If you already have SY0-701 notes, you do not need to start over for Security+ SY0-801. By our count, 25 of the 27 SY0-801 objectives map to an SY0-701 objective; you mainly add seven topic groups and practise the three topics that became scenario-based.
What stays the same?
The exam shell is unchanged: a maximum of 90 questions, 90 minutes, and 750 to pass on a 100–900 scale. The five domains keep their order, and Domain 2 is renamed from "Threats, Vulnerabilities, and Mitigations" to "Threats, Vulnerabilities, and Attacks".
V8 launches on November 17, 2026, according to the V8 launch details CompTIA publishes. SY0-701 stays open in English until June 11, 2027.
Which seven topic groups should you add?
Think of this as the diff between your SY0-701 notes and the SY0-801 objectives.
- AI threats (2.6): prompt injection, poisoning, jailbreaking, hallucinations, model manipulation, evasion and more.
- New attack surfaces (2.4): large language models, identity providers, public repositories and public object storage.
- New vectors (2.3 and 2.5): RCS messages, collaboration tools, QR codes, quishing and deepfakes.
- Threat intel basics (2.1): threat feeds, likelihood, impact, CVSS, CVE and prioritization.
- Modern identity (4.5): passkeys, passwordless sign-in, password managers and compromised credential monitoring.
- AI in automation (4.6): agentic AI, chatbots, predictive analysis, AI-augmented baselines and guardrails.
- Deception technology (4.1): honeypots, honeynets, honeyfiles, honeytokens and canary accounts.
The AI group is the biggest change. If prompt injection and poisoning are new to you, start with a plain-English breakdown of the 13 AI threats in objective 2.6.
Which objectives became hands-on?
SY0-801 has nine objectives that start with "Given a scenario", up from seven in SY0-701. Three changes matter most for study time.
| Topic | SY0-701 verb | SY0-801 verb |
|---|---|---|
| Change management | Explain (1.3) | Given a scenario, demonstrate (1.2) |
| Vulnerability management | Explain (4.3) | Given a scenario, perform tasks (4.3) |
| Automation and orchestration | Explain (4.7) | Given a scenario, apply (4.6) |
Mitigation techniques also moved. They were an "explain" objective in SY0-701 Domain 2 (2.5). In SY0-801 they become Domain 4 objective 4.1, "Given a scenario, apply mitigating controls, techniques, and solutions".
What does not need new notes?
Cryptography, architecture, incident response and the governance objectives carry over with small updates. One rumour to ignore: the official objectives do not mention post-quantum cryptography, so do not spend time on it for this exam.
Still deciding which version to sit? The full SY0-801 vs SY0-701 comparison with a take-it-now-or-wait table lays out the official dates, the domain weights and a decision table by situation.
If you are still on SY0-701, this EduSum video covers the current exam's domains and three sample questions:
When you want to test yourself under real conditions, SY0-701 practice tests in the 90-question, 90-minute format show which domains still need work.
Frequently Asked Questions
1. Can I use SY0-701 study material for SY0-801?
Mostly, yes. By our mapping, 25 of the 27 SY0-801 objectives have an SY0-701 counterpart. Add the seven topic groups above.
2. Which SY0-801 objective is completely new?
Objective 2.6, which covers threats and vulnerabilities in AI usage.
3. How many scenario-based objectives does SY0-801 have?
Nine, compared with seven in SY0-701.
Top comments (0)