In this guide: the path in one line · how to read it · what each one validates · which order for your profile · Security+ or Linux+ first? · ready for the next step? · getting started
The CompTIA path in one line
The most common CompTIA route into cybersecurity looks like this:
A+ → Network+ → Security+ → CySA+ or PenTest+
With Linux+ as an infrastructure and cloud branch that you can take after Network+ or alongside Security+.
Each step builds on the one before it. A+ gives you the foundations of IT support; Network+, how networks work; Security+, how to protect systems, networks and data. From there the path splits: CySA+ if you want to detect and respond, PenTest+ if you want to test security by attacking with permission. Linux+ runs on a parallel track: running the servers that almost everything else depends on.
How to read the path
- None of them requires passing another first. CompTIA publishes recommended experience and knowledge. For Security+ SY0-801, that is two years of hands-on experience as a security administrator; for Linux+ XK0-006, 12 months with Linux servers plus A+, Network+ or Server+ level knowledge. If you already know what a step teaches, you can skip it.
- They are vendor-neutral. CompTIA certifications teach concepts that apply across vendors rather than one company's hardware or cloud. That makes them a solid first credential.
- It is not a mandatory ladder. It is an order that works for most people. What matters is not sitting an exam that assumes knowledge you do not have yet.
What each certification validates, and who it is for
| Certification | What it validates | Who it is for |
|---|---|---|
| A+ | IT support: hardware, mobile devices, operating systems, basic networking, basic security and troubleshooting | People starting out in IT or end-user support |
| Network+ | Networking: how networks are designed, configured, managed and secured, and how to troubleshoot them | Network support staff, and anyone who needs the networking that security assumes |
| Security+ | Defensive security: controls, threats, architecture, operations, incident response, and governance, risk and compliance | Anyone going for a first cybersecurity certification |
| CySA+ | Security analysis: detecting and analyzing threats, managing vulnerabilities and responding to incidents | People working, or aiming to work, in a security operations center (SOC) |
| PenTest+ | Authorized penetration testing: planning and scoping, reconnaissance, testing and reporting | People who want to assess security from the attacker's side, with permission |
| Linux+ | Linux server administration: system management, services, security, automation and troubleshooting | People heading for infrastructure, cloud, DevOps or technical security roles |
A+: the support foundation
The entry point. It covers what a support technician does every day: building and repairing computers, installing and configuring operating systems, connecting devices to the network and solving users' problems. Unlike the others on this path, it takes two exams. If you have been in a support role for a while, you can go straight to Network+.
Network+: understanding networks
Almost every security question assumes you know how a packet gets from A to B: ports, protocols, IP addressing, DNS, routing, wireless and segmentation. Network+ puts all of that in order. It is the step that pays off most later: arrive at Security+ with solid networking and half of the architecture domain will already make sense.
Security+: the first cybersecurity certification
The center of the path. It validates that you can recognize threats, apply controls, protect the architecture, monitor and respond to incidents. Version 8, SY0-801, launches on November 17, 2026 and adds AI, cloud and a fuller incident response process. The details are in the Security+ SY0-801 guide.
CySA+: detect and respond
The natural next step after Security+ if you want to stay on defense: analyzing logs and alerts, telling a false positive from a real attack, prioritizing vulnerabilities and handling an incident end to end. It goes deeper into what Security+ covers in its threats and operations domains.
PenTest+: test by attacking, with permission
The other branch after Security+. A penetration test is authorized work: the scope is agreed in writing, only what is in scope gets tested, and the result is a report of what was found and how to fix it. PenTest+ validates that whole process. Strong Linux and networking skills help a lot, because many of the tools in this field run on Linux.
Linux+: the infrastructure and cloud branch
It shows that you can set up, maintain and repair Linux servers, with security, scripts, containers, virtual machines and automation. The current version is XK0-006. It stands on its own for infrastructure and cloud work, and it complements Security+, CySA+ and PenTest+, since much of what you protect or test runs on Linux. See the Linux+ XK0-006 guide.
Which order makes sense for you
| If you… | Suggested order |
|---|---|
| Are new to IT | A+ → Network+ → Security+ |
| Already work in IT support | Network+ → Security+, or straight to Security+ if you know networking |
| Work in networking | Security+, then CySA+ if defense is your direction |
| Want infrastructure, cloud or DevOps work | Network+ (or equivalent knowledge) → Linux+ → Security+ |
| Want to work in a SOC | Security+ → CySA+, with Linux+ as a complement |
| Want to do penetration testing | Security+ → PenTest+, with solid Linux skills |
| Have run Linux servers for years | Linux+ to certify what you already do, then Security+ |
One rule works in every case: read the exam objectives before you buy a voucher. If more than half the topics sound like a foreign language, you are missing an earlier step.
Security+ or Linux+ first?
It is the most common question once you have the support and networking basics. It depends on where you are going:
- Security+ first if your goal is cybersecurity. It is the certification that opens the field, and whatever Linux you learn afterward you will apply with a security mindset.
- Linux+ first if your goal is infrastructure or cloud, or if you have never used a terminal. A lot of security lab work happens on Linux, and showing up to Security+ already comfortable with users, permissions, services and logs makes the architecture and operations domains much easier.
There is no wrong answer: the two complement each other.
Signs you are ready for the next step
Passing one exam does not automatically mean you are ready for the next. Before moving up, check these:
- You can explain the previous exam's objectives in your own words, without notes. If you passed but have already forgotten half of it, review before stacking new material on top.
- You have done the work by hand. Configured a network, hardened a server, read a log until you found the problem. Every step on the path assumes more hands-on experience than the last.
- The next exam's objectives make sense to you. You do not need to know them yet, but you should recognize most of the vocabulary. If you do not, the gap is in the step before.
- You know why you want it. A certification that matches the job you are aiming for is worth more than one taken because it came next in a list.
And remember the recommended experience is there for a reason. You can sit Security+ without two years as a security administrator, but you will need to make up for it with lab time and practice exams.
A note on exam language
According to CompTIA, Security+ SY0-801 and Linux+ XK0-006 are delivered in English. If English is not your first language, a mix works well: learn the concepts in the language you think in, then practice with English questions so the wording and the acronyms feel familiar on exam day.
Getting started
- Find your starting point in the table above.
- Read the objectives for the first exam on your path. They are public and tell you exactly what to study.
- Try the format before deciding how much time you need. One practice exam shows you in an afternoon how far you are. If performance-based questions worry you, see the guide to Security+ and Linux+ PBQs.
- Pick a date. Once the exam is booked, studying stops getting postponed.
If your next step is Security+ or Linux+, HacksinCodigos has a 15-day course for each: Security+ and Linux+. A note on language: the courses are taught in Spanish, and the practice exams are in English, like the real exams. Both come with a browser-based lab and practice exams in the real format. You can try the first lesson for free and take the free sample exam before deciding.