Which security cert should you take first?

The rules

1. 1. No tech job yet? A+ first Start here

   Why: security work means reading what computers and networks are doing, and A+ teaches how they work: hardware, networks, operating systems. CompTIA calls it "the industry standard to start your IT career" and aims it at help desk jobs, a common first IT job. CompTIA suggests 12 months of IT support work first. That's a suggestion, not a rule, and anyone can book the exam.

   Not first if: you already fix computers or manage accounts at work. Skip to rule 2.

   Prep: Professor Messer's free videos cover both exams (220-1201 and 220-1202). You can take them in any order.

   Next: get an IT job, then Security+. Passing Security+ later renews A+ too, so you stop paying for both.

2. 2. In IT already? Security+ first Start here

   Why: it covers threats, security operations and security management, the daily work of a junior security analyst. CompTIA suggests Network+ and two years in a security or systems admin role. Help desk and support work already moves you toward that. It's also where the other two paths lead next.

   Not first if: words like "subnet", "DNS" and "Active Directory" are new to you. Do A+ or Network+ first, or study those topics before you book.

   Prep: free SY0-701 videos from Professor Messer. CompTIA's own practice tests cost $209 if you want them. Version 8 is expected to start on or around November 17, 2026, so read which version to book first.

   Next: a few years in a SOC, then CySA+ (rule 5).

3. 3. Coming from another career? CC is a cheaper first step Start here

   Why: CC needs no experience and tests ideas more than hands-on skill: security principles, governance, access control, networking and incident response. If your old job dealt with rules, risk or audits, that background carries over. At $199 it's a cheaper first exam than Security+, though you pay $50 a year to keep it.

   Not first if: you want a hands-on job such as SOC analyst. A SOC analyst watches and sorts security alerts. CC alone won't show those skills, so pair it with free labs or go straight to Security+.

   Prep: ISC2's own course plus exam costs $454. The free alternative: Cisco's Introduction to Cybersecurity and Microsoft's security concepts learning path cover many of the same basics.

   Next: Security+. Later, once you have the years, SSCP or CISSP (rule 5).

4. 4. Network+ is optional Next

   Network+ costs $399. CompTIA suggests A+ and 9 to 12 months in a junior network job. It's worth it if networks are your weak spot. Many people skip it and study networking for Security+ instead.

5. 5. CySA+, SSCP and CISSP come later Not first

   • CySA+ ($439): CompTIA suggests about 4 years as a SOC or vulnerability analyst.
   • SSCP ($249): needs one year of full-time security work. Pass without it and you're an "Associate of ISC2" with two years to earn it.
   • CISSP ($749): needs five years of experience in at least two of its eight areas. It's a goal for later, not a way in.

6. 6. GSEC only if someone else pays Not first

   GIAC's GSEC is a respected exam, but one attempt costs $999 and a retake costs $899. That's more than A+, Security+ and CC put together if you fail once. Take it if your employer pays.

7. 7. Cheap extras: add them, don't swap them in

   • Microsoft SC-900 ($99, never expires): Microsoft's cloud security basics. Useful if the jobs you want use Microsoft 365 or Azure.
   • Cisco CCST Cybersecurity ($125, a 50-minute exam): an entry check on the basics. It lasts five years.
   • Google Cybersecurity Certificate ($49 a month on Coursera): a series of 8 or 9 courses (the page says both), not a single exam. Graduates get a discount on Security+. Pick it if you want a guided course before Security+.

Every option at a glance

Each price links to its source on the full cost table, with retakes and renewal fees. Checked on Nov 10, 2026.

What about hacking certs?

This site covers defense: protecting systems and spotting attacks. We leave out certs built around attacking systems. They're rarely the right first step for someone without IT experience.