CompTIA SecurityX (CAS-005): What the Certification Actually Covers, Costs, and Requires

What SecurityX Actually Certifies

SecurityX validates that someone can do the job of a security architect or senior security engineer — not just describe security concepts, but design a segmentation strategy, choose between homomorphic encryption and tokenization for a specific data problem, or troubleshoot a broken PKI chain under exam conditions. CompTIA built it for people who already carry security responsibility at an enterprise level, and it shows: several of the performance-based questions put candidates in a simulated Linux shell and ask them to complete a  configuration task, not just click the right multiple-choice answer.

If the name looks unfamiliar but the content sounds familiar, that's because it is. SecurityX is the rebrand of CASP+ (CompTIA Advanced Security Practitioner). CompTIA retired the CASP+ name in December 2024 as part of a new "Xpert" series that also includes CloudNetX and DataAI, and folded the credential's history forward — existing CASP+ holders kept their certification under the new name with no retest required.

Who CAS-005 Exam Is For (and Who It Isn't)

This is not a stepping-stone certification. CompTIA recommends candidates have roughly ten years of general IT experience with at least five of those years spent hands-on in security, and it explicitly frames SecurityX as sitting above Security+, CySA+, and PenTest+ in its cybersecurity pathway — not alongside them. There's no enforced prerequisite, so nothing stops a less experienced candidate from registering, but the performance-based questions are built around  architectural decisions and hands-on troubleshooting that are hard to fake your way through without the field time.

It fits people already working as security architects, senior security engineers, security consultants, or technical leads on a security team who need a vendor-neutral credential to formalize what they're already doing. It's a poor fit for anyone newer to security — Security+ or CySA+ will do more for a career at that stage, both because they're achievable and because they're what SecurityX assumes you already know.

Exam Format and What Taking It Feels Like

You'll have up to 165 minutes for a maximum of 90 questions, mixing multiple-choice, multiple-select, and performance-based items. Candidates who've taken the exam recently describe the PBQs coming early — drag-and-drop and click-based scenario questions in the first stretch, followed by a run of multiple-choice, with a hands-on Linux VM task (log in with provided credentials, complete a specific task) showing up around the midpoint. That structure means the front-loaded PBQs can eat disproportionate time if you're not watching the clock, since a single PBQ can be worth more time-per-point than a multiple-choice question.

There's no partial credit narrative and no scaled score at the end — CompTIA scores it pass/fail only, and you won't see a number, just a result once Pearson VUE processes it. Most candidates get their Credly badge within about 12 hours of finishing.

Domains and Weightings

CAS-005 V5 is organized into four domains, and the weighting tells you where to spend prep time:

Security Engineering carries the most weight, and it's also the domain most likely to surprise candidates coming from a CASP+ (CAS-004) background — it now includes post-quantum cryptography, homomorphic encryption, and generative AI as an automation and threat vector, none of which existed in the prior version's objectives in the same form. Security Architecture leans heavily on cloud-native concepts: CASB models, container and serverless security, Terraform and Ansible as configuration tools, and zero trust as a design principle rather than a buzzword. Governance, Risk, and Compliance is the lightest-weighted domain but still covers  frameworks (COBIT, NIST CSF, ISO/IEC 27000, PCI DSS) rather than testing definitions in isolation.

Cost Breakdown

A single SecurityX exam voucher runs $529 USD at CompTIA's list price, though CompTIA runs periodic adjustments to this figure and authorized resellers sometimes offer it at a discount — confirm the current number in the CompTIA Store before budgeting. That fee buys one attempt; if you don't pass, you'll need another voucher to retry, which is where a voucher-plus-retake bundle can be worth considering if you're not confident going in.

Regional pricing varies by country, and CompTIA doesn't publish a global price list on the certification page itself — check the store for your billing region.

Prerequisites and Eligibility

There's no hard gate. You can register and sit SecurityX without holding Security+, CySA+, PenTest+, or Cloud+ first, and without proof of experience. CompTIA's stated recommendation — 10 years general IT experience, 5 of them hands-on in security — is guidance, not a checkpoint enforced at registration. In practice, most people who pass without that background are already doing security architecture or engineering work day to day, even if their job title or formal certification history doesn't reflect it yet.

How CAS-005 Exam Is Scored and What Passing Requires

CompTIA doesn't publish a passing threshold or a scaled score for SecurityX — it's strictly pass/fail. That's a deliberate departure from something like Security+, which reports a 100–900 scaled score against a published cutoff. For SecurityX, you'll be told before the exam that no score will be shown, and confirmation comes only as a pass/fail result, typically visible in your Pearson VUE exam history shortly after you finish and later formalized as a digital badge.

Renewal and Continuing Education

SecurityX is valid for three years from your exam date. To keep it active, CompTIA's Continuing Education (CE) Program requires 75 CEUs within that three-year window — earned through activities like attending conferences and webinars, completing relevant training, teaching or mentoring, publishing security-related content, or holding other qualifying CompTIA or non-CompTIA certifications. Activities need to be documented and tied to at least 50% of one or more SecurityX exam objectives to count. Miss the window without renewing, and the certification lapses — the only way back is to pass the current version of the exam again.

How SecurityX Compares to CISSP

The most natural alternative for someone weighing SecurityX is (ISC)²'s CISSP, and the two get compared constantly because they sit at a similar seniority level but test differently. CISSP costs $749 and requires five years of verified, paid work experience across its eight domains to earn full certification — without that experience, you're certified as an "Associate of ISC²" until you accumulate it. SecurityX has no enforced experience requirement and costs less, but leans harder into hands-on, performance-based scenarios rather than the broader managerial and policy framing CISSP is known for. Candidates who already lean technical — configuring systems, not just governing them — often find SecurityX the better test of what they actually do; candidates aiming for CISO-track or broader security-management roles tend to get more mileage out of CISSP's breadth and industry name recognition, particularly outside the U.S. where CISSP is more entrenched. Neither replaces the other on a resume; plenty of senior practitioners eventually hold both.

 Preparation Timeline

Candidates who already work daily in security architecture or engineering roles report meaningful prep in one to two weeks of focused study, particularly if they're using CompTIA's own CertMaster Practice material aligned to the current objectives. For candidates without that day-to-day exposure — someone stronger in operations or compliance than in architecture and cryptography, for instance — six to eight weeks of structured study is more , with extra time budgeted specifically for the newer Security Engineering content (post-quantum cryptography, homomorphic encryption) that has no equivalent in most people's prior CASP+ prep. The performance-based Linux and configuration tasks reward actual lab time over flashcards, so building in hands-on practice — not just reading objectives — matters more here than it does for CompTIA's lower-tier exams.