- CS0-004 Domain 1, Security Operations (34%).
- Build a practical foundation in security operations by learning how SOC teams collect, triage, investigate, escalate, document, and improve security monitoring across enterprise environments.
- Explain system and network architecture concepts that matter in security operations, including security architecture components, identity concepts, and logging practices.
- Learn how analysts interpret alerts, establish context, identify scope, reduce false positives, determine severity, and communicate operational risk to technical stakeholders.
- Apply scenario-based workflows that connect CySA+ exam objectives to real SOC operations, ticket queues, escalation procedures, and continuous monitoring.
CompTIA Cybersecurity Analyst Certification Training Course
CompTIA CySA+ Certification Training Course
Build the detection, analysis, vulnerability management, incident response, and reporting skills analysts use every day. Accumentum’s CompTIA CySA+ course now prepares you for CySA+ V4 (CS0-004), released June 23, 2026.
Course focus: Security operations, AI in security operations, threat intelligence and hunting, vulnerability management, incident response and management, and reporting and communication, aligned with CompTIA’s CySA+ V4 (CS0-004) exam objectives.
Course Overview
Develop the practical cyber defense skills required for security operations, vulnerability management, incident response, and analyst-level communication.
Accumentum’s CompTIA CySA+ Certification Training Course is for current and aspiring SOC analysts, incident response analysts, vulnerability management analysts, threat intelligence analysts, and IT security staff who need to detect, analyze, prioritize, respond to, and report on threats.
The course now follows CySA+ V4, exam code CS0-004, which CompTIA released on June 23, 2026. The four domains are Security Operations (34%), Vulnerability Management (26%), Incident Response and Management (24%), and Reporting and Communication (16%). V4 adds an objective on the use of AI in security operations and names SIEM, EDR, packet analysis, and threat intelligence platforms as core analyst tools.
CySA+ V3 (CS0-003) is retiring. CompTIA retires the English CS0-003 exam on December 22, 2026, and the Japanese, Portuguese, and Spanish versions on March 23, 2027. If you are partway through CS0-003 study, the transition section and FAQs below explain your options.
Instruction connects each objective to analyst work: reading logs and telemetry, correlating alerts, hunting for threats, running and interpreting vulnerability scans, prioritizing remediation, supporting incident response, and writing reports that non-technical stakeholders can act on.
Course Objectives
Build CySA+ CS0-004 readiness and operational cybersecurity analyst capability.
01
Security Operations
Analyze indicators of malicious activity across networks, endpoints, cloud, and identity systems, use SIEM and EDR tools, apply threat intelligence and hunting, and explain how AI is used in security operations.
02
Vulnerability Management
Choose the right scanning method, analyze tool output, prioritize vulnerabilities with risk-based approaches, and explain control types and compliance practices used to manage risk.
03
Incident Response and Management
Apply attack methodology frameworks such as MITRE ATT&CK and the Cyber Kill Chain, follow the incident response process, and use triage, evidence handling, escalation, and root cause techniques.
04
Reporting and Communication
Report vulnerability and incident findings through reports and dashboards, run post-incident reviews, and track metrics such as detection time, response time, and remediation effectiveness.
Who Should Attend
- Aspiring and current cybersecurity analysts preparing for CompTIA CySA+ CS0-004.
- SOC analysts, incident response analysts, threat intelligence analysts, vulnerability management analysts, and cyber defense staff who monitor, triage, escalate, and report.
- Network administrators, systems administrators, help desk staff, and cloud support staff moving into analyst roles.
- CS0-003 candidates who will not test before the English retirement date of December 22, 2026.
Prerequisites
- There are no Accumentum enrollment prerequisites, but you should understand networking, operating systems, and basic security concepts before you start.
- CompTIA recommends about four years of experience in a SOC analyst or vulnerability analyst role for CySA+ V4.
- Security+, Network+, or equivalent hands-on work with logs, alerts, scans, and tickets will help you apply the material faster.
- Experience supporting IT infrastructure, investigating suspicious behavior, or handling security tickets is useful background.
Pathway Map
The CompTIA CySA+ training course covers the complete cybersecurity analyst workflow.
The curriculum connects CS0-004 exam objectives with real SOC work across telemetry, threat intelligence, threat hunting, vulnerability management, incident response, AI in security operations, reporting, and continuous improvement.
Course Content
- CS0-004 Domain 1, Security Operations (34%).
- Explain threat intelligence and threat hunting concepts, including frameworks, data sources, indicators, tactics, techniques, procedures, threat actors, confidence levels, and sharing models.
- Use frameworks and adversary behavior models to understand how attackers move through environments, abuse identity, evade detection, persist, exfiltrate data, and impact business operations.
- Learn how analysts transform raw intelligence into detection opportunities, hunting hypotheses, enrichment steps, prioritized alerts, and defensive recommendations.
- Practice threat hunting scenarios that require forming a hypothesis, gathering telemetry, testing assumptions, identifying evidence, and documenting findings for operational follow-up.
- CS0-004 Domain 1, Security Operations (34%).
- Analyze indicators of potentially malicious activity across networks, endpoints, cloud, and identity systems using structured investigation methods.
- Use SIEM, EDR, packet analysis tools, and threat intelligence platforms, along with firewall, DNS, authentication, and application logs, to support analyst decisions.
- Practice using appropriate tools and techniques to determine malicious activity, validate alert fidelity, identify patterns, correlate related events, and escalate incidents appropriately.
- Build analyst confidence through investigation scenarios involving malware, phishing, credential abuse, lateral movement, suspicious network traffic, unauthorized access, command-and-control, and data exposure indicators.
- CS0-004 Domain 2, Vulnerability Management (26%).
- Implement the appropriate vulnerability scanning method to find vulnerabilities across systems, networks, and applications, including asset discovery, internal and external scans, credentialed and non-credentialed scans, and active and passive approaches.
- Understand scan planning considerations for cloud systems, mobile assets, critical infrastructure, segmented networks, authenticated assets, production systems, and environments with uptime requirements.
- Learn how vulnerability management programs use scanning cadence, asset ownership, scope control, validation, exceptions, prioritization criteria, and remediation workflows to reduce exposure.
- Apply scanning scenarios that require selecting the right scan type, interpreting scope limitations, identifying data quality issues, and communicating constraints to technical teams.
- CS0-004 Domain 2, Vulnerability Management (26%).
- Analyze output from vulnerability assessment tools and translate technical findings into prioritized remediation actions based on severity, exploitability, asset criticality, exposure, business impact, and compensating controls.
- Prioritize vulnerabilities with risk-based approaches that use scoring systems, threat intelligence, exploit availability, and business context.
- Recommend mitigation strategies including patching, configuration changes, segmentation, access control, compensating controls, secure coding fixes, temporary workarounds, and risk acceptance documentation.
- Practice remediation planning scenarios that require validating fixes, tracking ownership, reporting progress, managing exceptions, and communicating risk to both technical and business stakeholders.
- CS0-004 Domain 3, Incident Response and Management (24%).
- Outline the incident response process: preparation, detection, analysis, containment, eradication, and recovery, plus post-incident activity and lessons learned.
- Use attack methodology frameworks such as MITRE ATT&CK and the Cyber Kill Chain to map observed behavior, estimate attacker objectives, and prioritize response actions.
- Learn how analysts support evidence gathering, communication, containment decisions, stakeholder coordination, service restoration, business continuity, and documentation during active incidents.
- Practice incident response simulations involving malware infection, credential compromise, data leakage, unauthorized access, ransomware indicators, cloud account abuse, and suspicious lateral movement.
- CS0-004 Domain 3, Incident Response and Management (24%).
- Implement incident response techniques including triage, evidence handling, escalation, remediation, and root cause identification.
- Learn how analysts support investigation integrity while coordinating with incident responders, legal teams, management, compliance personnel, and third-party response providers.
- Explore recovery considerations such as restoring services, validating eradication, confirming account security, verifying system integrity, improving monitoring, and reducing recurrence risk.
- Apply recovery-focused scenarios that require documenting incident evidence, recommending next steps, validating containment, and supporting post-incident improvement actions.
- CS0-004 Domain 1, Security Operations (34%).
- Describe efficiency and process improvement in security operations, including automation, workflows, and processes that reduce repetitive work.
- Summarize how AI is used in security operations, including use cases, risks, and governance considerations. This objective is new in CS0-004.
- Learn how scripts, APIs, SOAR concepts, detection rules, queries, dashboards, playbooks, ticketing integrations, and threat intelligence feeds improve security operations efficiency.
- Practice analyst efficiency scenarios that require choosing appropriate tools, using repeatable workflows, documenting assumptions, and improving the reliability of security operations processes.
- CS0-004 Domain 4, Reporting and Communication (16%).
- Explain vulnerability management reporting and communication, including reports, dashboards, and communication that present findings and support escalation during security events.
- Learn how to create meaningful analyst reports that include evidence, severity, scope, business impact, recommended actions, ownership, timelines, limitations, and measurable outcomes.
- Report on security operations and incident response with incident documentation, post-incident reviews, and metrics such as detection time, response time, and remediation effectiveness.
- Practice executive and technical reporting scenarios that require translating complex security findings into clear, defensible, actionable recommendations for different audiences.
- CS0-004 Domain 2, Vulnerability Management (26%).
- Explain control types, risk, and vulnerability management concepts, including the controls, policies, and compliance practices used to manage risk.
- Connect analyst findings to frameworks, baselines, policies, procedures, regulatory expectations, business objectives, and management reporting needs.
- Learn how post-incident reviews, vulnerability trends, recurring alerts, detection gaps, training needs, and control weaknesses inform security program improvement.
- Apply governance and improvement scenarios that require recommending stronger controls, updating processes, refining reporting, improving documentation, and aligning analyst work with organizational risk priorities.
Course Features
Designed for practical CySA+ training and cybersecurity analyst certification preparation.
Security Operations Practice
Expert-led SOC scenarios, detection analysis, alert triage exercises, and analyst discussions.
Hands-On Analyst Labs
Applied exercises covering logs, telemetry, SIEM and EDR concepts, vulnerability findings, threat intelligence, incident response, and reporting.
Transition Guidance
Clear advice for CS0-003 candidates on when to test on the retiring exam and when to move to CS0-004.
Career Pathway Support
Connect CySA+ training to SOC analyst, incident response, threat intelligence, and vulnerability management roles.
Certification Exam
CS0-003 to CS0-004: exam details and transition.
CySA+ CS0-004 Exam Readiness
Accumentum’s CySA+ course prepares you to analyze malicious activity, manage vulnerabilities, support incident response, and report findings across all four CS0-004 domains.
CompTIA released CySA+ V4, exam code CS0-004, on June 23, 2026. CS0-004 has a maximum of 85 questions, a 165 minute time limit, and a passing score of 750 on a scale of 100 to 900. It is offered in English, with French, Japanese, Spanish, and Portuguese listed by CompTIA as coming soon. CompTIA recommends about four years of experience in a SOC analyst or vulnerability analyst role.
CySA+ V3 (CS0-003) is retiring. CompTIA retires English CS0-003 learning products on November 22, 2026, the English CS0-003 exam on December 22, 2026, and the Japanese, Portuguese, and Spanish versions on March 23, 2027.
The four domain names stay the same, but the weights change. Security Operations moves from 33% to 34%, Vulnerability Management from 30% to 26%, Incident Response and Management from 20% to 24%, and Reporting and Communication from 17% to 16%. CS0-004 adds an objective on the use of AI in security operations.
If you are ready to test on CS0-003, schedule before December 22, 2026 (English). If your test date will be later, study for CS0-004.
Accumentum is an independent training provider. CompTIA sets and changes exam rules, dates, fees, and policies, so confirm current details on comptia.org before you schedule.
Career Outcomes
Where CompTIA CySA+ can take your career.
CompTIA CySA+ shows employers that you can do the work in security analytics and response. We built this course around the jobs our learners actually go after, so the labs and reviews map to tasks you will see in those roles.
SOC Analyst
Hunt, triage, and escalate incidents in a security operations center.
Threat Intelligence Analyst
Turn threat data into detections and briefings.
Incident Response Analyst
Contain, investigate, and document security incidents.
Vulnerability Management Analyst
Prioritize findings and track remediation to closure.
Funding and PathPay
Ways to pay for CompTIA CySA+ training.
Accumentum is an Army CA and Air Force COOL Approved Vendor. If you are a soldier or airman, start a request in ArmyIgnitED or AFVEC. Those systems decide eligibility and funding for each course, and we help you with the paperwork. See our Army CA pathway, our AF COOL pathway, and the full funding options page.
Paying on your own? PathPay lets you start CompTIA CySA+ training after your first monthly payment clears and spread the rest of the course fee over a short schedule. You get the same instructors, labs, and support as a full upfront enrollment. Questions about funding? Email us at info@accumentum.net.
Related Training
Courses that pair well with CompTIA CySA+.
CySA+ holders who want to lead security programs often move on to SecurityX. You can browse the full CompTIA training catalog or our complete course list.
CompTIA Security+ Certification Training Course
Pairs with CySA+ by extending your skills in core cybersecurity operations.
CompTIA PenTest+ Certification Training Course
Pairs with CySA+ by extending your skills in offensive security testing.
CompTIA SecurityX Certification Training Course
Pairs with CySA+ by extending your skills in advanced security architecture and engineering.
Study Plan
How we pace the CompTIA CySA+ course.
Our CompTIA CySA+ course has 10 modules. We teach them in order because each one builds on the last. In the first half you work through Security Operations Foundations and SOC Workflow, Threat Intelligence, Threat Hunting, and Adversary Behavior, Detection Engineering, Log Analysis, and Malicious Activity Investigation, Vulnerability Scanning Methods and Assessment Workflows, and Vulnerability Analysis, Prioritization, and Remediation Recommendations. In the second half you move on to Incident Response, Incident Management, and Attack Methodology Frameworks, Incident Response Techniques, Evidence Handling, and Recovery Support, Automation, AI in Security Operations, and Analyst Efficiency, Reporting, Metrics, Communication, and Actionable Recommendations, and Control Types, Risk, Compliance, and Continuous Improvement.
Plan on steady weekly study between sessions. Read the objectives for the week before class, practice the skills in a lab or on your own gear, and come with questions. Near the end we review weak spots against the official CySA+ CS0-004 objectives so you go into the exam with a clear plan.
Frequently Asked Questions
How Accumentum’s CompTIA CySA+ course supports CS0-004 preparation, what CS0-003 candidates should know before the retirement date, and how the course is delivered.
CompTIA CySA+ is a vendor-neutral cybersecurity analyst certification. CompTIA says it validates your ability to detect, analyze, and respond to threats in security operations and vulnerability management roles.
The course prepares you for CySA+ V4, exam code CS0-004, which CompTIA released on June 23, 2026.
CompTIA retires the English CS0-003 exam on December 22, 2026. English CS0-003 learning products retire on November 22, 2026. Japanese, Portuguese, and Spanish versions of the exam retire on March 23, 2027.
If you can test in English by December 22, 2026, you can finish on CS0-003. If your test date will be later, switch to CS0-004. The four domain names are the same, so earlier study still counts, but review the new objective on AI in security operations and the heavier weight on incident response. Contact Accumentum if you are unsure which path fits your date.
Domain weights shift: Security Operations 33% to 34%, Vulnerability Management 30% to 26%, Incident Response and Management 20% to 24%, and Reporting and Communication 17% to 16%. CS0-004 adds an objective on AI in security operations and names SIEM, EDR, packet analysis, and threat intelligence platforms as analyst tools. The maximum question count (85), time limit (165 minutes), and passing score (750) stay the same.
A maximum of 85 questions in 165 minutes, with a passing score of 750 on a scale of 100 to 900. The exam is in English, with French, Japanese, Spanish, and Portuguese coming soon according to CompTIA.
There are no Accumentum enrollment prerequisites. CompTIA recommends about four years of experience in a SOC analyst or vulnerability analyst role before taking CS0-004.
Security+ covers foundational security knowledge. CySA+ focuses on analyst work: detecting threats, analyzing telemetry, managing vulnerabilities, supporting incident response, and reporting findings.
Most learners finish Accumentum’s CySA+ course in 6 to 10 weeks of part-time study, depending on background, lab practice, and exam timeline.
No. You earn CySA+ by passing the CompTIA exam. Accumentum is an independent training provider, and CompTIA sets the exam rules, dates, fees, and policies.
CompTIA CySA+ supports roles such as SOC Analyst, Threat Intelligence Analyst, Incident Response Analyst, and Vulnerability Management Analyst. Your experience and the employer decide the final fit, and the certification helps show you can handle the work in security analytics and response.
Accumentum is an Army CA and Air Force COOL Approved Vendor. ArmyIgnitED and AFVEC decide eligibility and funding for each request, and we help you prepare the paperwork.
Yes. With PathPay you start the CySA+ course after your first monthly payment clears and pay the rest of the course fee over a short schedule.
CySA+ holders who want to lead security programs often move on to SecurityX.
Email us at info@accumentum.net. We look at your background and goals and suggest the course order that makes sense for you.
The course has 10 modules, starting with Security Operations Foundations and SOC Workflow and ending with Control Types, Risk, Compliance, and Continuous Improvement.
Yes. Under the CompTIA retake policy you can retake an exam right away after a first attempt. After a second attempt you wait at least 14 days before a third try. You buy a new voucher for each attempt.
Enrollment
Enroll in the CompTIA CySA+ Certification Training Course with Accumentum.
Enroll in Accumentum’s CompTIA CySA+ Certification Training Course to prepare for the CS0-004 exam and build practical analyst skills across monitoring, threat detection, vulnerability management, incident response, and reporting.
You will work through all four CS0-004 domains with an instructor, including the new objective on AI in security operations.
If you are finishing CS0-003 study, plan to test in English by December 22, 2026. For course dates and enrollment help, visit Accumentum’s registration page.
Advance into cybersecurity analysis with CompTIA CySA+ training.
Prepare for the CompTIA CySA+ CS0-004 exam while you build the security operations, threat analysis, vulnerability management, incident response, and communication skills modern cyber defense roles require.