CySA+ is not a bigger Security+. It is a day in a SOC: a queue of alerts, a log source that disagrees with another, and a decision you have to justify in writing. The best resources give you investigations to work, not just definitions to memorise. We make SecLern, so it is first here; the disclosure is at the top because you should know who is ranking whom.
| Option | Best for | What it costs | Skip it if |
|---|---|---|---|
| SecLern | SIEM queue investigations and graded notes | Free tier; Pro $15/month or $99/year | You have never read a log |
| Dion Training | A complete course with labs and 600+ questions | $399 for the complete course | You only need investigation reps |
| CompTIA CertMaster | Official Learn, Labs and Practice | Paid per exam | You are paying yourself |
| Professor Messer | Security+ foundations, not CySA+ coverage | No CySA+ course listed | You need CS0-004 material |
| TryHackMe SOC Level 1 | 65 hands-on SOC labs | Free rooms; subscription for the path | You are two weeks from the exam |
| LetsDefend | Simulated SOC alerts and workflow | Free plan; paid tiers | You need exam-mapped questions |
| Blue Team Labs Online | Forensics and threat hunting investigations | Free and paid tiers | You want a guided syllabus |
What CS0-004 asks for
CySA+ CS0-004 is 85 questions in 165 minutes, with a pass mark of 750 on a 100 to 900 scale. It launched on 23 June 2026, so it is a new exam and some third-party courses may still be catching up. The previous CS0-003 retires in English on 22 December 2026, so a product that still names CS0-003 is both old and on a deadline. The domains are security operations at 34%, vulnerability management at 26%, incident response at 24%, and reporting at 16%. Operations and response together are 58% of the exam, which is why investigation practice matters more than another glossary.
The CySA+ exam page carries the current facts, and the malicious indicators objective names the level the exam expects. Before buying any course, check that the product page names CS0-004, not CS0-003. A course written for the old version will teach useful skills and miss the new objectives.
The short answer
Learn the vocabulary from a course, then spend most of your time on investigations: triage a queue, decide what is real, scope the containment, write the note. The table compares the options on that job.
1. SecLern: our pick for investigation practice
The CS0-004 path holds 3,788 questions, 35 performance-based questions, 41 labs and 18 lessons. The labs are analyst shifts: two alerts at handover with one answer each, contain a credential dump without taking the domain controller down, prove a workstation is beaconing to a young domain, decide where to cut a chain that has already moved, write the case note the morning shift can act on. The surface is a SIEM queue and a console, and the grade reads the state and the note you leave.
The free tier gives you 30 study questions a day, three labs and unlimited flashcards, and the incident response objective shows what each shift is testing. Pro is 15 dollars a month or 99 dollars a year, and the 29 dollar Exam Sprint covers 90 days.
Good for: people who understand security concepts and freeze when a log queue is ambiguous. Skip it if you have never read a log or used a SIEM; start with the Security+ material and come back.
2. Dion Training: the complete course
Dion's CySA+ CS0-004 complete course is 399 dollars: 48-plus hours of video, hands-on labs, a practice exam with 600-plus questions and 12 months of access. The separate practice exam pack uses randomized sets with explanations. It is the most complete single purchase with a published price on this list.
Good for: a structured course with labs and a large question bank in one price. Skip it if you already know the material and only need investigation reps; the course is the expensive part.
3. CompTIA CertMaster: the vendor's own materials
CertMaster Learn is the official e-learning with flashcards and performance-based questions. CompTIA Labs provides virtual environments and lab guides aligned to the objectives, and CertMaster Practice is the official knowledge assessment. CertMaster Perform bundles all three.
Good for: employer-funded study and official alignment on a new exam version. Skip it if you are paying yourself or studying several certifications; it is licensed per exam.
4. Professor Messer: check before you count on it
Messer's site lists video courses for A+, Network+ and Security+. At the time of writing it does not list a CySA+ course, so do not buy a bundle assuming one exists. His Security+ material is still useful background if your security vocabulary is shaky, but it is not CS0-004 preparation.
Good for: Security+ foundations if you are moving up from that exam. Skip it if you need CySA+ coverage; there is nothing to buy here for this exam today.
5. TryHackMe SOC Level 1: strong hands-on, not exam-mapped
TryHackMe's SOC Level 1 path has 14 modules, 65 hands-on labs and an estimated 65 hours of work, rated easy. It teaches SOC tools and operations, network and web attacks, endpoint monitoring and SIEM handling. The free plan gives access to free rooms only; the full path needs a subscription.
The strength is volume of realistic investigation. The limit is alignment: it is a SOC analyst path, not a CS0-004 course, and it will not map every task to a CompTIA objective.
Good for: building investigation stamina and learning the tools. Skip it if you are close to your exam date and need objective-mapped review.
6. LetsDefend: alerts in a simulated SOC
LetsDefend is a SOC analyst training platform built around simulated alerts and an incident workflow, with a free plan and paid tiers. You work alerts, decide whether they are malicious, and practise the handoff.
Good for: the rhythm of a SOC shift and the language of escalation. Skip it if you need CompTIA-specific question practice or a structured exam plan.
7. Blue Team Labs Online: investigations and forensics
Blue Team Labs Online is a gamified platform for defenders with investigations in incident response, digital forensics, security operations, reverse engineering and threat hunting. It has free and paid tiers, leaderboards and scenario-based challenges.
Good for: practising the investigative reasoning that CySA+ rewards, especially forensics and threat hunting. Skip it if you want a guided syllabus or a score that predicts exam readiness.
How we chose
We ranked on five jobs: explaining the objectives, investigation realism, labs, exam simulation, and price. We checked every competitor fact on the vendor's page on 28 October 2026 and linked it below. We did not include leaked question sets, and we did not include a course that does not name CS0-004.
The newness of the exam is a real problem for buyers. CS0-004 launched in June 2026, so a product that was excellent for CS0-003 may not have been rewritten yet. The product page is the only reliable signal: if it does not name the new code, assume it has not been updated.
What a CySA+ task actually feels like
You get an alert: a service account signed in like a person. You have a SIEM queue, a proxy log, an endpoint view and a ticket. The task is not "what is the definition of lateral movement". It is "is this real, what is the scope, what do you contain first, and what do you write in the handover note".
That is why lab practice beats flashcard practice at this level, and why the labs hub is a better browse than another question bank. You need to read two sources, notice that one is stale, and make a call with incomplete evidence. Then you need to explain the call in a sentence a shift lead can act on.
How to score an investigation, not an answer
A CySA+ task is graded on the decision and the note, so practise writing both. After each lab, write the handover note in four sentences and no more: what happened, what you can prove, what you did, and what the next shift should watch. If a sentence cannot be traced to a log line, cut it or label it as inference.
That constraint does more for your exam performance than another hundred definitions, because it forces the two skills the exam separates. Scoping is deciding what is in the incident and what is not. Justification is explaining why, in terms someone else can check. Analysts who blur the two either over-contain, which breaks production, or under-report, which leaves the next shift blind.
Then score yourself against four questions rather than your memory of the task: did you identify the first event in time, did you name every affected account and host, did your containment avoid taking out the service, and would a reader who was not there understand the note. One line each. The CySA+ lab catalogue tests the same four things with a queue in front of you and a deadline behind you.
CVSS is a starting point, not a priority
Scoring questions trip people because the exam gives you a number and then expects you to reason past it. A network-reachable, no-authentication, high-impact vector scores 9.8 and reads Critical. The CVSS calculator returns that number and, on the same screen, says the useful part out loud: base score only, no temporal or environmental metrics, and a high score is not a business priority by itself.
So practise the second step, which is what the exam actually asks. What does this asset do, who can reach it, and what already compensates for it? A 9.8 on an isolated test host with no data can wait behind a 7.5 on the internet-facing payment path. Write the two sentences that justify the order, because "critical first" is the reflex the exam is testing you out of.
Use the sub-scores to explain the reasoning rather than to decorate it. High impact with low exploitability is a different conversation from low impact with trivial exploitability, and the difference is almost always exposure: who can reach it, from where, and with what credentials.
One habit worth building before the exam: say the base score, then say what would move it. A compensating control does not change the vector, but it changes the order, and the order is what the reporting domain asks you to defend.
A four-week plan
Week one: security operations, the 34% domain. One investigation lab a night, plus 20 questions on the objectives you missed. Week two: vulnerability management, including prioritisation and CVSS. Use the CVSS calculator to check your scoring, not to avoid learning it. Week three: incident response, the 24% domain, with containment and scoping labs. Week four: reporting, plus two timed mixed sets and a review of every missed objective.
If you are new to SOC work, add two weeks at the front for log reading and network basics, or follow the CySA+ study plan instead of improvising. CySA+ assumes you can read a proxy log and know what a domain controller does.
What to do this week
Download the CS0-004 objectives and rate each domain. Pick one investigation lab and work it end to end, including the note. Read the graded breakdown, then work the same lab again from scratch. On the weekend, take a 40-question timed set and list the objectives behind every miss.
Book the exam when two fresh timed sets land above 80 percent and you can triage a queue, scope a containment and write a handover note without a template. CySA+ rewards the analyst who can explain a decision, not the one who memorised the most acronyms. If you are still choosing a path, read Security+ versus CySA+ and the SOC analyst career path.