Cybersecurity Certifications: Which Ones, In What Order

For most beginners aiming at a SOC or general security role, CompTIA Security+ is the safest first exam because job ads name it most often (about US$425–439 voucher (CompTIA does not publish it on the cert page; V7 current; V8 expected ~17 Nov 2026), checked October 2026). ISC2 Certified in Cybersecurity is cheaper (about US$199 exam + US$50/yr maintenance (secondary listings; free programme closed 20 May 2026; confirm with ISC2)) and gentler. Cisco CCST Cybersecurity is US$125 exam. Choose by target role and budget.

It is a structured beginner course from Google on Coursera and a reasonable way to learn the basics. It is not an exam-based industry certification like Security+, so job ads that name an exam will not treat it as equivalent. Coursera lists US$49 a month in the US and Canada after a 7-day free trial, estimates most learners pay under US$300 in total, and says it takes under 6 months at under 10 hours a week (coursera.org, checked 3 November 2026). Financial aid is available. Check Coursera for the current price.

CISSP is the standard senior generalist credential and is named in many security manager, architect and consultant ads. ISC2 requires five years of cumulative paid experience in two or more of the eight domains (a degree or approved credential can waive up to one year). Without it you can pass the exam and become an Associate of ISC2, which gives six years to earn the experience, and an exam fee of about US$749 exam (secondary listings; confirm with ISC2). It is not an entry-level exam. Confirm current requirements on the ISC2 site.

Security+ for the foundation, then CySA+, Cisco CyberOps Associate, Blue Team Level 1 or Microsoft SC-200 for SOC work, and GIAC GCIH or GCIA later. The roadmap orders these by your budget and hours per week.

No widely recognised exam is free now: ISC2 closed its free CC exam programme to new participants on 20 May 2026. Free preparation courses and badges exist (Cisco Networking Academy, IBM SkillsBuild, Fortinet NSE 1 and others in the learning library). The free-certifications post tracks what is still free.

Our planning estimate is about 80 hours of self-study for someone starting from the right level, which is roughly 4 to 5 months at 5 hours a week. This is an estimate, not an issuer figure, and varies with your IT background.

Not strictly, but they often get you past automated and recruiter screening, especially at entry level. Employers weigh them alongside practical proof. One well-chosen certification plus hands-on work beats several certificates with no practice.

Most major certifications need ongoing fees and continuing education credits, for example ISC2 CC carries an annual maintenance fee (about US$50 per secondary listings; confirm with ISC2) and CompTIA, ISC2, ISACA and GIAC certifications have renewal cycles. Rules change, so check the issuer before you commit.