CompTIA SecurityX
Follow a topic roadmap built from the published exam blueprint, with lessons, practice exercises in a real terminal and practice exams.
An advanced cybersecurity certification validating the skills of security architects and senior security engineers to design, build, and implement secure enterprise solutions.
What you'll learn
Every objective SecurityX publishes, and what it asks you to be able to do. The percentage is how much of the exam each one is worth.
- Governance, risk, and compliance (20% of the exam)Security program documentation: policies, procedures, standards, and guidelines. Configuration management: asset life cycle, CMDB, and inventory. Data governance: production, development, testing, and QA. Risk management: impact analysis, risk assessment (quantitative vs. qualitative), third-party risk, confidentiality, integrity, and availability. Threat modeling: actor characteristics, attack patterns, and frameworks (ATT&CK, CAPEC, STRIDE). Attack surface: architecture reviews, data flows, and trust boundaries. And 5 more, each a topic in the course below.
- Security architecture (27% of the exam)Network architecture: segmentation, microsegmentation, VPN, always-on VPN, and API integration. Security boundaries: asset identification, management, attestation, data perimeters, and secure zones. Deperimeterization: SASE, SD-WAN, and software-defined networking. Zero trust concepts: defining subject-object relationships. Cloud capabilities: CASB (API-based, proxy-based), shadow IT detection, shared responsibility model, CI/CD pipeline, Terraform, Ansible, container security, orchestration, and serverless workloads. Cloud data security: data exposure, leakage, remanence, insecure storage, and encryption keys. And 1 more, each a topic in the course below.
- Security engineering (31% of the exam)Cryptographic techniques: tokenization, code signing, cryptographic erase, digital signatures, hashing, and symmetric/asymmetric cryptography. Advanced cryptography: PQC, key stretching, homomorphic encryption, forward secrecy, and hardware acceleration. Cryptographic use cases: data at rest, in transit, and in use; secure email, blockchain, privacy, compliance, and certificate-based authentication. Automation: scripting (PowerShell, Bash, Python), event triggers, IaC, cloud APIs, generative AI, containerization, patching, SOAR, and workflow automation. Vulnerability management: scanning, reporting, and SCAP (OVAL, XCCDF, CPE, CVE, CVSS).
- Security operations (22% of the exam)Vulnerabilities and attack surface: injection, XSS, insecure configurations, outdated software, and weak ciphers; mitigations include input validation, patching, encryption, and defense-in-depth. Monitoring and data analysis: SIEM (event parsing, retention, false positives/negatives), aggregate analysis (correlation, prioritization, trends), and behavior baselines (network, systems, users). Threat hunting: internal intelligence (honeypots, UBA), external intelligence (OSINT, dark web, ISACs), TIPs, IoC sharing (STIX, TAXII), and rule-based languages (Sigma, YARA, Snort). Incident response: malware analysis (sandboxing, IoC extraction, code stylometry), reverse engineering, metadata analysis, data recovery, and root cause analysis.
The exam at a glance
- Length
- 165 minutes
- Cost
- 544 USD
- Validity
- 3 years
- Style
- Hands-on
maximum of 90 a mix of multiple-choice and performance-based questions. Based on V5. Pass mark is pass/fail only; no scaled score.
minimum of 10 years of general hands-on IT experience including 5 years of hands-on security with Network+ Security+ CySA+ Cloud+ and PenTest+ or equivalent knowledge
Sitting the exam
The part nobody publishes in a syllabus. For SecurityX the logistics are study strategy: what you are allowed to read while the clock runs changes how you should practise, and what a second attempt costs changes when you should book.
Where you sit it
- Candidates have the option to sit for the CompTIA SecurityX exam either online or at a designated testing center.
What you are asked
- The assessment lasts for a maximum of 165 minutes.
- The test features a maximum of 90 questions consisting of a blend of multiple-choice and performance-based items.
How it is marked
- The result is determined solely on a pass or fail basis without any scaled scoring.
If you do not pass
- Vouchers and all associated retakes are valid for 12 months beginning on the purchase date, and test-takers must complete their exam and any applicable retake before that expiration date passes.
Booking it
- Vouchers and any included retakes remain valid for a period of 12 months from the purchase date.
What comes with it
- The certification kit features a professionally printed 8.5 x 11" frameable certificate.
Read off the official exam page on 16 October 2026. Rules change without notice, so confirm anything you are about to spend money on.
What the exam covers
Straight from the published curriculum. The weights are how much of the exam each area is worth, so they are the honest guide to where your study time should go.
Course content
23 topics
1. Security Foundations and Documentation
- Security program documentation: policies, procedures, standards, and guidelines.
2. Asset and Configuration Management
- Configuration management: asset life cycle, CMDB, and inventory.
3. Data Governance and Classification
- Data governance: production, development, testing, and QA.
4. Risk Management Fundamentals
- Risk management: impact analysis, risk assessment (quantitative vs. qualitative), third-party risk, confidentiality, integrity, and availability.
5. Threat Modeling and Attack Surface
- Threat modeling: actor characteristics, attack patterns, and frameworks (ATT&CK, CAPEC, STRIDE).
- Attack surface: architecture reviews, data flows, and trust boundaries.
6. Cryptographic Fundamentals
- Cryptographic techniques: tokenization, code signing, cryptographic erase, digital signatures, hashing, and symmetric/asymmetric cryptography.
7. Advanced Cryptographic Techniques
- Advanced cryptography: PQC, key stretching, homomorphic encryption, forward secrecy, and hardware acceleration.
- Cryptographic use cases: data at rest, in transit, and in use; secure email, blockchain, privacy, compliance, and certificate-based authentication.
8. Network Security Architecture
- Network architecture: segmentation, microsegmentation, VPN, always-on VPN, and API integration.
- Security boundaries: asset identification, management, attestation, data perimeters, and secure zones.
9. Deperimeterization and Modern Network Models
- Deperimeterization: SASE, SD-WAN, and software-defined networking.
- Zero trust concepts: defining subject-object relationships.
10. Cloud Security Architecture
- Cloud capabilities: CASB (API-based, proxy-based), shadow IT detection, shared responsibility model, CI/CD pipeline, Terraform, Ansible, container security, orchestration, and serverless workloads.
- Cloud data security: data exposure, leakage, remanence, insecure storage, and encryption keys.
11. Cloud Control Strategies
- Cloud control strategies: proactive, detective, and preventative controls; customer-to-cloud connectivity, service integration, and continuous authorization.
12. Scripting and Automation Foundations
Basic scripting with PowerShell, Bash, and Python for security tasks
13. Security Automation and Orchestration
- Automation: scripting (PowerShell, Bash, Python), event triggers, IaC, cloud APIs, generative AI, containerization, patching, SOAR, and workflow automation.
14. Vulnerability Management
- Vulnerability management: scanning, reporting, and SCAP (OVAL, XCCDF, CPE, CVE, CVSS).
15. Common Vulnerabilities and Mitigations
- Vulnerabilities and attack surface: injection, XSS, insecure configurations, outdated software, and weak ciphers; mitigations include input validation, patching, encryption, and defense-in-depth.
16. Security Monitoring and SIEM
- Monitoring and data analysis: SIEM (event parsing, retention, false positives/negatives), aggregate analysis (correlation, prioritization, trends), and behavior baselines (network, systems, users).
17. Threat Intelligence Sources and Collection
- Threat hunting: internal intelligence (honeypots, UBA), external intelligence (OSINT, dark web, ISACs), TIPs, IoC sharing (STIX, TAXII), and rule-based languages (Sigma, YARA, Snort).
18. Threat Intelligence Sharing and Detection Rules
Structured threat information sharing protocols and rule-based detection languages
19. Incident Response and Forensics
- Incident response: malware analysis (sandboxing, IoC extraction, code stylometry), reverse engineering, metadata analysis, data recovery, and root cause analysis.
20. Governance and Security Frameworks
- Frameworks: COBIT, ITIL, etc.
- Security frameworks: NIST, CSF, CSA, and others.
21. Compliance and Industry Standards
- Compliance strategies: industry-specific standards (PCI DSS, ISO/IEC 27000).
22. GRC Tools and Automation
- GRC tools: mapping, automation, and compliance tracking.
23. Security Program Management
- Program management: training (phishing, security, privacy), communication, reporting, and RACI matrix.
What to know before you start
- General hands-on IT experience
- Hands-on security experience
- Network principles
- Security principles
- Cybersecurity analysis
- Cloud concepts
- Penetration testing
Other CompTIA certifications
All CompTIA certificationsFrequently asked questions
How much does the SecurityX exam cost?
544 USD. Confirm it on CompTIA's page before you book: exam fees change.
How long is the SecurityX exam?
165 minutes. maximum of 90 a mix of multiple-choice and performance-based questions.
How many questions are on the SecurityX exam?
The test features a maximum of 90 questions consisting of a blend of multiple-choice and performance-based items. Check the current count with CompTIA before you book.
How long is SecurityX valid?
3 years. Check CompTIA's recertification route before it lapses.
Is the SecurityX exam hands-on?
Yes. It is performance-based: you are given a live environment and a command line, and marked on what you actually do rather than what you can recognise. Reading alone does not prepare you for it.
What is on the SecurityX exam?
4 domains. The heaviest is Security engineering at 31% of the exam, so it is the one worth over-preparing.
What should I know before starting SecurityX?
General hands-on IT experience. Hands-on security experience. Network principles. Security principles. Cybersecurity analysis. Cloud concepts. Penetration testing.
SecurityX vs Network+: what is the difference?
SecurityX: 165 minutes, 544 USD, hands-on, expert level. Network+: 90 minutes, 399 USD, hands-on, foundational level. Both are CompTIA exams with their own guide on this site.
Exam details from CompTIA. Always confirm on their page before booking.
What learners say about Acelro
About Acelro rather than the SecurityX exam: what learners made of the gap analysis, the roadmap and the projects.
“The roadmap makes me focus on a learning curve, no matter the length.”
“Acelro has been really great for me, an inspiring experience. I've gained a lot of confidence doing projects I thought were rocket science.”
“The gap analysis maps your actual skills against what the current job market is asking for. Nobody else made it that clear where I stood.”
Not sure you are ready for SecurityX yet? Check where your skills stand in under a minute, no sign-up required.
Check your career readiness, free