years of hands-on experience as a security administrator |
| Objectives | 28 | 27 |
| "Given a scenario" objectives | 7 of 28 | 9 of 27 |
| Acronym list | More than 300 entries | About 100 entries |
The last three rows are worth a second look. CompTIA marks its hands-on objectives with the phrase "Given a scenario," and V8 has two more of them while having one fewer objective overall. The acronym list at the back of the objectives also shrank to about a third of its old size. My read is that V8 leans a little further toward applying ideas and a little less toward memorizing terms. That's my inference from the documents. CompTIA hasn't said so.
The experience line changed too. V7 pointed people to Network+ first. V8 drops the Network+ mention and describes the target candidate as a security administrator with two years of hands-on work. Neither version requires it. It's only a recommendation.
Seen "question count to be announced" somewhere? Some early write-ups said the SY0-801 question count and time limit were still undecided. CompTIA's V8 page and the final objectives now list a maximum of 90 questions and 90 minutes.
Where the points moved
The five domains keep their names, with one change. Domain 2 goes from Threats, Vulnerabilities, and Mitigations to Threats, Vulnerabilities, and Attacks. The mitigations didn't vanish. Most of them moved into Security Operations, which you'll see below.
| Domain | SY0-701 | SY0-801 | Change | Objectives |
|---|---|---|---|---|
| 1.0 General Security Concepts | 12% | 16% | Up 4 | 4 to 3 |
| 2.0 Threats, Vulnerabilities, and Attacks (Mitigations in 701) | 22% | 24% | Up 2 | 5 to 6 |
| 3.0 Security Architecture | 18% | 19% | Up 1 | 4 to 4 |
| 4.0 Security Operations | 28% | 27% | Down 1 | 9 to 8 |
| 5.0 Security Program Management and Oversight | 20% | 14% | Down 6 | 6 to 6 |
Governance and oversight takes the biggest hit. On a 90 question exam, six points is roughly five questions' worth of material, and part of the drop comes from data roles and recovery metrics moving out of Domain 5 into Domain 3.
Domain 1 goes the other way. It gains four points while shrinking from four objectives to three. V8 folds the old control types objective and the old fundamentals objective into one, 1.1, organized around defense in depth. That single objective now holds CIA, AAA, non-repudiation, Zero Trust principles, least privilege, control categories and control types. Fewer objectives carrying more weight usually means each one gets tested harder, so I wouldn't skim Domain 1 just because it looks short.
The new AI objective, and the other places AI shows up
V8 adds exactly one objective built around AI. It's 2.6, "Summarize threats and vulnerabilities associated with artificial intelligence (AI) usage," and it lists 13 topics.
- Model manipulation
- Poisoning
- Prompt injection
- Data loss
- Bias
- Explainability
- Hallucinations
- Jailbreaking
- Evasion
- Privacy
- Ethical considerations
- Session hijacking
- Code execution
Pay attention to the verb. "Summarize" sits low on CompTIA's scale. You should be able to recognize each item, say what it is and what harm it can do. Designing defenses for an AI system isn't part of this objective. If that's the part you want, CompTIA's SecAI+ covers AI security on its own.
AI also turns up inside three objectives that already existed.
Vulnerabilities
Large language models appear as one entry in the list of vulnerabilities and attack surfaces, next to items like zero-day and misconfiguration.
Malicious activity
Deepfakes join the social engineering attacks, along with quishing, which is phishing through QR codes.
Automation
A new AI block lists agentic AI, chatbots, predictive analysis and AI-augmented baselines as capabilities a security team can use.
Topics with a new address
A good share of what looks new in V8 is old material that moved. If you're working from SY0-701 books or videos, this table keeps you from thinking a topic got cut when it only got renumbered.
| Topic | SY0-701 | SY0-801 |
|---|---|---|
| Mitigations such as segmentation, access control and hardening | 2.5 | 4.1, now "apply mitigating controls, techniques, and solutions" |
| Firewalls, IDS and IPS, network access control, 802.1X | 3.2 and 4.5 | 4.1 |
| Honeypots, honeynets, honeyfiles, honeytokens | 1.2 | 4.1, with canary accounts added |
| Zero Trust | 1.2 | 1.1 for the principles, 3.2 for the architecture (user authentication, device health and inventory, application access control) |
| CVSS and CVE | 4.3 | 2.1, a new objective on the characteristics of threats and vulnerabilities |
| Data roles like owner, controller, custodian and steward | 5.1 | 3.3, with data operator and data subprocessor added |
| RTO, RPO, MTTR, MTBF | 5.2, under business impact analysis | 3.4, as recovery metrics |
| Shadow IT | 2.1, as a threat actor | 2.4, as a vulnerability |
| SLE, ALE, ARO | 5.2 | 5.2, unchanged |
Objective 4.1 is the one I'd flag for anyone switching versions. It pulls together the old mitigation list, firewall and filtering material, endpoint security and the deception tools, then adds rate limiting, captive portals, endpoint posture checks, secrets scanning in code repositories and BIMI alongside SPF, DKIM and DMARC. It's the biggest single objective on the new exam.
The numbers shift across the board, which matters if your practice questions are tagged by objective.
| Subject | SY0-701 | SY0-801 |
|---|---|---|
| Change management | 1.3 | 1.2 |
| Cryptographic solutions | 1.4 | 1.3 |
| Threat actors and motivations | 2.1 | 2.2 |
| Threat vectors | 2.2 | 2.3 |
| Vulnerabilities | 2.3 | 2.4 |
| Indicators of malicious activity | 2.4 | 2.5 |
| Identity and access management | 4.6 | 4.5 |
| Automation and orchestration | 4.7 | 4.6 |
| Incident response | 4.8 | 4.7 |
| Data sources for investigations | 4.9 | 4.8 |
Other new material worth knowing
Beyond AI, most additions land in Domain 2 and in the day-to-day objectives of Domains 4 and 5. These are terms that appear in the SY0-801 objectives and weren't in the SY0-701 objectives.
Threats and attacks
- Threat vectors such as RCS messages, collaboration tools, QR codes, RTF and PDF attachments, browser extensions, session tokens, living-off-the-land tools, and logistics and SaaS providers
- Vulnerabilities including hardcoded secrets, unsafe exception handling, stale credentials, rogue devices, public code repositories and public object storage
- Fileless malware, adware, user enumeration, MFA bypass and a named list of indicators of compromise
Architecture and data
- Multicloud and the cloud deployment models (public, private, hybrid, community)
- Security Service Edge, out-of-band management, end-to-end encrypted messaging, group managed service accounts and privilege creep
- Structured and unstructured data, secret and top secret classifications, deidentification, geofencing and a data life cycle
- Backup immutability, restoration testing, autoscaling, redundant power supplies and surge protectors
Operations
- Vulnerability work with IPAM, cloud security posture management, source code review and penetration test report review
- Account types including emergency access, plus passkeys, backup codes, compromised credential monitoring and access reviews
- Incident response phases for negotiation and for notification and external reporting, internal and external advisories, and post-incident reporting
- Investigation sources like memory dumps, bit-level copies, IPFIX and log parsing, with HR and legal as stakeholders
Governance and oversight
- Runbooks, RFCs, reference architectures, and policies for clean desk, data disposal and vulnerability disclosure
- Vendor selection through RFPs, RFIs, RFQs and expressions of interest, plus service-level objectives, a vendor registry and vendor lock-in
- Compliance training on anti-money laundering and anti-bribery
- MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model named as reference sources for audits
- Learning management systems and personnel behavior risk scoring for awareness programs
Two of these stand out to me. Negotiation is now listed as its own incident response activity, which most people will connect to ransomware. And seeing ATT&CK, the Kill Chain and the Diamond Model named in a Security+ objective means you should know what each framework is for, even at an entry level.
What CompTIA cut
Some topics that were in the SY0-701 objectives don't appear anywhere in the SY0-801 objectives. A few of them surprise people.
Networking and architecture
- SASE and SD-WAN are gone, and SSE is listed instead
- Containerization, ICS, RTOS and embedded systems are out of the architecture models
- Jump servers no longer appear
Cryptography
- Blockchain and the open public ledger
- Key stretching
- Steganography, while obfuscation stays
Threats and indicators
- Memory injection and resource reuse as vulnerabilities
- Bloatware and RFID cloning
Identity and risk
- Attribute-based access control
- Password vaulting, ephemeral credentials and "somewhere you are"
- Expansionary, conservative and neutral risk appetite types, and key risk indicators
- Business partners agreements and work orders
One caution. CompTIA notes that the example lists in its objectives aren't exhaustive, so a missing term isn't a promise it will never show up. I'd still spend your hours where the objectives point.
Is SY0-801 harder than SY0-701?
Nobody can tell you that honestly before people start sitting it, and I'd be wary of anyone who claims to know. The question limit, time and passing score are the same. What changes is the mix. If you're strong on hands-on security work and weaker on policy, V8's weights may suit you a little better. Governance and risk your comfort zone? SY0-701 still gives that material more room.
Which version I'd take
Students ask me this a lot, and I start with one question. When will you realistically be ready to sit the exam? Not the date you'd like, the date you'll actually be ready.
Take SY0-701
It's the only version you can book. Nothing to decide.
Finish what you started
Already studying for SY0-701? Stay with it. Practice materials for it are mature and it earns the same Security+. Starting from zero now? Go with SY0-801.
Study for SY0-801
Booking SY0-701 close to June 11 leaves no room if you need a second attempt. After that date the English exam is gone.
Don't put Security+ on hold for V8 if your employer or a DoD role needs it now. Either version earns you Security+, and that's what those requirements ask for. Our DoD 8570 and 8140 page explains how the requirement works, and the Security+ jobs and salary page covers the roles that ask for it.
The opposite mistake happens too. People hear a new version is coming and stall for months. Four of the five domain names carry over and the format is identical, so time you spend studying now is rarely wasted.
Caught between them? Study these first
If you prepared on SY0-701 material and your test date lands on SY0-801, this is where I'd spend the extra hours, in this order.
- Objective 2.6. Learn all 13 AI topics well enough to explain each one in a sentence.
- Objective 4.1. It's the largest objective now and gathers controls from four different places in V7.
- The 2.3 threat vectors. Most of the new vocabulary lives here, from RCS and quishing to session tokens and living-off-the-land tools.
- Objective 4.5. Account types, passkeys, backup codes and compromised credential monitoring.
- Objective 4.7. Negotiation, advisories, notification and external reporting, and post-incident reporting.
- Objective 5.5. Know what ATT&CK, the Cyber Kill Chain and the Diamond Model are used for.
- The new numbering, so objective tags on practice questions don't send you to the wrong topic.
The core is all still there. Controls, PKI, threat actors, Zero Trust, identity, vulnerability management, incident response and quantitative risk carry over, sometimes under a new number.
Does my current Security+ expire when SY0-801 launches?
No. CompTIA certifications like Security+ are good for three years from the date you certify, whichever version you passed. To renew Security+ you earn 50 continuing education units during that three-year cycle, or use one of CompTIA's single-activity options. Our guide to keeping your certification active walks through them.
Accumentum Security+ start dates
Every Security+ start on our calendar after CompTIA releases V8 is our Security+ V8 (SY0-801) course. With the launch expected on or around November 17, 2026, that's every start from Monday, November 30 on. The two starts before that use our Security+ SY0-701 course.
- Monday, October 26, 2026Security+ SY0-701Register for Oct 26
- Monday, November 9, 2026Security+ SY0-701Register for Nov 9
- Monday, November 30, 2026Security+ V8 (SY0-801)Register for Nov 30
- Monday, January 4, 2027Security+ V8 (SY0-801)Register for Jan 4
- Wednesday, January 13, 2027Security+ V8 (SY0-801)Register for Jan 13
- Monday, January 25, 2027Security+ V8 (SY0-801)Register for Jan 25
- Tuesday, February 16, 2027Security+ V8 (SY0-801)Register for Feb 16
- Monday, March 1, 2027Security+ V8 (SY0-801)Register for Mar 1
- Monday, March 22, 2027Security+ V8 (SY0-801)Register for Mar 22
New Security+ classes start every 2 to 3 weeks, and every start after March 22 is the V8 course too. Starting November 9? Most students finish in 4 to 8 weeks part-time, so you'll likely test after SY0-801 is out. That's fine. SY0-701 stays open in English until June 11, 2027, so take the exam that matches the course you studied. If CompTIA moves the launch date, check this page again before you register.
How we help with either exam
Security+ V8 (SY0-801) course
Follows CompTIA's five new domains, with one module per domain, including objective 2.6 on AI.
Security+ SY0-701 course
For anyone testing before SY0-701 retires. Most students finish in 4 to 8 weeks part-time.
When you enroll, tell us your target test date and we'll confirm which course fits. Since August 2022, 2,405 Accumentum students have certified out of about 2,435 attempts, a 98.8% pass rate.
Not sure where you stand? The free Security+ Exam Readiness Score is 20 questions and gives you a quick read. PathPass® has a Security+ SY0-701 practice bank at $19 a month for one exam or $39 for all banks, with a free preview. Check the PathPass page for when the SY0-801 bank is available.
Ways to pay for your Security+ course
Pay monthly
The PathPay 12-Month Program lists Security+ at $162.50 a month, $1,950 total, with the exam voucher included. PathPay® is a payment plan, not a loan.
Have your employer pay
Many employers set aside training funds. Ask before you enroll, since most want their paperwork done before the course starts. The funding page covers the options.
Army CA and Air Force COOL
Accumentum is an Army CA and Air Force COOL Approved Vendor, but the Army or the Department of the Air Force decides eligibility and payment. Get approval before you enroll. See our Army CA and Air Force COOL pages.
Questions about which course or payment option fits? Email us at info@accumentum.net.
Frequently asked questions
When is the Security+ SY0-801 release date?
CompTIA expects SY0-801 to launch on or around November 17, 2026, in English, as of October 9, 2026.
When does Security+ SY0-701 retire?
The English SY0-701 exam retires June 11, 2027. In Japanese, Portuguese, Spanish and Thai, it retires August 13, 2027.
What's new in Security+ SY0-801?
SY0-801 adds objective 2.6 on threats and vulnerabilities in AI usage and shifts the domain weights. General security concepts rises to 16 percent, threats, vulnerabilities and attacks rises to 24 percent, and security program management and oversight drops to 14 percent. Many topics also move, with most mitigations now in objective 4.1.
Is SY0-801 the same format as SY0-701?
Yes. Both have a maximum of 90 multiple choice and performance-based questions, a 90 minute limit and a passing score of 750 on a 100 to 900 scale.
What did CompTIA remove from Security+ in SY0-801?
The SY0-801 objectives no longer list SASE and SD-WAN, which are replaced by Security Service Edge. Containerization, blockchain, key stretching, steganography, attribute-based access control, password vaulting and the risk appetite types are also gone from the objectives.
Which Accumentum Security+ starts use the V8 course?
Every start after CompTIA releases V8. With the launch expected on or around November 17, 2026, that's every start from Monday, November 30, 2026 on. The October 26 and November 9 starts use the SY0-701 course.
Should I wait for SY0-801?
Only if your test date will fall late in the spring of 2027 or after June 11, 2027, or you haven't started studying yet and plan to test after launch. If you need Security+ sooner, take SY0-701.
Does my Security+ expire when SY0-801 comes out?
No. Security+ is good for three years from the date you certify, whichever version you passed. You renew with 50 continuing education units in that cycle or another CompTIA renewal option.
Sources
All checked October 9, 2026.
- CompTIA, Security+ V8 exam details, launch date and domain weights: comptia.org/en-us/certifications/security/v8/
- CompTIA, Security+ SY0-801 V8 Exam Objectives, document version 2.0, linked from the V8 page: SY0-801 objectives (PDF)
- CompTIA, Security+ V7 exam details, domain weights and retirement dates: comptia.org/en-us/certifications/security/v7/
- CompTIA, Security+ SY0-701 V7 Exam Objectives, document version 7.0: SY0-701 objectives (PDF)
- CompTIA, Security+ certification overview: comptia.org/en-us/certifications/security/
- CompTIA, Certification Renewal Policy: comptia.org certification renewal policy
- CompTIA, Earn Continuing Education Units: comptia.org CEU requirements