What the course covers
About this course map
Four domains, mapped one-for-one to the CompTIA CySA+ CS0-003 exam objectives and taught in the same order, so nothing on the exam is left uncovered.
This course targets CS0-003, which remains a live exam. CompTIA has since published CySA+ V4 under exam code CS0-004, and lists CS0-003 as retiring on 22 December 2026 in English, later in Japanese, Portuguese and Spanish. If you intend to sit CS0-003, book it against that date. If you would rather sit V4, ask us and we will run the V4 map instead.
What defines CS0-003 is the decision to describe the analyst job as a workflow rather than a toolset. Two thirds of the exam sits in security operations and vulnerability management, and a full sixth of it is about writing and saying things clearly — the reporting domain is not a footnote here. Each domain below carries its published weighting, and we give it classroom time in proportion.
Domain 01 — Security Operations
The daily work of a monitoring analyst: knowing what normal looks like well enough to spot what is not. 33% of the exam.
Domain 02 — Vulnerability Management
Finding weaknesses is straightforward. Deciding which ones matter, and getting them fixed, is the job. 30% of the exam.
Domain 03 — Incident Response Management
What you do between the alert and the all-clear, and how you make the next one cheaper. 20% of the exam.
Domain 04 — Reporting and Communication
The domain that decides whether any of the previous three produce a result. 17% of the exam.
Who should take this
Security operations centre analysts, incident responders, threat hunters, vulnerability analysts, and network or system administrators moving into a defensive security role. It also suits developers and cloud engineers who are being asked to own detection and remediation for their own services.
CompTIA recommends Network+ and Security+ or equivalent knowledge, and around four years of hands-on experience as an incident response or security operations analyst. These are recommendations, not requirements — nothing gates you from sitting the exam, and we regularly teach candidates with less time served but a strong operational background.
You will need solid networking and operating system knowledge and comfort at a command line. Prior scripting experience helps but is not assumed.
The exam
CySA+ is set and awarded by CompTIA.
CompTIA does not publish how much of the paper is performance-based, so plan to meet those questions anywhere in it. The exam voucher is purchased separately from CompTIA; we arrange it on your behalf and send you the code, and you book your own exam date.
How we deliver it
Five days, classroom or online live, or at your office for a private group. Roughly half the time is spent in front of real telemetry — logs, captures and scan output from an estate we have compromised on purpose — rather than in slides. Domain checkpoints each day, and a full-length mock under exam conditions on the final afternoon.
Mapped to the CompTIA CySA+ CS0-003 exam objectives. Taught from Hacky Security's own curriculum and lab estate by instructors who work our security operations centre.
Exam & certification
- 1Train with us40 hours of instructor-led preparation, labs and practice questions.
- 2Sit the official examExam voucher sold separately. We buy it from the certification body on your behalf and send you the code — you book your own exam date.
- 3Get certifiedThe certification is awarded by CompTIA when you pass their exam.
What you receive
- CompTIA certification — issued by CompTIA after you pass, and verifiable with them.
- Hacky Security certificate of completion — for the training itself, with a unique ID.
- Checkable by employers — anyone can confirm our certificate on the Verify page.
This course is Hacky Security’s own preparation training. The certification itself is awarded by CompTIA, not by us.
Similar courses
Hacky Security is a CompTIA Authorized Partner. This course is delivered from Hacky Security's own curriculum; the certification itself is awarded by CompTIA. Certification names and codes are the trademarks of their respective owners and are used only to describe what this course prepares you for.
