Last updated: October 15, 2026.
If you have been studying for SY0-701, or you are choosing between the two versions, the first question is simple: how different is Security+ SY0-801 (V8)? The short answer is that it is an evolution, not a rewrite. The format is unchanged, the five-domain structure stays, and most core topics carry over. What changes is the weighting and a clear push toward AI and modern operations.
This is part of our complete guide to Security+ SY0-801.
What stays the same
- Exam format: up to 90 questions, multiple-choice and performance-based
- Time limit: 90 minutes
- Passing score: 750 on a scale of 100 to 900
- Number of domains: five
- Certification validity: three years
- Vendor-neutral focus: the exam is not tied to a single product
Domain weights: SY0-701 vs SY0-801
| Domain | SY0-701 | SY0-801 | Change |
|---|---|---|---|
| 1. General Security Concepts | 12% | 16% | +4 |
| 2. Threats, Vulnerabilities, and Mitigations (701) / Attacks (801) | 22% | 24% | +2 |
| 3. Security Architecture | 18% | 19% | +1 |
| 4. Security Operations | 28% | 27% | -1 |
| 5. Security Program Management and Oversight | 20% | 14% | -6 |
Two things stand out. Governance, risk and compliance (domain 5) loses six points, so it matters less on exam day than before. General Security Concepts gains four, so the fundamentals, including cryptography and change management, deserve more attention than they got under V7. Security Operations is still the biggest domain, and Domains 2 and 4 together still account for just over half of the exam.
What is new or more prominent in SY0-801
1. AI becomes a named topic
This is the headline change. V8 includes a dedicated objective (2.6) on threats and vulnerabilities associated with AI use, covering things like model manipulation, poisoning, prompt injection, hallucinations, jailbreaking and privacy. Large language models also appear among the attack surfaces in objective 2.4, and objective 4.6 includes AI capabilities in security automation, such as agentic AI and predictive analysis. CompTIA does not expect you to be an AI engineer. It expects you to recognize AI-related risks and apply security principles to them. See our detailed breakdown in AI in Security+ SY0-801.
2. Domain 2 is renamed
The second domain moves from "Threats, Vulnerabilities, and Mitigations" to "Threats, Vulnerabilities, and Attacks," which fits its focus on recognizing attack types and indicators of malicious activity.
3. More modern attack vectors and identity topics
The V8 objectives list items such as QR-code phishing, deepfakes, RCS messaging, session tokens, passkeys, just-in-time access, Security Service Edge (SSE) and group managed service accounts. Check the official objectives document to see exactly where each of these sits compared with the version you studied.
4. Sharper recommended experience
V8 describes the target candidate as a security administrator with about two years of hands-on experience.
What this means for your study
- If you studied for SY0-701: most of your knowledge transfers. Focus your top-up on AI risks, the domains whose weight increased, and the newer topics above.
- If you are starting from scratch: study the version you intend to sit. Our guide to which exam to take explains how to choose by test date.
- Everyone: compare the two official objectives documents line by line. CompTIA's bulleted examples are not exhaustive, so topics outside the list can still appear.
For a domain-by-domain walkthrough of V8, read SY0-801 Exam Objectives Explained.
Ready to prepare for V8?
Explore official training, practice and labs in our CompTIA Security+ SY0-801 (V8) collection.
Frequently asked questions
Is SY0-801 a completely new exam?
No. It keeps the same format and five-domain structure, with updated weighting and new emphasis on AI and modern operations.
What is the biggest difference between SY0-701 and SY0-801?
The addition of AI-related objectives, plus a shift in domain weights, with Program Management and Oversight dropping from 20% to 14%.
Do I need to relearn everything if I studied SY0-701?
No. Most core content carries over. Review the new objectives and the domains whose weight increased.
Is the passing score different?
No. Both versions use 750 on a scale of 100 to 900.
Written by an instructor who holds Security+, CySA+, PenTest+ and SecurityX. CertInstructor is an Authorized CompTIA Partner.
0 comments