TL;DR
Testing before mid-2027 and already studying 701: finish 701. Starting fresh with no near date: take 801. The format is unchanged (up to 90 questions, 90 minutes, 750 to pass), about 80% of 701 knowledge transfers directly, and employers ask for Security+ without a version number. The 801 delta is one new AI-risk objective plus modernized vocabulary and shifted domain weights.
Side by side
- SY0-701. Up to 90 questions, 90 minutes, 750 pass on the 100 to 900 scale. Domains: concepts 12%, threats 22%, architecture 18%, operations 28%, oversight 20%. Objectives document version 5.0, launched 2023-11-07. English retires 2027-06-11.
- SY0-801. Launches 17 November 2026. Same format: up to 90 questions, 90 minutes, 750 to pass. Domains reshuffled: concepts 16%, threats 24%, architecture 19%, operations 27%, oversight 14%. Governance lost the most share; fundamentals gained.
- The headline addition. New objective on AI risk: prompt injection, jailbreaking, training-data poisoning, evasion, AI-enabled data loss, bias, hallucinations, explainability, privacy, and ethics. Study it like any other threat family: what it looks like, what it abuses, what control stops it.
- Vocabulary modernization. Quishing and deepfakes join social engineering. Living-off-the-land binaries, session-token theft, SaaS supply chain risk, passkeys, just-in-time access, and framework references (ATT&CK, Kill Chain, Diamond) appear as named terms. Old answers using retired terms still score when the concept matches, but new questions use new words.
- Certificate reads the same. The credential says Security+, never the version number. No employer filters on 701 against 801.
The booking decision
Three cases cover nearly everyone. Studying 701 now with a date before mid-2027: keep going and book 701. Check the retirement date for your language before booking late in the window, and do not let 801 FOMO restart your plan. Starting fresh with no date: go 801 directly, since its materials are current and its vocabulary is what new questions use. Sitting between versions with 701 half-studied: finish 701 if the exam is within two months, since the transfer works in that direction and a pass now beats a perfect plan later.
One caution: version-change rumors online routinely invent dates. Trust the owner page and the retirement notice for your language, nothing else.
The delta domain by domain
Concepts (12 to 16%): the same CIA, AAA, and crypto core with stronger Zero Trust and least-privilege framing. Old notes transfer; refresh the wording. Threats (22 to 24%): classic attacks unchanged, plus quishing, deepfakes, living-off-the-land techniques, session-token theft, and the full AI-risk objective as its own study block. Architecture (18 to 19%): same zones, devices, and tunnels, plus deployment-model vocabulary, SSE, managed service accounts, and data-lifecycle roles. Operations (27 to 28%): same incident response order and IAM core, plus canary accounts, negotiation and notification phases, memory forensics, and AI automation capabilities. Oversight (20 to 14%): same risk math and vendor basics, plus procurement documents, SLOs, lock-in analysis, framework references, and training-program vocabulary. Study the additions as named lists with one distinguishing detail each, the same way you studied the originals.
New standalone objectives worth your attention
Beyond AI, 801 promotes two scattered topics into objectives of their own. Objective 2.1 covers characteristics of threats and vulnerabilities: feeds, likelihood and impact, life-cycle stages, and CVSS scoring with CVE identification. If you memorized CVSS as vocabulary for 701, upgrade it to procedure: given a vector or a score band, prioritize. Objective 2.4 catalogs vulnerability and attack-surface types including zero-days, crypto weaknesses, stale credentials, rogue devices, shadow IT, race conditions, hardcoded secrets, public repos and storage, large language models, and identity providers. Read that list as a distractor menu: learn each phrase precisely enough to reject its near-miss neighbor.
What moves over, and what shrinks
Most of 701 carries forward with tighter wording and additions. Controls keep their categories with Zero Trust folded in. Change management adds CAB process, fail forward and version control. Crypto adds CSRs, wildcards and record-level encryption. Threat actors gain competitor, accidental and ethical actors. Vectors expand: rich communication services, QR codes, CAPTCHA abuse, living-off-the-land binaries, and separate OT, signal and endpoint splits. Indicators add quishing, deepfakes, MFA bypass, password spraying and user enumeration. Architecture adds serverless, multicloud, infrastructure as code, OT, air-gapped designs, microservices and data sovereignty. Identity gains passkeys and passwordless; incident response gains negotiation, mandatory notification and post-incident review. What shrinks is D5 depth per objective and the standalone physical-security catalog, which folds into the operations control list.
How to reweight your study weeks
If you built an 8-week plan on 701 weights, adjust three blocks rather than rewriting the plan. Grow concepts: D1 moves from roughly one week to a week and a half, because 16% sampling across only 3 objectives means each one gets probed harder. Shrink governance: D5 drops from a week and a half to one week, keeping risk math, incident response order and third-party risk at full strength while compressing framework recall. Add two dedicated AI days inside the threats block: one for the attack list (injection, poisoning, jailbreak, evasion, deepfake vectors) and one for safeguards (data handling, guardrails, human review). Keep operations at two full weeks; a one-point dip changes nothing about its rank. Convert one review day a week into scoring procedure for 801: given a CVSS vector or severity band, prioritize. Track the shift by domain in readiness.
Retirement calendar sanity
English 701 retires 2027-06-11, which gives 701 studiers a long runway. Other languages follow on their own dates, so check your language specifically instead of assuming English dates apply. Book with at least a month of buffer before retirement: late-window sittings risk reschedule trouble if life interferes, and a forced version switch mid-study wastes the buffer anyway. If your date is already booked inside the window, ignore 801 completely until you pass. Version awareness is useful; version anxiety is not.
What stays identical across versions
Most of the exam does not move, and naming it calms version nerves. The CIA triad, AAA, control types, and crypto fundamentals are version-proof. Threat actor types and classic malware behave the same. Firewall logic, VPN types, and network zones transfer untouched. Incident response order, risk math (ALE equals SLE times ARO), and business continuity basics are identical. Password, access control, and social engineering fundamentals hold. What changes is vocabulary on top and AI-risk content beside it. When study doubt strikes, sort every topic into transfers or learns: the transfers pile should dwarf the learns pile, and if it does not, the doubt is about readiness generally, not about versions.
The 801 material situation
New exams always launch before third-party materials mature, which creates a brief window where official objectives plus delta guides beat big prep books. Use the official objectives document as the syllabus, the version explainer as the map, and practice questions written for the new objectives rather than relabeled 701 banks. Relabeled banks betray themselves with retired terms and missing AI-risk coverage; check any bank for those two tells before trusting it. Within a year the material ecosystem catches up, but early passers win by studying the source instead of waiting for the shelf to fill. One more practical note: keep your 701 notes. The transfer pile described above means those notes remain the bulk of your 801 knowledge, with the delta sections appended rather than replacing anything. Studier who keep one living notebook across versions revise faster than studiers who start a fresh binder per version. When in doubt about a topic, check the official objectives wording first: the exam tests what the document says, and third-party summaries occasionally preserve older phrasing that the new questions have already replaced.
Myths worth dropping
Myth one: employers prefer 801. Hiring filters say Security+, and interviewers test knowledge, not version numbers. Myth two: 701 passes look dated after 801 launches. A current cert is current; renewal cycles, not version numbers, keep it fresh. Myth three: you must restudy everything for 801. The 80% transfer is real, and delta study is measured in weeks. Myth four: waiting for 801 materials is safer than starting 701 now. Waiting burns the one resource exams actually consume, which is steady weekly hours. Start with the version your date points at.
What 701 studiers must relearn for 801
About four weeks at 30 minutes a day covers the delta. Week one: AI-risk objective plus new vectors (quishing, deepfakes, session theft). Week two: identity and response additions (passkeys, just-in-time access, negotiation and notification phases). Week three: architecture and data vocabulary (SSE, managed service accounts, immutability, subprocessor risk). Week four: two full 801 simulations with patch-only review between them. Core knowledge (CIA triad, crypto, incident response order, risk math) transfers one to one, so you are diffing the exam, not restudying it. The full transfer table lives in SY0-801 changes.
Study advice that survives both versions
Both versions open with performance questions, so the PBQ strategy applies unchanged: budget 20 to 25 minutes on first pass, flag heavy sims, bank multiple-choice points, return with remaining time. Both reward the same daily shape from the Security+ study plan: warm up, timed gap-targeted questions, one lab or game, then notes. And both punish the same mistake, which is re-reading strong domains while weak ones sit untouched. Let the readiness view name your weak topics and make that list the final-weeks syllabus.
Sources
- CompTIA Security+ exam page (owner)
- Exam facts re-verified 2026-10-18 against the SY0-801 objectives PDF version 2.0 and the CompTIA Security+ V8 page; retirement dates per owner notices.
Editorial: this guide was written by the SecLern study team on 2026-10-18. Version-transition specifics change as CompTIA publishes; confirm the live version and your language retirement date on the owner page before booking.