CCNA Cybersecurity

When I first heard about Cisco CyberOps Associate, I assumed it was just another networking cert. Then I looked at the objectives and realized Cisco had built something specifically for people who want to work in a Security Operations Center. Not routing tables and switch configurations—actual security operations. Threat monitoring, incident analysis, and the tools SOC analysts use every day.

That cert has a new name now. As of early 2026, it’s officially called CCNA Cybersecurity. If you’ve seen it called CyberOps Associate or Cisco Certified Cybersecurity Associate, those are the same certification—it just went through two rebrands in quick succession. The exam code hasn’t changed, your skills haven’t changed, and the job it prepares you for hasn’t changed. But there are real updates to the content worth knowing about before you start studying.

What Changed and Why It Matters

Cisco kicked off the rebrand on January 21, 2025, when CyberOps Associate was renamed to Cisco Certified Cybersecurity Associate. Then in February 2026, it was renamed again to CCNA Cybersecurity, pulling it into Cisco’s main certification structure alongside the traditional CCNA and CCNP networking tracks. That second rename was actually smart—hiring managers already know what CCNA means, so attaching it to the cybersecurity track gives the cert more immediate name recognition on a resume.

The rebrand wasn’t just cosmetic. Along with the new name, Cisco updated the exam to version 1.2 and added content around AI-powered threat detection, security automation, and zero trust architecture. These aren’t filler topics—they reflect what SOC teams are actually dealing with right now. AI tools are handling a lot of the repetitive alert triage work that junior analysts used to do manually, which means employers want analysts who understand how to work alongside those tools, not just watch dashboards.

If you already hold the CyberOps Associate cert, you don’t need to do anything. Cisco automatically updated existing credentials to reflect the new name. You can grab an updated badge from Cisco’s CertMetrics platform without retaking anything.

What Is CCNA Cybersecurity?

The CCNA Cybersecurity certification validates your skills in security operations center fundamentals. It’s built for entry-level SOC analysts—the people who monitor alerts, investigate incidents, and escalate threats before they become bigger problems.

Unlike Security+ which covers broad security concepts across the whole field, CCNA Cybersecurity is laser-focused on SOC work. You’ll learn security monitoring, host-based analysis, network intrusion analysis, and security policies. The curriculum aligns with real SOC analyst job descriptions, and Cisco’s networking background shows up in a useful way—they know how traffic moves through enterprise infrastructure because their gear runs most of it.

Fun historical footnote: the original article said this cert replaced the older CCNA Cyber Ops. Now it’s literally called CCNA Cybersecurity again. Cisco went full circle, just with updated content and a better fit in their certification framework.

What Does the Exam Cover?

The exam still covers five domains that map to SOC analyst responsibilities. The v1.2 update added AI and automation topics woven throughout, rather than bolting them on as a separate section.

Security Concepts (20%) – Foundational knowledge including the CIA triad, security models, access control, and cryptography basics. This overlaps with Security+ content but frames everything for SOC context. New content here covers AI-driven threat intelligence and how machine learning tools assist analysts.

Security Monitoring (25%) – The core of SOC work. Network and host telemetry, log analysis, SIEM tools, and how to make sense of security data at scale. The updated exam includes AI-assisted monitoring tools and how to interpret their outputs alongside traditional data sources.

Host-Based Analysis (20%) – Understanding what’s happening on endpoints. Operating system fundamentals, endpoint security tools, malware analysis basics, and how attackers compromise hosts. Predictive AI in endpoint detection tools is now part of this domain.

Network Intrusion Analysis (20%) – Reading network traffic to identify attacks. Protocol analysis, common attack signatures, packet inspection, and network forensics. This is where Cisco’s networking heritage shows up the most, and it hasn’t changed much because network traffic fundamentals don’t change.

Security Policies and Procedures (15%) – Incident response processes, vulnerability management, compliance frameworks, and zero trust architecture. Zero trust got a real expansion in v1.2, which makes sense given how many organizations are actively implementing it.

Who Should Get CCNA Cybersecurity?

Same answer as before the rebrand: this cert is ideal if you specifically want to work in a SOC. Not general IT security, not penetration testing, not compliance—SOC analyst work. If monitoring dashboards, triaging alerts, and investigating incidents sounds like your future, CCNA Cybersecurity prepares you for that.

The AI content additions actually make this more relevant now, not less. SOC teams are actively adopting AI-assisted tools for alert correlation and threat detection, and employers want analysts who understand how to work with those outputs. This cert introduces you to that workflow at the entry level.

For students, the CCNA name carries real weight with hiring managers who might not have known what CyberOps Associate was. That’s a legitimate resume upgrade without any extra work on your part if you’re studying for it now.

If you’re undecided about which security path to take, Security+ is still a better starting point for broad coverage. But if you know you want SOC work, CCNA Cybersecurity is the more targeted choice.

Exam Details

The exam code and format stayed the same through both rebrands. What changed is the v1.2 content update — if you’re using older study materials labeled for v1.0 or v1.1, make sure you supplement them with current Cisco resources to cover the AI and zero trust additions.

How I’d Approach Studying Now

The core study approach hasn’t changed, but a few things are worth updating.

Cisco’s official course through Networking Academy is still the foundation. Make sure you’re accessing the current version — the updated v1.2 content is what the exam tests, and older prep materials won’t cover the AI-related topics that are now in scope.

Wireshark is still non-negotiable. Network intrusion analysis is 20% of the exam, and no amount of reading replaces time spent with actual packet captures. I’d grab sample PCAP files from Malware Traffic Analysis and practice identifying what looks wrong before it gets flagged by an automated tool. That context helps you understand what AI detection tools are actually catching.

For the updated content, spend time with the AI and automation topics in the official exam blueprint. You don’t need to be an AI engineer — you need to understand how AI-assisted tools fit into the SOC workflow, how to interpret their alerts, and where human judgment still matters. That’s the framing Cisco uses.

Setting up Security Onion in a home lab is still one of the best things you can do for the security monitoring section. Generate traffic, trigger alerts, and practice investigating them. Real log experience makes scenario-based questions click in a way that flashcards don’t.

The MITRE ATT&CK framework still isn’t explicitly tested, but it’s worth browsing. Understanding how attacks unfold helps you think like an analyst, which is exactly what the exam scenario questions reward.

Test Day Tips

Two hours sounds generous until you’re 60 questions in. Pace yourself — 100-plus questions with scenarios that include log entries or packet captures can move fast. I’d finish flagged questions first and leave review time at the end.

Cisco questions often hide the answer in a specific detail — a timestamp, a port number, a protocol behavior that doesn’t match normal. Read scenario questions carefully. The correct answer is usually in the data they give you, not in general knowledge.

Don’t overthink the straightforward questions. Some of them test basic concepts where the obvious answer is correct. Save your analysis energy for the scenarios.

If a network analysis question has you stuck, think about what normal looks like for that protocol and work backward from there. Anomalies from expected behavior are almost always what the question is testing.

What Comes After

Cisco now has CCNP Cybersecurity as the natural next step — it’s the professional-level track that builds on CCNA Cybersecurity and covers more advanced threat hunting, incident response, and security analysis for experienced SOC analysts moving into senior roles.

CySA+ from CompTIA is still a solid complement. It overlaps in some areas but approaches security analytics from a different angle, and having both shows genuine depth in the analyst space.

If you want to understand the attacker side of things — which makes you a better defender — CEH or PenTest+ give you that perspective without fully committing to a red team career path.

Most SOC analysts eventually branch into incident response, threat hunting, or security engineering. CCNA Cybersecurity gets you in the door. Where you go from there depends on what you find interesting once you’re actually doing the work.

Jenna Carson

Self-taught security pro. No degree, just certs, labs, and a lot of late nights.