TL;DR
SecurityX CAS-005 launched 17 December 2024 as the renamed successor to CASP+, in CompTIA's Xpert series: max 90 questions in 165 minutes, graded pass or fail with no scaled score, across four domains led by Security Engineering at 31%. It targets senior practitioners with years behind them. Confirm prices and languages on the CompTIA page, since neither is verifiable enough to print here.
By SecLern Editorial. Published 2026-10-18. Exam facts checked 2026-10-17 against the CompTIA SecurityX page and the objectives document version 3.0. Unverifiable details are omitted as facts and flagged where readers might otherwise trust a blog figure.
From CASP+ to SecurityX
SecurityX is the new name for what was CASP+, now sitting in the CompTIA Xpert series as the expert-level security credential. Version 5 carries the code CAS-005; the prior CAS-004 retired 17 June 2025. The rename still confuses search results, which mix both names two years on, so when you shop for books check the code on the cover: CAS-005 is current, anything keyed to CAS-004 teaches the retired test. The positioning did not change with the name. This is the architect-level exam for people who design security programs rather than operate controls, and CompTIA aims it at practitioners with roughly a decade of general experience including several years hands-on. If Security+ felt like breadth, SecurityX feels like judgment at depth. Start from the SecurityX study hub.
Format: 90 questions, 165 minutes, pass or fail
Owner-verified: a maximum of 90 questions in 165 minutes. The distinctive fact is scoring: SecurityX reports pass or fail only, with no scaled score and no numeric threshold published. There is no 750-style target to chase and no near-miss score to interpret; your mocks should therefore track domain-level accuracy and scenario judgment, not a simulated scale. The question-type split is unpublished, so treat any exact performance-item count as a simulator default. Price is unverifiable (no CompTIA figure we could confirm; third parties cite around five hundred dollars, which is hearsay until the store page says it). Languages beyond the core offering are similarly unconfirmed. Check the CompTIA page in booking week for price, languages, and retake policy, and budget the top of the cited range so the fee never surprises you.
The four domains
Weights 20/27/31/22, in architecture order. Read them as a design narrative: govern it, architect it, engineer it, operate it.
- D1 Governance, Risk, and Compliance: 20%. Strategy, risk programs, compliance mapping, and policy. The domain that frames every later decision; senior-exam governance questions ask what you approve and fund, not what terms mean.
- D2 Security Architecture: 27%. Enterprise and security architecture, patterns, reference models, cloud and hybrid design. Learn to compare architectures against requirements rather than to recite patterns.
- D3 Security Engineering: 31%. The heaviest domain. Implementation detail: cryptographic solutions, network and endpoint engineering, automation, resilience engineering. Where D2 asks which design, D3 asks how it is built and where it breaks.
- D4 Security Operations: 22%. Detection, response, threat intelligence use, and operational assurance. Senior-level operations questions emphasize measurement: whether controls work, proven with data.
Study hours near 20/27/31/22, with D2 and D3 combined taking well over half. Pair every pattern with a failure story from your own experience; expert exams reward scar tissue organized into principles.
Who should sit it, and who should wait
Sit SecurityX when you already design or advise on security at organizational scale: architects, senior engineers, consultants, and managers with deep technical roots. The exam assumes fluency it never re-teaches, so arriving without senior-level reps means paying an expert fee to discover gaps a cheaper exam would have named. A sensible ladder runs Security+ to CySA+ or PenTest+ to SecurityX, with years of practice between rungs; the Security+ study plan plus work experience is the honest prerequisite list. Wait if your scenarios still feel like vocabulary tests, if architecture trade-offs do not come naturally yet, or if your employer funds only one attempt and your mocks show red domains. An expert fail costs more than money: the score report gives no scaled breakdown to study from, so a premature attempt buys little information. Verify with readiness on scenario-heavy fresh items before booking.
How expert prep differs
Breadth drilling got you through associate exams; it stalls here. Replace flashcard volume with decision reps: for each objective, write the situation, the options a senior would weigh, the choice, and the metric that proves it worked. Study frameworks as tools (risk, architecture, and attack models appear as reference sources in advanced objectives) and practice citing the right one for the problem. Read post-incident analyses and architecture reviews from industry, then argue with them in your notes; the exam tests the arguing muscle. Time your mocks at the full 165 minutes with long scenario exhibits, because expert stems are the longest CompTIA writes and stamina is a scored skill in practice if not in name. Two clean full sittings under time, a week apart, is the booking bar per readiness explained.
A self-check before you pay the fee
Run this checklist honestly a month before booking. One, design reps: can you whiteboard three architectures you have actually built or reviewed, with the trade-offs you accepted, without notes. Two, framework fluency: can you name which reference model fits a risk, architecture, or attack-analysis question and say why in one sentence. Three, mock breadth: two full timed sittings with no red domains, because an expert form hunts weakness the way adaptive tests do. Four, stamina: have you sat 165 minutes of long scenarios twice without your accuracy collapsing in the final third. Five, budget honesty: can you fund a retake without pain, since pass-fail scoring gives you no near-miss information to calibrate on. Three or more no answers means wait three months and convert each no into a work project or lab series. Expert exams reward scar tissue organized into principles, and principles come from reps, not from reading weeks. When all five read yes, book within two weeks while the edge is sharp, and spend the gap on decision reps rather than new books.
Sources
- CompTIA SecurityX certification page (code, launch, format, pass-fail, weights)
- CompTIA blog, introducing SecurityX (Xpert series, CASP+ succession)
Read next
For the rung below, the Security+ study plan shows the method to outgrow. For method at any level, weak-spot training explains calibration, and exam-day checklist covers the 165-minute pacing shape. Track prep in readiness. A closing note on cost and courage: expert exams carry expert fees, and pass-fail scoring means a fail buys less diagnostic information than a scored one, so the booking decision deserves cold arithmetic across mock accuracy by domain, stamina over two sittings, and a funded retake. Candidates who pass usually describe the exam as fair but deep, with scenarios rewarding real design experience over memorized frameworks. If your daily work already involves approving architectures, funding controls, and explaining risk to non-technical owners, you are closer than you feel; the exam tests Tuesday-morning judgment, not trivia. If that description does not match your week yet, the ladder below still leads here: Security+ for breadth, an analyst exam for depth, then years of practice. The view improves with every rung, and the fee waits patiently until you are ready.