Your first cybersecurity certification
For most people the first security certification is CompTIA Security+ ($439 in the US, November 2026) if you already understand networks and operating systems, or ISC2 Certified in Cybersecurity ($199) if you do not. Cisco's CCNA Cybersecurity ($300) suits people aiming at security operations center (SOC) work. All three need no work experience. Skip CEH, CySA+ and CISSP as a first step: CEH asks for two years in security or official training, CompTIA recommends about four years for CySA+, and CISSP requires five years to certify (one can be waived). Because CompTIA recommends Network+ and two years of experience before Security+, we suggest A+ or Network+ too if you have never worked in IT.
Seven security certifications people consider first
| Certification | Exam fee | Cheapest first attempt | Experience | Study time | Best for |
|---|---|---|---|---|---|
| ISC2 Certified in Cybersecurity (CC) | $199 | $199 | None | 3 to 6 weeks | Career starters testing whether security suits them |
| CompTIA Security+ | $439 | $439 | None required; Network+ and 2 years recommended | 6 to 8 weeks with Network+-level knowledge | IT staff moving into security |
| Cisco CCNA Cybersecurity (200-201) | $300 | $349.99 | None | 2 to 3 months with IT support experience | Aspiring SOC analysts, especially in Cisco shops |
| ISC2 SSCP | $249 | $609 | 1 year in an SSCP domain (a degree can count) | See the SSCP guide | Systems and network staff who already do some security work |
| CompTIA CySA+ | $439 | $593 | None required; about 4 years recommended | 6 to 10 weeks after Security+ | Analysts already working with alerts and logs; a second credential |
| EC-Council CEH | $950 online + $100 application | $1,050 | 2 years in security, or official training | 6 to 10 weeks | Roles or contracts that name CEH; not a first step |
| ISC2 CISSP | $749 | $818 | 5 years in 2 of 8 domains | See the CISSP guide | Experienced staff; not a first certification |
The cheapest first attempt is the lowest route on each guide. For Security+ it is the voucher with free videos; for CySA+ it includes CompTIA's practice-and-exam bundle because we found no free full course; for CEH it is the experience route with the application fee; for CCNA Cybersecurity, SSCP and CISSP it adds a book or self-paced course to the exam. CISSP and SSCP candidates who lack the experience can pass the exam and become an Associate of ISC2 while they earn it.
ISC2 CC: cheap, short, and no longer free
ISC2's One Million Certified in Cybersecurity program, which gave away training and the exam, stopped taking new enrollments on May 20, 2026, so CC now costs $199 for the exam. It tests security principles, access control, network security and operations at an entry level. Its value is as a low-risk first look: three to six weeks of study tells you whether you enjoy the subject before you spend months on Security+.
Security+: plan around V8
CompTIA sells V7 (SY0-701) now and expects V8 (SY0-801) on or around November 17, 2026; the English V7 exam retires June 11, 2027. If you are already studying V7, you have until then to sit it. If you are starting now and expect to test after early 2027, study for V8 instead, so you are not racing the retirement date. The Security+ guide tracks the change and the voucher options, including CompTIA's $579 voucher with a retake.
A good fit if
- You have worked a help desk or administered systems
- You understand TCP/IP, ports and common services
- Your employer or a contract asks for Security+ by name
Think twice if
- You have never worked in IT: start with A+ or ISC2 CC
- You already work in a SOC: CySA+ fits your work better
- You want penetration testing: Security+ is defensive; see PenTest+ or OSCP later
Consider instead: ISC2 CC if you are new to IT, or Security+ against CySA+ if you already work in security.
Why not CEH or CISSP first
Both are well known, which is why people ask. CEH costs $950 for the online exam plus a $100 application if you skip EC-Council's official training, and it asks for two years of security work on that route. CISSP requires five years of paid work in at least two of its eight domains to certify; a degree or approved credential can replace one year. Neither suits a first step; our CEH against OSCP and CISSP against CCSP comparisons cover them for later.
Questions
- What is the best first cybersecurity certification?
- Security+ for people with IT experience; ISC2 CC for people without it. CCNA Cybersecurity is a strong alternative for SOC work.
- Is ISC2 CC still free?
- No. New enrollments in the free program closed May 20, 2026; the exam costs $199.
- Can I get Security+ with no experience?
- Yes. CompTIA recommends Network+ and two years of experience but sets no prerequisite.
- Should I take CySA+ before Security+?
- No. CySA+ is written for working analysts; CompTIA recommends about four years in a security operations or vulnerability role.
Next step
Tell us what you do now and the security job you want, and we will reply with a first certification, a study order and when to book around the Security+ change.
Ask which security certification to start with
Sources
- ISC2: Certified in Cybersecurity, checked November 5, 2026
- CompTIA: Security+, checked November 5, 2026
- CompTIA: CySA+ (V4), checked November 5, 2026
- Cisco: CCNA Cybersecurity, checked November 5, 2026
- ISC2: SSCP experience requirements, checked November 5, 2026
- ISC2: CISSP experience requirements, checked November 5, 2026
- EC-Council: CEH eligibility and application, checked November 5, 2026
Prices are published list prices we recorded on the dates shown, not quotes. How we research.