CySA+ Pass Rate 2026: CompTIA Publishes No Official Rate

There is no official CompTIA CySA+ pass rate, and unlike most certification bodies, CompTIA has put that refusal in writing. Its exam development policy carries a section headed "CompTIA policy regarding the sharing of pass rates and other confidential exam data," and it ends with a single unambiguous sentence: "it is CompTIA's policy to not disclose pass rates to any external third party." The same page adds that "all of CompTIA's exam content, results data, and analyses are classified as highly confidential" and "are never shared with any external third party." So every percentage circulating in 2026 as "the CySA+ pass rate" was produced by someone who does not have the data. This page is not going to add another one. What CompTIA does publish is exact, and it tells you more about your odds than a pass rate ever would.

How the CySA+ exam is actually scored

CySA+ is a proctored, timed exam that mixes multiple-choice items with performance-based questions (PBQs). CompTIA's published exam details for the CS0-003 series are these:

Exam series code	CS0-003 (CySA+ V3)
Launch date	June 6, 2023
Number of questions	Maximum of 85, a mix of multiple-choice and performance-based questions
Duration	165 minutes
Passing score	750 on a scale of 100–900
Languages	English, Japanese, Portuguese, Spanish
Recommended experience	Network+, Security+ or equivalent knowledge, plus a minimum of 4 years of hands-on experience as an incident response analyst, SOC analyst, or equivalent
Retirement	English exam retires December 22, 2026; translations March 23, 2027

750 is not 83 percent

This is where most "you need X percent to pass" claims fall apart. A scaled score is not a percentage. The CySA+ scale runs from 100 to 900, not from 0 to 100, so a candidate who gets nothing right does not score zero. Divide 750 by 900 and you get 83 percent, a figure repeated across the web as the CySA+ pass mark; measure the same cut across the scale's actual 800-point span and you get roughly 81 percent. Both calculations are arithmetic performed on the wrong quantity, because neither number describes questions answered correctly.

CompTIA describes its exams as criterion-referenced: "Candidates' scores are compared to an established standard or cut score to determine pass/fail status on an exam." Its published details stop at "maximum of 85 questions" — no conversion from raw points to the 100–900 scale is given anywhere. And PBQs do not score like multiple-choice items. CompTIA states that "there can be multiple ways to solve a question or challenge posed in a PBQ" and that "partial credit may be given to virtual PBQs, as it is for simulation PBQs." A scaled score is the output of that machinery, not a tally. Anyone handing you a target number of correct answers is guessing at a conversion CompTIA has never released.

One more official fact that matters in 2026: CS0-003 is no longer the current version. CompTIA launched CySA+ V4 (CS0-004) on June 23, 2026 with the same headline parameters — a maximum of 85 questions, 165 minutes, and a passing score of 750 on a scale of 100 to 900 — and has set the V3 English exam to retire on December 22, 2026, with English learning products retiring November 22, 2026.

Why the pass rates you see online disagree

Search for the CySA+ pass rate and one results page will hand you figures that cannot all be true at once. What they share is not a source but the absence of one: none of them cites CompTIA, because the only official document on the subject is the policy page that declines to release the number.

The incentives behind the spread are easy to read once you look for them. A training provider that tells you CySA+ has a punishing failure rate has just explained why you need its course. A bootcamp advertising a high pass rate among its own graduates has measured a self-selected group who already paid for training and sat the exam when their instructor said they were ready. Both figures can be honest inside their own population and still say nothing about a stranger's odds, because neither population is a random sample of CySA+ candidates.

Version churn adds a second layer of noise that is specific to CompTIA. An article headlined "CySA+ pass rate" may be describing CS0-003, CS0-004, or a version retired before either — different exams, with different objectives, written years apart. A claim made about a freshly launched CS0-003 in 2023 and a claim made after the June 23, 2026 launch of CS0-004 are not measuring the same test, but on a search results page they look interchangeable, and almost none of them name an exam code at all.

There is also a structural reason a CySA+ pass rate would not help you even if it existed. CompTIA states that its exams "do not attempt to measure a person's knowledge and skills when compared to other similar cohorts or groups of individuals (norm-referenced exams)." There is no curve. No one else's performance moves your result, and no share of the cohort is destined to fail. You are measured against a fixed standard of minimal competence in the job role, which means the only variable that matters is whether you clear it.

What separates passing from failing candidates

The domain weights are published, and they are where a study plan should start. They also shifted between versions:

Domain	V3 (CS0-003)	V4 (CS0-004)
Security operations	33%	34%
Vulnerability management	30%	26%
Incident response and management	20%	24%
Reporting and communication	17%	16%

• Two domains carry nearly two-thirds of V3. Security operations and vulnerability management together account for 63 percent of CS0-003. A candidate weak in either one is trying to pass on the remaining third.
• Reporting and communication is the domain people skip. At 17 percent it is roughly one question in six, and it is the least technical material on the exam — which is exactly why analysts who live in a SIEM console leave those marks on the table. CompTIA kept it at roughly the same weight in V4, so it is not going away.
• PBQs are the clock risk. CompTIA warns candidates before a virtual PBQ that the item cannot be skipped and returned to, and advises completing it to the best of your ability before moving on. Because partial credit is available, an imperfect attempt is worth more than a blank — but a perfectionist attempt early in the exam can cost you the multiple-choice items at the end.
• The experience bar is genuinely high. CompTIA recommends Network+, Security+ or equivalent knowledge plus a minimum of four years of hands-on work as an incident response or SOC analyst. Candidates who fail are very often the ones who treated a recommendation written in years as a recommendation written in study hours.
• A retake is not free. CompTIA requires no waiting period between the first and second attempt, but you must wait at least 14 calendar days before a third or any subsequent attempt, and the policy is explicit that "candidates must pay the exam price each time they attempt the exam. CompTIA does not offer any free re-tests or discounts on retakes."

The bottom line

Nobody outside CompTIA knows the CySA+ pass rate, and CompTIA has stated in policy that nobody outside CompTIA will. What is official and checkable is that CS0-003 gives you a maximum of 85 questions in 165 minutes and requires 750 on a 100–900 scale, that the scale is criterion-referenced rather than a percentage correct, that security operations and vulnerability management make up 63 percent of the exam, and that the English V3 exam retires on December 22, 2026. Those facts change how you study. A pass rate would not change a single decision inside a study plan, which is why its absence is not the gap in your research it appears to be.

The useful next move is finding out which of those four domains actually costs you marks, before you pay for a seat you have to pay for again. Work through a free CompTIA CySA+ practice test and let your own weak domain tell you where the 165 minutes should go.