Safety Center
Cybersecurity Certifications: Which First?
Certifications help your CV get read — but the wrong one at the wrong time wastes money and months. This guide orders the common certifications by career stage, explains what each one actually proves, and links to the issuers for current fees and syllabuses.
Try the tool: Certification Path Picker
How to choose: a simple rule
Choose by the job you want next, not by the certificate that sounds most impressive. A SOC analyst and a penetration tester and a governance analyst need different proof, and employers know it. The rule: one broad foundation certificate first, then a specialist certificate matched to your direction, and only then an advanced one. Collecting advanced certificates before you have the experience they assume signals poor judgement, not ambition.
Stage 1: foundation (first certificate)
CompTIA Security+ is the default first certification for a reason: it covers threats, architecture, operations, incident response and governance at foundation level, it is vendor-neutral, and it is widely listed in entry-level job adverts. It is a multiple-choice exam, so it proves knowledge rather than hands-on skill — which is fine at this stage, because the hands-on proof comes from your labs and portfolio.
Alternatives at this stage include CompTIA Network+ if your networking is weak (take it before Security+ if you need the foundation), and entry-level cloud certificates if you are targeting cloud roles. Google's Cybersecurity Certificate and similar beginner programmes can also build foundation knowledge, but treat them as learning, not as a replacement for Security+ in job adverts that name it.
A note on versions: Security+ exam versions change over time — SY0-701 is the version in use during 2026, with a successor expected around late 2026 according to secondary sources. Verify the current version on CompTIA's own site before booking, and make sure your study material matches it. Last checked: 14 November 2026.
Stage 2: direction (pick one path)
- Defence / SOC: vendor training in the SIEM your target employers use, plus blue-team practical courses. The SIEM name on your CV matters more here than another general certificate.
- Offensive / testing: a practical, hands-on penetration-testing certification from a recognised training provider — one that requires you to demonstrate skills in a lab, not only answer questions. See our penetration-testing guide.
- Cloud: the associate-level security certificate from your target cloud provider (AWS, Azure or Google Cloud), after the foundation cloud certificate.
- Governance / risk: ISACA's CISA or CRISC, or CompTIA's governance-oriented material, depending on the market you are in.
- Threat intelligence: SANS FOR578 or the GIAC Cyber Threat Intelligence (GCTI) certification, usually after SOC experience — threat intelligence is rarely an entry-level destination.
Stage 3: advanced (later, with experience)
CISSP (ISC2) is the best-known advanced certification, aimed at experienced security professionals and managers. It requires five years of cumulative paid experience in at least two of its eight domains — or four years with a recognised degree — and you must be endorsed by another CISSP holder. Passing the exam without the experience makes you an Associate of ISC2, not a CISSP. That is a respectable stepping stone, but do not present it as the full credential.
CISM (ISACA) is the management-oriented equivalent, aimed at people who manage and govern security programmes. CEH (EC-Council) sits between foundation and advanced: it covers ethical-hacking concepts and tools, and is sometimes listed in job adverts, but employers increasingly prefer practical testing certifications over it for hands-on tester roles. OSCP-style practical certifications occupy the hands-on end of this stage and carry strong weight with testing employers precisely because they are hard to pass without real skill.
What each popular certificate actually proves
Security+ proves broad foundation knowledge. Network+ proves networking foundation. CEH proves familiarity with hacking concepts and tools at a theory level. CISSP proves broad, experienced, management-level knowledge across eight domains. Practical testing certificates prove you can find and exploit weaknesses in a lab under time pressure. Cloud security certificates prove you can secure a specific cloud platform. None of them proves you can do the day-to-day job alone — that proof comes from work and labs, which is why every certification on this page is paired with the advice to build a portfolio.
Money, expiry and honest budgeting
Certification is expensive, and the exam fee is only part of the cost: study material, practice exams and retakes add up. This site does not publish exam fees because they change and sources conflict — Security+ alone has been reported at several different prices across sources. Before you commit to any certificate, check three things on the issuer's own website: the current fee, the current exam version and syllabus, and the renewal rules. Then budget for the possibility of a retake. A failed first attempt is normal and says nothing about your ability; it says you need more practice on specific domains.
Last checked: 14 November 2026. Exam fees, versions and experience requirements change. Always verify on the issuer's website — CompTIA, ISC2, ISACA, EC-Council or the cloud provider — before booking.
The order, summarised
- Build networking and operating-system foundations first — a certificate cannot substitute for them.
- Take Security+ (or Network+ first if your networking is weak).
- Get a job or a serious lab routine: help desk, junior SOC, or structured lab practice with written reports.
- Choose your direction and take one specialist certificate matched to it.
- Only then pursue advanced credentials such as CISSP, with the experience they require.
If you follow that order, each certificate will mean something to the person reading your CV — because it will sit next to real work that proves it.
A study plan that actually works
Pick one exam, set a date two to three months out, and study in short daily sessions rather than weekend cramming. Work through the official exam objectives line by line, and for each objective write one paragraph in your own words plus one example from your lab. Take practice exams only after you have covered the syllabus once — a practice test taken too early measures guessing, not knowledge. When you score consistently above the pass mark on two different practice sets, and you can explain every wrong answer, you are ready to book.
Study with others if you can. A small study group, a forum thread, or a colleague preparing for the same exam will expose the gaps your own notes hide. Teaching an objective to someone else is the fastest test of whether you understand it: if you cannot explain it simply, you do not yet know it well enough to be examined on it.
Red flags in certification marketing
- 'Guaranteed pass' promises: no legitimate provider can guarantee a result. The promise itself is the warning.
- 'Get hired in 90 days' bundles: a certificate plus a job promise is a sales package, not a career plan. Employers hire on work, not on bundles.
- Outdated material: if the study guide's exam version does not match the issuer's current version, do not buy it. Check the version on the issuer's site first.
- Certificate mills: a certificate that requires no study, no exam, and no evidence is worth nothing to an employer — and listing it damages your credibility.
Sources
- CompTIA Security+ — issuer certification page
- ISC2 CISSP — experience requirements and domains
- ISACA — CISM and CRISC certification information
- NIST NICE Framework — work roles and competencies
- Research methodology — how this guide was researched
Frequently asked questions
Which cybersecurity certification should I get first?
For most beginners, CompTIA Security+ is the standard first certification: broad, entry-level, and recognised by many employers and government hiring frameworks. It proves foundation knowledge, not specialist skill.
Is CompTIA Security+ worth it with no experience?
Yes, as a first step. It helps your CV pass initial screening for help-desk, junior SOC and entry-level security roles. On its own it does not make you a penetration tester or a senior analyst — it opens the door, and lab work walks you through it.
Should a beginner get CEH or CISSP?
Usually not first. CEH is a mid-level ethical-hacking certification that assumes foundation knowledge, and CISSP requires five years of relevant experience (or four with a degree) before the full credential is awarded. Both have their place later; neither is a beginner's first certificate.
How much does Security+ cost?
This site does not publish a fee, because reported fees conflict across sources and CompTIA changes pricing and exam versions. Check the current fee on the CompTIA website before booking. Last checked: 14 November 2026.
Do certifications expire?
Many do. CompTIA certifications are typically valid for three years and require continuing education or re-examination to renew; ISC2 certifications have their own continuing-education requirements. Check the issuer's renewal rules before you commit.
Can certifications replace experience?
No. They complement experience and lab evidence. A certificate plus a portfolio of documented work is strong; a certificate alone, with nothing to show, is weak in interviews.