CASP+ vs SecurityX: How the CAS-005 Domains Differ From CAS-004

What changed when CASP+ became SecurityX?

CompTIA Advanced Security Practitioner, CASP+, became CompTIA SecurityX on 17 December 2024, when exam CAS-005 replaced CAS-004. SecurityX joined the CompTIA Xpert series, the vendor’s expert tier for specialised roles in cybersecurity, data and cloud networking. The certification status of existing holders and the continuing education programme were left untouched; only the exam content, its weightings and its name moved.

The clearest single change is scope. CompTIA’s announcement, Introducing CompTIA SecurityX, states that the new exam covers 23 objectives instead of the 28 in CASP+ V4. Fewer objectives does not mean an easier paper. It means each objective now carries more of the 90 questions, and that the ones CompTIA kept are the ones it considers central to a security architect’s week.

The second change is emphasis. Governance, risk and compliance grew, security engineering grew, and security operations shrank by eight points. Read together, the new blueprint pushes the exam towards designing and building secure systems and away from running a security operations centre, which is territory CompTIA already covers with CySA+.

The third change is the vocabulary inside the objectives. Artificial intelligence adoption, post-quantum cryptography, Zero Trust design and enterprise automation each have their own line in CAS-005. A candidate working from CAS-004 notes will find the structure familiar and several of the specifics missing.

How do the CAS-004 and CAS-005 domains compare?

Both exams use four domains with the same names, except that CAS-004’s “Security Engineering and Cryptography” became “Security Engineering” in CAS-005. The weightings moved in every domain: governance, risk and compliance rose from 15 to 20 percent, security architecture fell from 29 to 27, security engineering rose from 26 to 31, and security operations fell from 30 to 22 percent.

The CAS-004 figures come from the equivalency table in CompTIA’s own announcement; the CAS-005 figures match on the official certification page and on the full CAS-005 syllabus, which also lists every objective and sub-topic under each domain. Security engineering is now the heaviest domain, which was not true of CASP+, where operations led.

One more structural shift hides behind the table. Security operations lost eight points but kept the same kind of work: monitoring, vulnerability analysis, threat hunting and incident response. Governance gained five points and gained a new kind of work, because the AI adoption objective sits inside it rather than inside engineering. CompTIA treats the risks of adopting AI as a governance question first, which tells you how the exam wants those questions answered.

What does each SecurityX domain actually test?

The 23 CAS-005 objectives are unevenly spread: five sit under governance, risk and compliance, six under security architecture, eight under security engineering and four under security operations. Twenty of the 23 begin with “given a scenario” or “given a set of requirements”, so the exam expects applied decisions, with only three objectives written at the explain or summarise level.

Governance, Risk, and Compliance (20 percent, five objectives)

The domain opens with implementing governance components for a given set of requirements: policies, procedures, standards and guidelines, awareness training, reporting lines and RACI matrices, and the frameworks COBIT and ITIL. It then asks for risk management activities, including quantitative and qualitative assessment and third-party risk, and for an explanation of how compliance shapes a security strategy, with PCI DSS and the ISO/IEC 27000 family named.

Threat modelling is its own objective, built around actor characteristics, attack patterns and the MITRE ATT&CK, CAPEC and STRIDE frameworks, and the ATT&CK knowledge base is worth time because operations questions lean on the same tactic and technique vocabulary. The fifth objective is new ground for anyone from CAS-004: summarising the information security challenges of adopting artificial intelligence, including explainable versus non-explainable models and automated exploit generation.

Security frameworks round the domain out, and the syllabus names the NIST Cybersecurity Framework alongside CSA guidance. Expect to map a control to a framework function rather than recite the framework.

Security Architecture (27 percent, six objectives)

Every one of the six objectives starts with a scenario. You design resilient systems from requirements, build security into the early stages of a systems life cycle and keep it there, integrate controls into an architecture, and design access, authentication and authorisation. The cloud objective covers CASB in both API and proxy form, shadow IT detection, the shared responsibility model, CI/CD pipelines, Terraform and Ansible, containers, orchestration and serverless workloads.

The sixth objective integrates Zero Trust into architecture design, with secure zones, SASE, SD-WAN and software-defined networking as the named building blocks. CASP+ touched these ideas; CAS-005 makes the subject to object relationship of Zero Trust an objective in its own right.

Security Engineering (31 percent, eight objectives)

This is the largest domain and the broadest. Three of its eight objectives are troubleshooting tasks: identity and access management components, endpoint and server hardening, and complex network infrastructure security. Two more are implementation tasks, for hardware security such as secure enclaves and for securing specialised and legacy systems. The automation objective expects PowerShell, Bash and Python scripting, infrastructure as code, cloud APIs, SOAR and workflow automation, and it names generative AI as a tool.

The cryptography that left the domain title stayed in the domain. One objective explains advanced concepts, including post-quantum cryptography, key stretching, homomorphic encryption, forward secrecy and hardware acceleration. The other applies the right technique to a use case: data at rest, in transit and in use, secure email, code signing, tokenisation, cryptographic erase and certificate-based authentication.

Security Operations (22 percent, four objectives)

Four objectives, all scenario-based: analyse data for monitoring and response, with SIEM parsing, retention, false positives and negatives and behaviour baselines; analyse vulnerabilities and attacks and recommend attack-surface reductions, from injection and XSS to weak ciphers; apply threat hunting and threat intelligence, including STIX, TAXII, Sigma, YARA and Snort; and analyse data and artefacts for incident response. It is the smallest domain by weight and still the one most likely to appear as a performance-based item.

SecurityX exam format, cost and languages

CAS-005 runs to a maximum of 90 questions in a maximum of 165 minutes, mixes multiple-choice and performance-based questions, and reports pass or fail only, with no scaled score. The exam costs $544, is scheduled through Pearson VUE, and is offered in English and Japanese. CompTIA lists the exam version as V5 with a launch date of 17 December 2024.

CompTIA’s SecurityX certification page also gives a retirement estimate for the exam of around 2027, on its usual pattern of roughly three years after launch. That date applies to the CAS-005 exam version, not to the certification. A SecurityX certification stays valid through continuing education, as the renewal section below explains.

Many of the questions candidates ask about this exam concern the voucher rather than the content. The $544 figure is the exam price; CompTIA sells the voucher on its own or inside bundles that add CertMaster practice material and a retake. Check the bundle contents before paying, because the practice product and the retake assurance are what separate the bundles from the bare voucher.

Who is SecurityX written for?

CompTIA describes SecurityX as an advanced certification for security architects and senior security engineers who design, build and implement secure solutions across complex environments. Its recommended experience is a minimum of ten years of hands-on IT work including five years in security, with Network+, Security+, CySA+, Cloud+ and PenTest+ or equivalent knowledge. It maps to NICE and DoD 8140 work roles such as security architect and security control assessor.

That ten-year figure is the real gate. The exam has no formal prerequisite, but the objectives assume you have already run the lower-level work the other credentials cover: you are expected to troubleshoot an IAM integration, not learn what SAML is. The listed job roles also include systems requirements planner and research and development specialist, which signals that the architecture and governance domains are written for people who set direction as well as those who implement it.

If your background is operations rather than design, the reweighting matters to you more than to anyone else. Operations is now 22 percent of the paper. A SOC lead who was comfortable with CAS-004’s 30 percent operations share should expect to spend most of the preparation time on architecture and engineering, where 58 percent of the marks now sit.

Does a CASP+ holder need to retake anything?

No. CompTIA stated that the name change does not affect the certification status of current CASP+ holders or their continuing education programme. Active holders were notified to download the updated SecurityX badge. Renewal continues on the same basis as before: SecurityX requires 75 continuing education units within a three-year renewal cycle, and at least half of any course content claimed must relate to the exam objectives.

CompTIA’s SecurityX renewal page puts the figure in its own title, 75 CEUs required for SecurityX V5 renewal, and the vendor’s CE guidance adds that activities must fall inside the three-year cycle. Nothing in either place asks a CASP+ holder to sit CAS-005. The badge, the renewal cycle and the CEU count you already had simply carry the new name.

What does change for a holder is the reference point for CEU relevance. Because at least 50 percent of a course’s content must map to the exam objectives of the certification being renewed, the objectives that now count are CAS-005’s. A course on AI governance, Zero Trust design or post-quantum cryptography sits squarely on the new blueprint; one built purely around SOC operations maps to a smaller share of it than it used to.

Holders who want to understand how the credential is positioned today, rather than how it was marketed under the old name, can read our overview of what SecurityX proves, which covers the career case for the certification without repeating the comparison made here.

How hard is SecurityX compared with CASP+?

CompTIA publishes no pass rate and no scaled score for either exam, so no honest answer can give you a number. What can be compared is structure: CAS-005 has fewer objectives than CAS-004, more of them begin with a scenario, and the heaviest domain now holds the most troubleshooting tasks. The paper is narrower and more applied, which reads as harder to bluff rather than harder to pass.

Pass or fail scoring is the part people underestimate. On a scaled exam you learn how close you came; here you learn only the outcome, so a near miss and a wide miss look identical on the result sheet. The practical consequence is that preparation has to be measured against the objectives themselves, not against a target score. Timed practice against each of the four domains is the only feedback loop available before exam day.

The performance-based questions are the other variable. CompTIA does not say how many of the 90 are performance-based, only that the paper mixes both types. Budget the 165 minutes on the assumption that simulations arrive early and take disproportionate time, and answer the multiple-choice items at pace to protect that budget.

How should you prepare for CAS-005 with CAS-004 material?

CAS-004 material remains usable for roughly the parts of the blueprint that did not move, which is most of security architecture and all of the cryptography techniques, and it is weakest exactly where CAS-005 added lines: AI adoption, post-quantum cryptography, Zero Trust design, automation and the reweighted governance domain. The sequence below starts from the official objectives rather than from the old notes.

1. Download the current CAS-005 objectives and mark every line that has no counterpart in your CAS-004 notes, starting with the AI adoption objective in governance and the Zero Trust objective in architecture.
2. Reallocate study time to the new weightings, giving security engineering and security architecture together about 58 percent of your schedule and security operations no more than a quarter.
3. Rebuild the cryptography notes around the CAS-005 wording, adding post-quantum cryptography, homomorphic encryption, forward secrecy and hardware acceleration to the concepts list.
4. Practise the automation objective hands-on, writing short PowerShell, Bash or Python scripts against a cloud API and an infrastructure-as-code template, because this objective is scenario-based and cannot be learned from reading.
5. Run timed practice sets domain by domain and score them against the objective list, since the exam itself will give you only a pass or fail.
6. Reserve the final two weeks for performance-based rehearsal across all four domains, prioritising incident response artefacts and network troubleshooting scenarios.

For candidates sitting the exam for the first time rather than converting old notes, our earlier guide to CAS-005 study strategies sets out a schedule from a standing start. Whichever route you take, the objectives list is the syllabus, and the four weightings above are the only reliable guide to where the marks are.

Frequently Asked Questions

Is CASP+ the same certification as SecurityX?

Yes. CompTIA renamed CASP+ to SecurityX on 17 December 2024 when it released exam CAS-005. Existing CASP+ holders kept their certification status and continuing education programme and received the SecurityX badge.

What is the difference between CAS-004 and CAS-005?

CAS-005 covers 23 objectives instead of CAS-004’s 28, renames Security Engineering and Cryptography to Security Engineering, and reweights every domain: governance 15 to 20 percent, architecture 29 to 27, engineering 26 to 31, operations 30 to 22.

How many domains does the SecurityX CAS-005 exam have?

Four: Governance, Risk, and Compliance at 20 percent, Security Architecture at 27 percent, Security Engineering at 31 percent and Security Operations at 22 percent, spread across 23 objectives.

How many questions are on the CAS-005 exam and how long is it?

A maximum of 90 questions, mixing multiple-choice and performance-based items, in a maximum of 165 minutes. The result is reported as pass or fail with no scaled score.

How much does the SecurityX exam cost?

The CAS-005 exam price is $544 (USD). CompTIA also sells the voucher inside bundles with CertMaster practice material and a retake, and the exam is scheduled through Pearson VUE.

Does a CASP+ certification expire now that it is called SecurityX?

The rename changed nothing about validity. SecurityX, like CASP+ before it, is renewed through continuing education: 75 CEUs within a three-year renewal cycle. The 2027 figure on CompTIA’s page is the estimated retirement of the CAS-005 exam version, not of the certification.

Can I use CASP+ CAS-004 study material for CAS-005?

Partly. The architecture and cryptography techniques content carries over, but CAS-005 adds objectives on AI adoption, Zero Trust design, post-quantum cryptography and automation, and shifts the weightings, so old notes need checking line by line against the current objectives.

What experience does CompTIA recommend for SecurityX?

A minimum of ten years of general hands-on IT experience including five years of hands-on security, with Network+, Security+, CySA+, Cloud+ and PenTest+ or equivalent knowledge. There is no formal prerequisite.

Is SecurityX available in languages other than English?

CompTIA lists CAS-005 in English and Japanese, with other languages to be determined.

Conclusion

CASP+ vs SecurityX comes down to one exam swap. The credential, its holders, its badge and its 75-CEU renewal cycle are continuous; CAS-005 is where the change lives. Twenty-three objectives replace 28, governance and engineering gain five points each, operations loses eight, and AI adoption, Zero Trust, post-quantum cryptography and automation get lines of their own. If you are a holder, nothing is owed except renewal on the new objectives. If you are a candidate, treat CAS-004 material as a partial map, reweight your study time towards architecture and engineering, and measure yourself against the objective list, because the exam will only ever tell you pass or fail. Start with the official objectives, then test each domain under time.