TL;DR
Defenders take CySA+; attackers take PenTest+. Both run 165 minutes at the intermediate analyst level and both assume Security+ fluency, but CySA+ grades detection, triage, and reporting while PenTest+ grades recon, exploitation, and engagement reporting. Pick by the job you want, not by perceived difficulty. Switching tracks later is normal and the shared base transfers.
Who each exam is for
CySA+ is for blue-team candidates: SOC analyst, incident responder, vulnerability analyst. Your happiest exam moments involve correlating three log sources into one finding and writing it up so clearly that the next shift acts correctly. Employers hiring defenders recognize this exam as proof you can do the shift work, not just describe it.
PenTest+ is for red-team candidates: pentest associate, offensive security intern, red-adjacent analyst. Your happiest exam moments involve chaining recon into a foothold under written rules of engagement and reporting severity with fixes a client can use. Employers hiring testers recognize this exam as proof you know the method, not just the tools.
Both are post-Security+ exams. Neither is a first cert.
Side by side
- CySA+ CS0-004. Up to 85 questions, 165 minutes, 750 pass on the 100 to 900 scale. Domains: security operations 34%, vulnerability management 26%, incident response and management 24%, reporting and communication 16%. Launched 2026-06-23.
- PenTest+ PT0-003. Up to 90 questions, 165 minutes, 750 pass on the 100 to 900 scale. Domains: engagement management 13%, recon and enumeration 21%, vulnerability discovery 17%, attacks and exploits 35%, post-exploitation 14%. Launched 2024-12-17.
- Same clock, different reading. Both give 165 minutes, but CySA+ spends it on long defensive stems (logs, reports, timelines) while PenTest+ spends it on offensive scenarios (scope, findings, exploit paths). Rehearse with the right material shape for your track.
- Shared base. Both assume Security+ vocabulary plus basic scripting literacy (reading code and queries matters more than writing them) and comfort with Linux and Windows command lines. The CySA+ plan readiness check applies equally to PenTest+ starters.
- Reporting both, differently. CySA+ reporting serves the next defender (evidence, conclusion, recommendation). PenTest+ reporting serves the client (severity, impact, remediation). Learn your track's shape; markers can tell a generic template from a native one.
Where they actually differ
Detect against exploit
The core split is directional. CySA+ asks: given these signals, what happened and what matters most. PenTest+ asks: given this scope, how do you progress and what do you report. Vulnerability management shows the split cleanly. Blue ranks findings by exploitability plus business context and schedules fixes. Red proves exploitability and documents impact. Same vulnerabilities, opposite verbs. Study the verbs of your track until they feel like reflexes.
Tool habits
Blue tool habits center on SIEM queries, log parsing, ticket queues, and scan-report triage. Red tool habits center on scanners, enumeration, proxies, and exploitation frameworks used legally in labs. Both tracks need the other side's awareness (defenders who think like attackers detect more; testers who think like defenders write better reports), but exam day grades your own side's fluency. Budget lab time accordingly: log volume for blue, engagement reps for red.
Career doors
Blue doors open wider at entry level: SOC analyst roles hire in volume and list CySA+ or its equivalents regularly. Red doors open narrower and often ask for proof beyond certs (lab write-ups, bug bounty history, portfolios). This is not a difficulty ranking; it is a market shape. Candidates who need income soon often go blue first even with red sympathies, then pivot with labs to show. That path is common enough to be unremarkable on a resume.
Exam temperament
CySA+ rewards patience: read everything, correlate before concluding, write carefully. PenTest+ rewards disciplined boldness: progress the engagement, respect scope boundaries, document as you go. Know your temperament honestly. Impatient readers fail CySA+ by concluding early; cautious hackers fail PenTest+ by stalling at recon. Neither temperament is fixed; both are trainable with timed reps.
The purple middle: skills both tracks share
Five skills serve both exams, and they make a fine shared study core. Log reading: blue parses for evil, red parses for opportunity, but both parse fast. Vulnerability logic: severity, exploitability, and context drive blue priority and red targeting alike. Script literacy: both read Python, Bash, PowerShell, and queries more than they write them. Reporting: evidence plus conclusion plus action, tuned per audience. Scope discipline: blue respects ticket boundaries and escalation paths, red respects rules of engagement. A study group mixing both tracks can drill all five together and split only for track-specific reps. If your group does this, keep score by finding, not by speed; careful beats quick on both exams.
Portfolio proof per track
Blue portfolio: two or three sanitized write-ups of investigations (alert, evidence trail, conclusion, recommendation), plus a triage runbook you wrote for a lab queue. Red portfolio: two or three sanitized engagement write-ups (scope, method, findings with severity, fixes), all against lab or bounty targets with permission documented. Both portfolios obey the same rules: no employer data, no real client names, plain language, dates included. Interviewers in both colors ask candidates to walk through one artifact aloud, which doubles as the best exam prep available: explaining your reasoning under friendly questioning is the skill both exams grade, minus the timer.
A log-reading starter kit for the undecided
Not sure which track fits. Spend two weeks on shared evidence work before choosing. Week one: read five firewall deny excerpts daily and write one sentence per excerpt stating what happened. Week two: read five authentication sequences daily and flag the anomalous one with a reason. If those sessions fly by and you want more, blue will feel like home. If they bore you and you keep wondering how the attacker got in rather than how to write it up, red is calling. Either answer is data, and the two weeks transfer to whichever exam you pick. Indecision resolved by experiment beats indecision resolved by forum poll, since your own attention is the most honest advisor in the room.
Which track for your case
Want SOC, IR, or vulnerability management work: CySA+. Want pentesting or red team work: PenTest+. Unsure: CySA+ first, since blue hiring volume is kinder and the shared base (logs, vuln logic, reporting) transfers directly to a later PenTest+ run. Already working one side: certify your side first, then borrow the other side's study material for perspective rather than sitting its exam immediately.
How to study for the one you pick
Blue: read logs daily, practice five-minute triage (confirm, correlate, contain), write one finding paragraph weekly, and drill scan-report prioritization. Red: lab each engagement phase in order under self-imposed rules of engagement, keep an attack journal, and write one full practice report before exam day. Both tracks: simulate at full 165-minute length, track misses by domain with the weak-spot method, handle performance questions via the PBQ strategy, and confirm booking timing with readiness explained.
Sources
- CompTIA CySA+ exam page (owner)
- CompTIA PenTest+ exam page (owner)
- Exam facts re-verified against published exam records 2026-10-18; pricing and question-type splits omitted (unpublished by owner).
Editorial: this guide was written by the SecLern study team and checked against the owner pages on 2026-10-18. Only owner-published format facts are stated.