CompTIA Cybersecurity Analyst (CySA+) is a top certification for people who work in cybersecurity. It focuses on finding, stopping, and responding to security threats by constantly monitoring systems.

This certification shows that a tech professional knows how to handle security incidents and fix weaknesses in systems. It also highlights the importance of clear communication when analyzing security issues and following rules and guidelines.

Skills You’ll Learn

Build your skills with CompTIA training and prove what you know by earning the CySA+ certification.

• Improve security operations and learn the difference between threat intelligence and threat hunting. Use the right tools to find harmful activity.
• Perform vulnerability assessments, rank security weaknesses by risk, and suggest ways to fix them.
• Use attack frameworks to understand how hackers work. Respond to security incidents and follow the steps of the incident response process.
• Use clear communication to report on security issues and share action plans and important results with leaders and team members.

Security Operations (33%)

System and Network Basics:
Learn how systems and networks are set up. Understand things like operating systems, networks, user access (IAM), encryption, and how to protect sensitive data. You will also learn how security logs are collected and reviewed.

Signs of Malicious Activity:
Learn how to spot warning signs of attacks. This includes unusual network traffic, unknown devices, unauthorized software, stolen data, strange app behavior, and social engineering scams.

Tools and Techniques:
Use tools like Wireshark, SIEM systems, and VirusTotal to detect threats. Practice skills like recognizing patterns, analyzing emails, and using basic scripting languages such as Python and PowerShell.

Threat Intelligence and Threat Hunting:
Understand different types of threat actors and how they attack systems. Learn how security teams gather and share information about threats and search for hidden risks.

Improving Security Processes:
Learn how to make security processes more organized and efficient by improving workflows and combining tools into one clear system.

Vulnerability Management (30%)

Vulnerability Scanning:
Learn how to scan systems to find security weaknesses. Understand the different types of scans, such as internal and external scans, and active and passive scans.

Understanding Scan Results:
Learn how to read and understand reports from security tools that scan networks, websites, and cloud systems.

Prioritizing Vulnerabilities:
Learn how to rank security weaknesses based on risk level, how easy they are to exploit, and how important the affected system is.

Fixing Security Weaknesses:
Learn ways to prevent common attacks like cross-site scripting (XSS) and other software weaknesses.

Responding to Vulnerabilities:
Understand how to apply patches, manage system updates, follow security policies, and reduce risk during the software development process.

Incident Response Management (20%)

Attack Frameworks:
Learn common models that explain how cyberattacks happen and how security teams study them.

Responding to Incidents:
Practice the main steps of incident response: detect the problem, analyze it, contain it, remove the threat, and recover systems.

Incident Management Process:
Understand how organizations plan for incidents, train teams, test response plans, and recover from disasters.

Reporting and Communication (17%)

Vulnerability Reporting:
Learn how to create clear reports about security weaknesses, share action plans, track progress, and communicate with leaders.

Incident Reporting:
Learn how to report security incidents, explain what happened, share lessons learned, and track important security metrics.

Course is offered as a virtual independent study or virtual independent study on demand (includes a CompTIA instructor). 

For our independent study and on-demand CompTIA courses, there is no set start date. These courses are offered all year long. Students can begin as soon as their enrollment is complete.

When we post these courses on CareerForce, we are required to enter a start date. This date is only for the posting and does not mean the class starts on that day.

Course must be completed within three months of receiving materials and the exam is to be completed a month after completing the course. If an exam retake is needed, it must be taken within two months of the previous exam. Both the course materials and exam vouchers have expiration dates with no extensions.

Certification renewal every three years from date of the exam.

Must have a minimum of CompTIA A+–level knowledge through certification, education, or similar training is required.

Level: Advanced

After you complete our course and pass the exam, we offer career exploration and job support through our MTFS Gather Program.