CompTIA Security+ SY0-801: What Actually Changed from SY0-701 (Final Objectives)

Jay — Mon, 09 Nov 2026 02:16:23 +0000

CompTIA Security+ SY0-801: What Actually Changed from SY0-701 (Final Objectives)

The new Security+ exam, SY0-801, launches on or around November 17, 2026. If you have been reading "what's new" roundups to decide which version to take, here is something worth knowing: most of them were written against the draft objectives that circulated earlier this year. The final objectives (Version 2.0) tell a slightly different story, and a few of the "new topics" those articles list are not on the exam at all.

This piece is built from the final objectives. Here is what changed, what did not, and how to choose.

First, the decision that matters less than you think

Passing SY0-701 or SY0-801 earns the same credential: CompTIA Security+, valid for three years. Employers ask for "Security+", not an exam code. The format is identical too: up to 90 questions, mixed multiple choice and performance-based, 90 minutes, 750 to pass on the 100-900 scale.

SY0-701 stays bookable in English until June 11, 2027. That gives you a seven-month overlap window. The practical rule:

Test-ready before about March 2027: take SY0-701. Mature study material, known question style, and a pass is a pass. Do not burn the overlap window "upgrading" to 801 for prestige.
Starting fresh now and testing in spring 2027 or later: prepare for SY0-801. Booking 701 close to the retirement date risks a retake landing after June 11, 2027, which would have to be on the new exam anyway.

Either way, roughly four questions in five on SY0-801 cover ground SY0-701 covered. Every hour you spent on a 701 guide transfers.

What actually changed

The domain weights all moved. This is the single most important change, because it tells you where to spend study hours:

Domain	SY0-701	SY0-801
1. General Security Concepts	12%	16%
2. Threats, Vulnerabilities, and Attacks	22%	24%
3. Security Architecture	18%	19%
4. Security Operations	28%	27%
5. Security Program Management and Oversight	20%	14%

Domain 2 got a new name (it was "Threats, Vulnerabilities, and Mitigations") and more weight. Domain 1 grew by a third. Domain 5 took the biggest cut, from a fifth of the exam to 14%. If you studied 701, you probably over-know governance relative to its new weight. Reallocate those hours to Domains 1 and 2.

AI is the headline new content. Objective 2.6, "Summarize threats and vulnerabilities associated with artificial intelligence (AI) usage," is the flagship addition. The named topics: model poisoning, evasion, prompt injection, jailbreaking, data loss and privacy leakage, session hijacking, unintended code execution from AI output, bias, hallucinations, and explainability. For each term, learn the symptom, the term, and the countermeasure. A chatbot tricked into revealing its system instructions is prompt injection. A model trained on scraped data giving biased advice is training-data bias. This is the highest-yield new topic on the exam.

AI shows up in operations too. Objective 4.6 names agentic AI, chatbot interfaces, predictive analysis, and AI-augmented baselines, and it names the counterweight you will be tested on: guardrails, the constraints placed on automated and AI-driven processes so they cannot exceed their authority. Expect scenario questions where the wrong answer is "let the AI handle it" and the right answer names the approval step or the human review.

Large language models are a named attack surface. Objective 2.4 lists LLMs alongside shadow IT, public repositories, rogue devices, and unmanaged credentials. Know it in both directions: the model can be the target (training data, prompts, weights) and part of your attack surface when you deploy one.

Smaller additions worth knowing: compensating and directive controls join the control-types list in Domain 1 (the classic exam angle is a scenario where the ideal control cannot be applied, which points to a compensating control). Group Managed Service Accounts (gMSAs) and privilege creep are named under identity. Security Service Edge (SSE) appears in the architecture domain. Negotiation is now a named incident-response phase, which means ransomware and extortion scenarios can test process, not just technology.

What did NOT change (and the draft rumors that died)

Several topics that appeared in draft-objective roundups do not appear in the final objectives. Do not study these as new exam topics:

SASE: not named. (Security Service Edge, SSE, is named. Related concept, different term, and only one of them is on the exam.)
SD-WAN: not named.
Container security: not named as a standalone topic.
Blockchain: not named.
ABAC (attribute-based access control): not in the access-control models list. The final list is rule-based, role-based, time-based, mandatory, discretionary, and just-in-time.

If a "what's new in 801" article you read lists these, it was written from the draft. File them under nice to know, not exam-critical.

What carries over unchanged is the bulk of the exam: cryptography and PKI, network and host defenses, SIEM and logging, identity fundamentals (federation, SSO, MFA, passkeys), vulnerability management, the incident response lifecycle, governance and risk math, and data protection. If you can explain each in a sentence from memory, your 701 study transfers directly.

The study plan in one paragraph

If you hold SY0-701 already, you are done; it is valid for three years and renews the same way. If you are mid-study on 701, finish and take 701. If you are starting fresh for a 2027 test date, study a 701 guide for the 80-90% overlap, then layer on the delta: every AI term and its mitigation, AI-assisted operations and guardrails, the named architecture models (serverless, multicloud, IaC, OT, air-gapped, microservices), the new control types, and the reweighted domains.

Want the practice questions?

We put together a free 25-question SY0-801 sampler drawn from the final objectives, built for the new exam version. It is free on our Gumroad store, and downloading it puts you on the list for launch-week updates on the full SY0-801 study guide:

Free SY0-801 sampler: https://bit4bitdfir.gumroad.com/l/inlhbv

CompTIA, Security+, SY0-701, and SY0-801 are trademarks of CompTIA, Inc. This is an independent study aid, not affiliated with or endorsed by CompTIA. Practice content is written from the published objectives for study purposes; it contains no actual exam questions.

DEV Community: Jay

CompTIA Security+ SY0-801: What Actually Changed from SY0-701 (Final Objectives)

CompTIA Security+ SY0-801: What Actually Changed from SY0-701 (Final Objectives)

First, the decision that matters less than you think

What actually changed

What did NOT change (and the draft rumors that died)

The study plan in one paragraph

Want the practice questions?