SY0-701 vs SY0-801: What Changed in CompTIA Security+ V8
CompTIA is replacing Security+ SY0-701 (V7) with SY0-801 (V8). CompTIA's launch date for SY0-801 is November 17, 2026, and the English SY0-701 exam retires on June 11, 2027. Here is what changed between the two, objective by objective, and what it means for how you study.
The short answer
| SY0-701 (V7) | SY0-801 (V8) | |
|---|---|---|
| Launch | November 7, 2023 | November 17, 2026 |
| Retirement | English: June 11, 2027; other languages: August 13, 2027 | Not set; CompTIA estimates about three years after launch |
| Languages | English, Japanese, Portuguese, Spanish and Thai | English at launch |
| Format | Up to 90 questions in 90 minutes | Unchanged |
| Passing score | 750 on a 100–900 scale | Unchanged |
| Objectives | 28 | 27 |
| Scenario objectives | 7 | 9 |
| Acronym list | more than 300 | 106 |
Both exams lead to the same CompTIA Security+ certification. From November 17, 2026 to June 11, 2027 you can take either one in English; after that, SY0-801 is the only English option. If you're deciding which to take, see SY0-701 or SY0-801?.
Counts on this page follow the objectives documents (SY0-801 version 2.0). CompTIA's V8 web page has a shorter summary that lists 26 objectives, without threat characteristics as a separate one; the document lists 27.
Domain weights
| Domain | SY0-701 | SY0-801 | Change |
|---|---|---|---|
| 1.0 General Security Concepts | 12% | 16% | +4 points |
| 2.0 Threats, Vulnerabilities, and Attacks | 22% | 24% | +2 points |
| 3.0 Security Architecture | 18% | 19% | +1 point |
| 4.0 Security Operations | 28% | 27% | −1 point |
| 5.0 Security Program Management and Oversight | 20% | 14% | −6 points |
The five domains keep their numbers, and four keep their names. Domain 2.0 was "Threats, Vulnerabilities, and Mitigations" and is now "Threats, Vulnerabilities, and Attacks", and the mitigations it used to hold now sit in Security Operations. The biggest shifts: General Security Concepts gains 4 points, and Security Program Management and Oversight loses 6. Security Operations is still the heaviest domain at 27%.
Two new objectives
SY0-801 has 27 objectives to SY0-701's 28, but the lower count hides real change. Several SY0-701 objectives were merged, and two objectives are new:
- 2.1: what makes threats and vulnerabilities serious: threat intelligence, likelihood and impact, CVE identifiers and CVSS scores, and prioritization. It's a new objective built mostly from material SY0-701 covered under vulnerability management (4.3) and risk management (5.2).
- 2.6: threats from using AI: model manipulation, poisoning, prompt injection, jailbreaking, hallucinations, data loss, privacy and more. It's new content with no SY0-701 counterpart.
Objective 2.6 is the headline change. It's a summarize-level objective, so expect to recognize and name AI risks, such as telling prompt injection from data poisoning, rather than configure defenses against them.
Where each SY0-701 objective went
| SY0-701 | Topic | SY0-801 |
|---|---|---|
| 1.1 | Security controls | 1.1 |
| 1.2 | Fundamental concepts | 1.1, 3.2, 4.1, 5.5 |
| 1.3 | Change management | 1.2 |
| 1.4 | Cryptography | 1.3, 3.3 |
| 2.1 | Threat actors | 2.2, 2.4 |
| 2.2 | Threat vectors | 2.3, 2.4, 2.5 |
| 2.3 | Vulnerabilities | 2.4 |
| 2.4 | Indicators | 2.5 |
| 2.5 | Mitigations | 4.1 |
| 3.1 | Architecture models | 3.1 |
| 3.2 | Infrastructure | 3.2, 4.1 |
| 3.3 | Data protection | 3.3 |
| 3.4 | Resilience | 3.4 |
| 4.1 | Hardening | 4.1 |
| 4.2 | Asset management | 4.2 |
| 4.3 | Vulnerability management | 4.3, 2.1 |
| 4.4 | Monitoring | 4.4 |
| 4.5 | Enterprise capabilities | 4.1 |
| 4.6 | Identity and access | 4.5 |
| 4.7 | Automation | 4.6 |
| 4.8 | Incident response | 4.7, 5.4 |
| 4.9 | Investigation data | 4.8 |
| 5.1 | Governance | 5.1, 3.3 |
| 5.2 | Risk management | 5.2, 3.4, 2.1 |
| 5.3 | Third-party risk | 5.3 |
| 5.4 | Compliance | 5.4 |
| 5.5 | Audits | 5.5 |
| 5.6 | Awareness | 5.6 |
The biggest moves:
- Mitigation techniques (701 2.5) and the firewall, IDS/IPS, NAC and email security settings (701 4.5) now share one objective, mitigating controls (801 4.1).
- CVE and CVSS move from vulnerability management (701 4.3) to the new threat characteristics objective (801 2.1).
- Data roles move from governance (701 5.1) to data protection (801 3.3).
- RTO, RPO, MTTR and MTBF move from risk management (701 5.2) to resilience and recovery (801 3.4).
- Shadow IT moves from threat actors (701 2.1) to vulnerabilities (801 2.4).
- Deception technology moves to mitigating controls (801 4.1), gap analysis to audits (801 5.5) and legal hold to compliance (801 5.4).
What's new in SY0-801
Topics that appear in the SY0-801 objectives and weren't listed in SY0-701 (new objective numbers):
- Large language models, public code repositories and public object storage as attack surfaces (2.4).
- Quishing, deepfakes, fileless malware, MFA bypass and user enumeration as attacks to recognize (2.5).
- RCS messages, collaboration tools, session tokens and living-off-the-land tools as threat vectors (2.3).
- Security Service Edge (SSE), group Managed Service Accounts and privilege creep (3.2).
- Community cloud as a deployment model (3.1), and data operators and subprocessors as data roles (3.3).
- Autoscaling, immutable backups and redundant power supplies (3.4).
- Canary accounts, secrets scanning in code repositories and BIMI for email (4.1).
- IPAM and cloud security posture management (CSPM) for finding vulnerabilities (4.3).
- Syslog, port mirroring and packet analyzers as monitoring tools (4.4).
- Passkeys, backup codes, emergency access accounts and compromised credential monitoring (4.5).
- Agentic AI, chatbots and AI-augmented baselines in security automation (4.6).
- Negotiation, external notification and post-incident reporting in incident response (4.7).
- Residual risk (5.2), RFP, RFI and RFQ with vendor lock-in (5.3), and anti-bribery training (5.4).
- MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model as reference sources for audits (5.5); SY0-701 had ATT&CK only on its acronym list.
- Defense in depth (1.1) and failing forward after a change goes wrong (1.2).
What's no longer listed
Topics the SY0-701 objectives named that the SY0-801 objectives don't (old objective numbers):
- Blockchain, steganography and key stretching (1.4).
- TPM, HSM, key management systems and secure enclaves as named crypto tools (1.4).
- Zero Trust control and data plane terms such as policy engine and policy enforcement point (1.2).
- The physical security list: bollards, fencing, lighting and guards (1.2).
- SASE, SD-WAN and software-defined networking (3.1, 3.2).
- Containers, ICS/SCADA systems and real-time operating systems as separate architecture items (3.1).
- Jump servers, next-generation firewalls, port security and EAP (3.2).
- Wireless settings such as WPA3, RADIUS, site surveys and heat maps (4.1).
- COPE and CYOD mobile deployment models (4.1).
- ABAC, password vaulting and ephemeral credentials (4.6).
- Misinformation, pretexting, typosquatting and RFID cloning (2.2, 2.4).
- Exposure factor, key risk indicators and risk appetite types (5.2).
- DNS filtering, user behavior analytics and file integrity monitoring as a named tool (4.5).
More scenario objectives
An objective that starts "Given a scenario" asks you to apply a concept to a situation rather than recall it. SY0-701 had 7 of them; SY0-801 has 9: 1.2, 2.5, 3.2, 4.1, 4.3, 4.5, 4.6, 4.8 and 5.6. Change management (1.2), vulnerability management (4.3) and automation (4.6) are new to the list. Those are the objectives most likely to show up as performance-based questions, though CompTIA doesn't say which objectives its PBQs cover. The SY0-801 objectives overview marks each one.
Is SY0-701 study material still useful?
For most topics, yes: the five domains are the same and much of the content carries over. But study the topics above from current material, and work from the SY0-801 objectives rather than old notes. The acronym list shrank from more than 300 entries to 106, so hundreds of cards in an old acronym deck are no longer on the list: move them to a lower priority rather than deleting them, and add the 32 new ones, such as BIMI, CSPM, gMSA, LLM and SSE. The free SY0-801 acronym trainer drills all 106, with a New in V8 filter.