Arsenal / Exam Change Watch
Security+ V7 to V8: what changed
Security+ is getting a new version. Here's what actually moved, what got cut, what's brand new, and how to decide which exam to sit.
V8 launch (SY0-801)
Nov 17, 2026"On or around," per CompTIA's Security+ page.
V7 English retirement (SY0-701)
June 11, 2027Per CompTIA's V7 page. Japanese, Portuguese, Spanish and Thai: August 13, 2027.
Exam format
90 Q / 90 min / 750Maximum of 90 questions, 90 minutes, passing score 750 (on a scale of 100–900). Same as V7.
Objectives
28 → 27Same five domain names in spirit, one domain renamed, weights reshuffled.
01 / Domain weights
Where the points moved
Domain 1 and Domain 2 picked up weight. Domain 5 dropped the most. Domain 2 also got a new name: "Mitigations" became "Attacks," because most mitigation content moved into Security Operations.
| Domain | SY0-701 (V7) | SY0-801 (V8) | Change |
|---|---|---|---|
| 1.0 General Security Concepts | 12% | 16% | +4 |
| 2.0 V7: Threats, Vulnerabilities, and Mitigations V8: Threats, Vulnerabilities, and Attacks | 22% | 24% | +2 |
| 3.0 Security Architecture | 18% | 19% | +1 |
| 4.0 Security Operations | 28% | 27% | −1 |
| 5.0 Security Program Management and Oversight | 20% | 14% | −6 |
Security Operations is still the biggest domain at 27%. If you only have time to go deep on one area, it's still that one.
02 / Objective crosswalk
Every V8 objective, and where it came from
Objective titles below are quoted from CompTIA's official SY0-801 objectives. The "Came from" column shows the SY0-701 objective number that holds most of the same content.
- New no V7 equivalent
- Merged absorbs other V7 objectives
- same home, big additions
- Renumbered same content, new number
- Same same number, minor changes
| V8 | SY0-801 objective | Came from | Change | What's different |
|---|---|---|---|---|
| 1.1 | Explain security concepts and controls. | 1.1 + 1.2 | Merged | Adds defense in depth and Zero Trust principles. Control categories are now technical/logical, managerial/administrative, physical/environmental and operational. The physical-security list (bollards, sensors) is gone. |
| 1.2 | Given a scenario, demonstrate the impact of change management processes on security. | 1.3 | Renumbered | Now a "Given a scenario" objective. Adds fail forward. |
| 1.3 | Explain the importance of using appropriate cryptographic solutions. | 1.4 | Renumbered | Adds hashing algorithms. Drops key stretching, blockchain and the named hardware tools (TPM, HSM, secure enclave). |
| 2.1 | Explain characteristics of threats and vulnerabilities. | parts of 4.3 | New | Threat feeds, intelligence sources, the threat life cycle, likelihood and impact, CVSS scoring, CVE and prioritization get their own objective. |
| 2.2 | Describe common threat actors and motivations. | 2.1 | Adds terrorist, competitor and accidental/unintentional actors, plus motivations like notoriety, extortion, general curiosity, influence and intellectual property. Nation-state is now state-sponsored. | |
| 2.3 | Describe threat vectors and sources. | 2.2 | Much bigger. Adds RCS, collaboration tools, CAPTCHA, RTF/PDF, browser-based, remote access (VNC, VPN), living-off-the-land tools, IoT, OT, physical and signal-based vectors. | |
| 2.4 | Explain types of vulnerabilities and attack surfaces. | 2.3 | Adds large language models (LLMs), identity providers, hardcoded secrets, unsafe exception handling, public repositories and public object storage. | |
| 2.5 | Given a scenario, analyze indicators of malicious activity. | 2.4 | Social engineering attacks land here. Adds fileless malware, skimming, quishing, deepfake, user enumeration, MFA bypass and indicator types such as hash, IP address and domain. | |
| 2.6 | Summarize threats and vulnerabilities associated with artificial intelligence (AI) usage. | none | New | Entirely new. 13 bullets from prompt injection to code execution. See the AI risks quick reference. |
| 3.1 | Compare and contrast security implications of different architecture models. | 3.1 | Adds multicloud, cloud deployment models (including community), proprietary vs. open source and business considerations. Drops containerization, SDN and the embedded/RTOS/SCADA list (OT remains). | |
| 3.2 | Given a scenario, manage the security architecture to best protect the infrastructure. | 3.2 | Adds Zero Trust architecture, Security Service Edge (SSE), gMSAs, privilege creep, out-of-band management and end-to-end encrypted messaging. Firewalls and IPS move to 4.1. SD-WAN and SASE are gone. | |
| 3.3 | Summarize concepts and strategies used to protect data. | 3.3 | Adds data transpose, deidentification, the data life cycle and data protection roles (owner through subprocessor), plus data compliance categories. | |
| 3.4 | Explain the importance of resilience and recovery in security architecture. | 3.4 | Recovery metrics (RTO, RPO, MTTR, MTBF) move here. Adds autoscaling, redundant power supply, surge protector, immutability and restoration testing. | |
| 4.1 | Given a scenario, apply mitigating controls, techniques, and solutions to secure the environment. | 2.5 + 4.1 + 4.5 | Merged | The big merge: mitigations, hardening and "modify enterprise capabilities" in one place. Adds canary accounts, WIPS, rate limiting, BIMI, secrets scanning and captive portals. |
| 4.2 | Explain the security implications of proper hardware, software, and data asset management. | 4.2 | Same | Adds planning/scoping to the asset life cycle. |
| 4.3 | Given a scenario, perform tasks associated with vulnerability management. | 4.3 | Now scenario-based. Adds IPAM, CSPM, source code review and penetration test report review. Threat feeds and CVSS/CVE move to 2.1. | |
| 4.4 | Explain security alerting and monitoring concepts and tools. | 4.4 | Same | Adds orchestration, packet analyzer, port mirroring, dashboards and network management systems. |
| 4.5 | Given a scenario, apply concepts related to identity and access management. | 4.6 | Renumbered | Adds passkeys, backup codes, emergency access and compromised credential monitoring. Just-in-time is now listed as an access control model. Attribute-based access control is gone. |
| 4.6 | Given a scenario, apply automation and orchestration solutions to secure operations. | 4.7 | Now scenario-based. Adds AI capabilities (agentic, chatbot, predictive analysis, AI-augmented baselines), guardrails, process engineering, CI/CD and workflows. | |
| 4.7 | Summarize concepts associated with incident response activities. | 4.8 | Renumbered | Adds IR playbooks and roles, negotiation, notification/external reporting (customers, law enforcement) and post-incident reporting (PIR). Legal hold moves to 5.4. |
| 4.8 | Given a scenario, use data, artifacts and sources to support a security investigation. | 4.9 | Renumbered | Adds NetFlow/IPFIX, surveillance footage, memory dump, bit-level copy, snapshots, stakeholders (HR, accounts, legal) and log-parsing techniques. |
| 5.1 | Explain the importance of governance, risk, and compliance artifacts. | 5.1 | Focus shifts to artifacts: benchmarks, advisories, implementation guides, baselines, RFCs, runbooks and more policies. Governance structures (boards, committees) are gone. Data roles move to 3.3. | |
| 5.2 | Explain the impact of risk management processes on the security of the organization. | 5.2 | Same | Adds residual risk and management oversight. Drops assessment frequency types and risk appetite types (expansionary, conservative, neutral). |
| 5.3 | Explain the assessment and management processes associated with third-party risk. | 5.3 | Adds procurement (RFP, RFI, RFQ, EOI), SLO, vendor registry and vendor lock-in. BPA and work order are gone. | |
| 5.4 | Summarize elements of effective security compliance. | 5.4 | Adds compliance training, AML/CTF, anti-bribery, privacy rights (opt-in/opt-out, data correction) and legal hold. | |
| 5.5 | Explain concepts associated with audit and assessment activities. | 5.5 | Adds MITRE ATT&CK, Cyber Kill Chain, Diamond Model, audit charter, gap analysis and functional/behavioral testing. | |
| 5.6 | Given a scenario, apply security awareness concepts to improve organizational security. | 5.6 | Adds training types, delivery mechanisms (LMS, self-service portals) and personnel behavior risk scoring. |
03 / Reverse lookup
Studying from V7 material? Here's where each objective went
V7 titles below are quoted from CompTIA's official SY0-701 objectives (Version 5.0).
| V7 | SY0-701 objective | Lands in V8 |
|---|---|---|
| 1.1 | Compare and contrast various types of security controls. | 1.1 |
| 1.2 | Summarize fundamental security concepts. | Split: mostly 1.1. Zero Trust planes to 3.2, deception to 4.1, gap analysis to 5.5 |
| 1.3 | Explain the importance of change management processes and the impact to security. | 1.2 |
| 1.4 | Explain the importance of using appropriate cryptographic solutions. | 1.3 |
| 2.1 | Compare and contrast common threat actors and motivations. | 2.2 |
| 2.2 | Explain common threat vectors and attack surfaces. | 2.3 (vectors), 2.4 (attack surfaces), social engineering to 2.5 |
| 2.3 | Explain various types of vulnerabilities. | 2.4. Injection, buffer overflow and memory attacks to 2.5 |
| 2.4 | Given a scenario, analyze indicators of malicious activity. | 2.5 |
| 2.5 | Explain the purpose of mitigation techniques used to secure the enterprise. | 4.1 |
| 3.1 | Compare and contrast security implications of different architecture models. | 3.1 |
| 3.2 | Given a scenario, apply security principles to secure enterprise infrastructure. | 3.2. Firewalls, IPS and 802.1X to 4.1, load balancing to 3.4 |
| 3.3 | Compare and contrast concepts and strategies to protect data. | 3.3 |
| 3.4 | Explain the importance of resilience and recovery in security architecture. | 3.4. Tabletop exercises to 4.7 |
| 4.1 | Given a scenario, apply common security techniques to computing resources. | 4.1 |
| 4.2 | Explain the security implications of proper hardware, software, and data asset management. | 4.2 |
| 4.3 | Explain various activities associated with vulnerability management. | 4.3. Threat feeds, CVSS and CVE to 2.1 |
| 4.4 | Explain security alerting and monitoring concepts and tools. | 4.4 |
| 4.5 | Given a scenario, modify enterprise capabilities to enhance security. | 4.1 |
| 4.6 | Given a scenario, implement and maintain identity and access management. | 4.5 |
| 4.7 | Explain the importance of automation and orchestration related to secure operations. | 4.6 |
| 4.8 | Explain appropriate incident response activities. | 4.7. Legal hold to 5.4 |
| 4.9 | Given a scenario, use data sources to support an investigation. | 4.8 |
| 5.1 | Summarize elements of effective security governance. | 5.1. Data roles to 3.3 |
| 5.2 | Explain elements of the risk management process. | 5.2. Recovery metrics to 3.4 |
| 5.3 | Explain the processes associated with third-party risk assessment and management. | 5.3 |
| 5.4 | Summarize elements of effective security compliance. | 5.4 |
| 5.5 | Explain types and purposes of audits and assessments. | 5.5 |
| 5.6 | Given a scenario, implement security awareness practices. | 5.6 |
04 / Gone in V8
Topics no longer named in the V8 objectives
These appear in the SY0-701 objectives but not in SY0-801. If you're switching to V8, you can stop drilling them. One honest caveat: CompTIA says its bullet lists are examples, not a complete list, so a stray question can still touch a related idea.
- Blockchain and open public ledger
- Key stretching
- Steganography
- TPM, HSM and secure enclave as named tools
- War and philosophical motivations
- Misinformation/disinformation
- Typosquatting, pretexting and brand impersonation as named techniques
- Bloatware
- RFID cloning
- Birthday attack
- Containerization and software-defined networking (SDN)
- Embedded systems and RTOS (OT stays)
- SD-WAN and SASE (SSE replaces it)
- Jump server and proxy server as named appliances
- Journaling
- Physical security list: bollards and infrared, pressure, microwave and ultrasonic sensors
- Wireless config detail: WPA3, RADIUS, site surveys, heat maps
- COPE and CYOD deployment models
- User behavior analytics
- Attribute-based access control and interoperability
- Technical debt and employee retention
- Risk assessment frequency (ad hoc, recurring, one-time, continuous)
- Risk appetite types (expansionary, conservative, neutral)
- Business partners agreement (BPA) and work order
05 / New in V8
What you'll need that V7 never asked for
AI threats and vulnerabilities
Model manipulation, poisoning, prompt injection, data loss, bias, explainability, hallucinations, jailbreaking, evasion, privacy, ethical considerations, session hijacking and code execution.
AI in security operations
AI capabilities for deployment: agentic, chatbot, predictive analysis and AI-augmented baselines. Plus guardrails, process engineering, process risks, CI/CD and workflow integrations.
Threat intel and vulnerability scoring
Threat feeds, intelligence sources, the life cycle, likelihood and impact, CVSS scoring, CVE and prioritization, all in one objective instead of tucked inside vulnerability management.
More ways in
RCS and collaboration tools, QR codes and CAPTCHA, RTF and PDF attachments, browser extensions and session tokens, VNC and VPN, living-off-the-land tools, logistic and SaaS providers, IoT, OT, and Bluetooth/RF/NFC.
Modern attack surfaces
Large language models (LLMs), identity providers, hardcoded secrets, unsafe exception handling, public repositories and public object storage.
Fresh attacks to recognize
Fileless malware, skimming, forced entry, quishing, deepfake, user enumeration and MFA bypass.
SSE and identity hygiene
Security Service Edge (SSE), Group Managed Service Accounts (gMSAs), privilege creep and end-to-end encrypted messaging.
New tools in the toolbox
Canary accounts, rate-limiting requests, BIMI for email, secrets scanning for repositories and captive portals for network access control.
After containment
Negotiation, notification and external reporting (customers, law enforcement, mandatory) and post-incident reporting (PIR).
Program management additions
RFP, RFI, RFQ and EOI. Service-level objectives and vendor lock-in. AML/CTF and anti-bribery. MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model of Intrusion Analysis.
06 / Decision time
Take V7 now, or wait for V8?
Short version: if you're already deep into V7 material, finish on V7. If you're just starting after November 17, start on V8. Either way you earn the same certification: CompTIA Security+.
- You've been studying V7 material for weeks and you're scoring well on practice tests.
- You can sit the exam well before June 11, 2027, with room for a retake if you need one.
- Your book, course and practice questions are all written for SY0-701.
- You're starting from zero after November 17, 2026.
- Your test date is close to June 2027. A failed V7 attempt late in the window leaves you no V7 retake.
- You want the AI and modern-threat topics on your résumé story.
Don't cut it close. The V7 English exam retires June 11, 2027. Book far enough ahead that a retake still fits on V7, or plan to switch.
Good news for switchers. Most of the material carries over. The domain names, exam length and passing score barely moved. Your biggest new study blocks are 2.1, 2.6 and the AI half of 4.6.
Sources
- CompTIA Security+ SY0-801 V8 Certification Exam Objectives (official PDF): titles, bullets, domain weights, test details.
- CompTIA Security+ SY0-701 Exam Objectives Version 5.0 (official PDF): V7 titles, bullets and weights.
- comptia.org Security+ page: V8 "expected to launch on or around November 17, 2026." comptia.org Security+ V7 page: retirement dates. Both checked October 29, 2026.