Security+ SY0-701 vs SY0-801: What Changes in CompTIA's V8 Exam

SY0-801, the next version of CompTIA Security+, is expected to launch on or around November 17, 2026. SY0-701 stays live until June 11, 2027 for the English exam, so for just under seven months you can book either one. The format does not change. The blueprint does: new domain weights, an objective on artificial intelligence, a rebuilt incident response section, and a long list of terms that moved or dropped out.

Everything below was checked against CompTIA's two objectives documents, SY0-701 Version 5.0 and the final SY0-801 Document Version 2.0, and against the V7 and V8 exam pages. Last verified 27 October 2026.

What stays the same

Both exams have a maximum of 90 questions, a mix of multiple-choice and performance-based, in 90 minutes. Both pass at 750 on a scale of 100 to 900, and CompTIA publishes no percentage equivalent for either. They lead to the same certification, CompTIA Security+, on the same three-year renewal cycle: 50 continuing education units (CEUs) and the $150 CE fee, or no fee if you pass the latest release of the exam or earn a higher-level CompTIA certification. CompTIA's renewal fees page lists the options.

Language is the one difference here with a practical edge. CompTIA lists SY0-801 in English only, so a candidate who tests in Japanese, Portuguese, Spanish or Thai has SY0-701 until August 13, 2027.

The new domain weights

Program management takes the biggest cut, six points, and general security concepts gain four. Security Operations is still the largest domain at 27%.

The Domain 2 rename follows a real move. SY0-701's objective 2.5, on mitigation techniques, leaves the domain, and most of its content lands in SY0-801's 4.1: "Given a scenario, apply mitigating controls, techniques, and solutions to secure the environment." Domain 2 now opens with a new objective on the characteristics of threats and vulnerabilities, and closes with the AI objective.

The objective count falls from 28 to 27. Domain 1 goes from four objectives to three, because SY0-801's 1.1 merges SY0-701's 1.1 on security controls with most of its 1.2 on fundamental concepts. Domain 2 grows from five to six, and Domain 4 shrinks from nine to eight.

The AI objective

SY0-701 has no objective on artificial intelligence; AI appears only in its acronym list. SY0-801 adds objective 2.6, "Summarize threats and vulnerabilities associated with artificial intelligence (AI) usage," and names 13 risks under it: model manipulation, poisoning, prompt injection, data loss, bias, explainability, hallucinations, jailbreaking, evasion, privacy, ethical considerations, session hijacking and code execution.

Three of those words were already in SY0-701 with other meanings. Jailbreaking was a mobile device vulnerability, privacy sat under compliance, and data loss meant data loss prevention. In 2.6 all three are AI risks.

AI shows up twice more. Objective 2.4 lists large language models (LLMs) as an attack surface, next to identity providers and mobile devices. Objective 4.6, on automation and orchestration, puts AI on the defending side with four capabilities: agentic, chatbot, predictive analysis and AI-augmented baselines. CompTIA also runs a whole certification on AI security, and our SecAI+ guide covers it.

Incident response: eight headings instead of seven steps

SY0-701's objective 4.8 lists a seven-step process: preparation, detection, analysis, containment, eradication, recovery and lessons learned. SY0-801's objective 4.7 replaces it with eight headings: preparation, identification, investigation, containment, negotiation, eradication/recovery, notification/external reporting, and post-incident.

Most of the old content survives under the new headings. Detection and threat hunting sit under identification, with internal and external advisories. Digital forensics, chain of custody, e-discovery and preservation sit under investigation. Lessons learned and root cause analysis sit under post-incident, next to a new item, post-incident reporting (PIR). Training, testing, tabletop exercises, simulation, playbooks and roles all go under preparation.

Two headings are new. Negotiation has nothing listed under it. Notification/external reporting covers stakeholders, customers, law enforcement and mandatory reporting. Legal hold leaves incident response altogether and moves to compliance, in 5.4.

Learn the eight headings as their own list. Mapping the old seven steps onto them leaves gaps at negotiation and notification.

What moved

• Mitigations. From Domain 2 (SY0-701 2.5) to Domain 4 (SY0-801 4.1).
• Controls and core concepts. SY0-701's 1.1 and most of 1.2 become SY0-801's 1.1, "Explain security concepts and controls," which also names defense in depth.
• RTO, RPO, MTTR and MTBF. From business impact analysis in risk management (SY0-701 5.2) to resilience and recovery (SY0-801 3.4).
• Legal hold. From incident response (SY0-701 4.8) to compliance (SY0-801 5.4).
• Shadow IT. From a threat actor (SY0-701 2.1) to a vulnerability and attack surface (SY0-801 2.4).
• Risk management strategies (SY0-701 5.2) are now risk treatment (SY0-801 5.2).

New in the SY0-801 objectives

These terms appear in SY0-801 and nowhere in SY0-701:

• Threats and vectors: Rich Communication Services (RCS) as a message-based vector (2.3), and deepfake and quishing among social engineering attacks (2.5).
• Architecture: Security Service Edge (SSE) and group managed service accounts (gMSAs) (3.2).
• Operations: BIMI next to SPF, DKIM and DMARC in email security (4.1); IP address management (IPAM) and cloud security posture management (CSPM) as ways to identify vulnerabilities (4.3); passkeys under password concepts (4.5).
• Change management: fail forward, next to backout planning (1.2).
• Third parties: expression of interest (EOI), service-level objective (SLO) and vendor lock-in (5.3).
• Compliance: anti-money laundering/counter-terrorism financing (AML/CTF) and anti-bribery training (5.4).
• Audits and assessments: MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model of Intrusion Analysis, named as reference sources (5.5).

What SY0-801 no longer names

Some SY0-701 terms do not appear anywhere in the SY0-801 objectives:

• Cryptography: Trusted Platform Module (TPM), hardware security module (HSM), secure enclave, key stretching, blockchain and steganography.
• Architecture and networking: software-defined networking (SDN), containerization, jump server, next-generation firewall (NGFW), SD-WAN, SASE, RADIUS, EAP and WPA3.
• Threats and intelligence: typosquatting, pretexting, open-source intelligence (OSINT) and the dark web.
• Identity and monitoring: attribute-based access control, the "something you know, have, are" factor list, and user behavior analytics.
• Risk and privacy: exposure factor, risk tolerance and data subject.

Missing from the list is not the same as missing from the exam. CompTIA's objectives say the bulleted examples are not exhaustive and that other examples may be on the exam. SY0-801's cryptography objective still has headings for tools and obfuscation; it just names nothing under them. Give these terms less time, and keep them in your review.

Does SY0-701 material still work?

Mostly. The domains keep their order and four of their five names, the format is the same, and most SY0-701 topics are still named in SY0-801. What SY0-701 material does not teach is the AI objective, the eight incident response headings and the new terms above. If you use it for SY0-801, add those three, and move study time toward general security concepts and away from program management.

Which one to book

If your test date falls between SY0-801's launch and June 11, 2027, you can choose. SY0-701 or SY0-801? sets out a rule by test date, with what vouchers and retakes mean near the switchover. The 2026 version index tracks the other CompTIA and AWS changes.