SecurityX, formerly known as CASP+, is CompTIA’s expert-level security certification. It tests whether you can design, build and run security for large enterprises. CISSP covers management and governance. SecurityX stays hands-on and technical. It suits senior practitioners who want to stay technical instead of moving into management.
I have used SecurityX to vet people for technical roles that need advanced security knowledge. It sits between tiers. It proves skills beyond Security+ and CySA+ without the management focus of CISSP.
What Is CompTIA SecurityX?
The CompTIA SecurityX certification targets security architects, senior security engineers, and technical leads who implement enterprise security solutions.
SecurityX is vendor-neutral, meaning the concepts apply regardless of specific products or platforms. The exam tests how you analyze requirements, assess risk and design solutions. It doesn’t test product-specific settings.
CompTIA recommends ten years of general IT experience with five years of hands-on security experience. There are no mandatory prerequisites. Without real experience, though, you’ll probably fail. The exam assumes you have already mastered Security+ and CySA+ level content.
The certification satisfies DoD 8570/8140 requirements for IAT Level III and IAM Level II positions. Few technical certs meet senior-level requirements and still stay hands-on.
What Does the Exam Cover?
The current exam is CAS-005. It covers four domains:
Security Architecture (29%): Designing secure networks, systems, and applications. Analyzing requirements, selecting controls, and integrating security into enterprise architecture.
Security Operations (30%): Advanced security monitoring, incident response, and vulnerability management. Implementing and managing security operations at scale. This domain goes beyond CySA+ into enterprise-level operations.
Security Engineering and Cryptography (26%): Implementing security solutions, applying cryptographic concepts, and integrating security technologies.
Governance, Risk, and Compliance (15%): Understanding risk frameworks, compliance requirements, and policy development. CISSP puts more weight on governance. SecurityX still tests the basics of GRC.
Who Should Get SecurityX?
SecurityX is for senior security practitioners who want to validate expert-level technical skills.
Some employers value technical depth, and SecurityX shows you have it.
CISSP meets many of the same senior DoD requirements. Pick the one that fits whether you want a technical or management focus.
CISSP is broader and includes management, governance, and strategic thinking. SecurityX is deeper technically but narrower in scope. Many senior professionals hold both, using CISSP for breadth and SecurityX for technical depth.
Exam Details
- Exam Code: CAS-005
- Number of Questions: Up to 90
- Question Types: Multiple choice and performance-based
- Time Limit: 165 minutes
- Passing Score: Pass/Fail (no scaled score)
- Cost: $510 USD
There’s no scaled score. You either pass or fail. Performance-based questions ask you to work through a scenario instead of picking from a list.
Preparation Approach
Start with real hands-on experience, then add structured study. Reading alone won’t get you through this exam.
Review the official exam objectives and honestly assess your experience against each domain. Spend extra time where you lack hands-on experience. Use lab work, or look for chances at work to get exposure.
Enterprise architecture concepts feature prominently. Understand how security integrates with network design, cloud architecture, and application development. Study zero trust architecture, microsegmentation, and modern security design patterns.
You need more than a conceptual grasp of cryptography. You should be able to select appropriate algorithms, understand key management, and identify cryptographic weaknesses in given scenarios.
Risk assessment at the enterprise level requires understanding frameworks and applying them to complex scenarios. Review NIST SP 800-30 and practice applying risk concepts to organizational situations.
Practice tests from Kaplan IT Training and other providers help calibrate readiness. Wait until you score well on practice tests every time before you book the exam.
Test Day Execution
Performance-based questions require careful analysis. Read scenarios completely before attempting solutions. These questions test how you apply what you know to a messy real situation.
Time management matters across 165 minutes with up to 90 questions. Some performance-based questions take significantly longer than multiple choice. Budget your time, and don’t get stuck on any one question.
Think like a senior practitioner. Questions assume you have experience and ask what you would do in realistic scenarios. Draw on your professional experience when reasoning through answers.
When answers seem equally valid, consider which response best addresses the complete scenario. SecurityX tends to reward the answer that fixes the whole problem over a narrow patch.
What Comes After SecurityX?
What comes next depends on where you want to take your career.
If you want a management credential, add CISSP. It covers governance and leadership.
Cloud security certifications add platform-specific depth. AWS Security Specialty, Azure AZ-500 or CCSP extend your skills into the cloud.
Specialized certifications in areas like penetration testing (OSCP), incident response (GCIH), or forensics (GCFE) add depth in specific technical domains.
Common next roles for SecurityX holders are principal engineer, security architect and technical director. The cert gets you considered. Your work decides how far you go.
SecurityX requires renewal every three years through continuing education.
Retired Army Chief Warrant Officer. Twenty years in cyber ops. Now in government consulting.