Cybersecurity Certification Guide: Roadmap, Best Certs, Costs & Pay (2026)

No single exam makes you a security professional. The credentials you’ll see in job posts fall into a few groups, and knowing the difference keeps you from spending money on the wrong type. Employers tend to read each group differently, so it helps to know what each one signals.

• Knowledge exams - test whether you understand concepts, tools, and rules. Security+, CySA+, and ISC2’s Certified in Cybersecurity work this way.

• Hands-on exams drop you in a lab with a clock. eJPT, PNPT, and OSCP work this way.

• Vendor-specific exams - prove skill on one platform, such as Microsoft’s SC-200 for Sentinel and Defender.

• Professional and management credentials - (CISSP, CISM, CISA, CRISC) prove judgment built on years of experience.

A knowledge exam gets your résumé noticed. A hands-on exam gives you something to talk about in the interview. Most careers end up with both.

Not always, but it helps most when your résumé has no security jobs on it yet. The U.S. Bureau of Labor Statistics notes that employers may prefer to hire analysts who hold professional certification. It also says information security analysts typically need a bachelor’s degree, though some people enter with a high school diploma plus relevant training and certifications.

For defense work, certifications can be a formal requirement. The DoD’s DoDM 8140.03 qualifies personnel by work role and requires certifications to be accredited to ISO/IEC 17024.

BLS doesn’t track every cybersecurity job separately. For information security analysts, the median pay was $129,180 in May 2025. The lowest-paid 10% earned under $75,090, and the top 10% earned over $199,850. Employment is projected to grow 21% from 2025 to 2035. Treat those figures as a rough map, and check job posts in your area for the real numbers.

Here’s the whole path in one place so you can see how the pieces fit before we go stage by stage. Think of the stages as levels, not strict rules. Plenty of people skip Stage 1, and the lane you choose in Stage 3 decides most of what comes next. Fees are list prices from October 2026, and “experience” means formal requirements unless it says “recommended.”

There’s no single best certification, only the best one for the job you want and the place you’re starting from. The fastest way to choose is to match your goal to a lane, then read the dedicated guide for that lane. Most readers fit one of these rows.

If you’re still deciding whether a lane fits, our guides to GRC analyst roles, ethical hacker roles, and penetration tester roles show the day-to-day work.

You don’t have to start with the hardest exam. These steps build vocabulary and confidence, and every one of them is optional. If you already work in IT, skip most of them. If you’re brand new, one or two make Stage 2 much easier. They’re also the most useful entry-level cybersecurity certifications for people with no security background.

1. CompTIA Network+ (N10-009): is worth it if networking is your weak spot. Network+ allows a maximum of 90 questions in 90 minutes, with a passing score of 720, and costs $399. CompTIA estimates its retirement in 2027.

2. ISC2 Certified in Cybersecurity (CC): needs no experience. ISC2’s CC page lists it as ISO/IEC 17024 accredited and approved under DoDM 8140.03. The exam costs $199, and ISC2 closed its free-exam program on May 20, 2026.

3. EC-Council Ethical Hacking Essentials (112-52): suits people leaning toward offense. The course has no prerequisites, a 75-question two-hour exam, and 47 labs, all for $299.

4. ISACA IT Risk Fundamentals: suits people leaning toward GRC. It’s a certificate, not a full certification, with a two-hour online exam and no prerequisites.

What this stage means for your pay

A foundation certificate won’t raise your pay by itself. Its job is to help you land your first technical role. BLS notes that many analysts come up through IT departments, often as network and systems administrators. For context, BLS lists 2025 median pay of $62,890 for computer support specialists and $99,130 for network and computer systems administrators.

Stage 2 is where your path starts to look like a job. You’ll take one broad exam that almost every security employer recognizes, then, if you can, one hands-on exam that shows you can use real tools. Neither requires prior experience on paper, though both reward lab time.

1. CompTIA Security+ (SY0-701): is the common gateway. CompTIA lists a maximum of 90 questions in 90 minutes (multiple-choice and performance-based) and a 750 passing score on a 100–900 scale. It also lists DoD 8140 work roles, including cyber defense analyst and vulnerability analyst. The fee is $439. CompTIA recommends Network+ and two years of experience as a security or systems administrator, but doesn’t require them. For prep, CompTIA’s own CertMaster Learn+Labs is estimated at 30 to 60 hours, plus 10 to 20 for practice. Security+ teaches concepts, not tool skills, so pair it with lab time.

2. INE eJPT: is the friendliest hands-on exam. INE built it for people with little or no cybersecurity experience, and it simulates real work: finding hosts, exploiting weaknesses, and testing a web app. The voucher lasts 180 days, a failed attempt gets one free retake within 14 days, and a pass is valid for three years. Third-party sources put it at about $249.

What this stage means for your pay

With Security+ behind you, you can apply for junior security roles. BLS doesn’t publish an entry-level figure for these jobs. Its lowest tier, the bottom 10% of information security analysts, earned under $75,090 in May 2025, which gives you a rough picture of the floor. Where you land depends on your city, industry, and the hands-on proof you can show.

This is where you choose a lane. The certifications below ask for experience (formal or recommended), so most people earn them after a first role. Each lane has a deeper guide linked above, so here you get the essentials and a way to compare.

SOC lane

1. CySA+ (CS0-004): is CompTIA’s analyst-focused step above Security+. CompTIA says V4 is the new version, and the English V3 exam retires December 22, 2026, so start on V4. It costs $439, and CompTIA recommends about four years of experience.

2. Microsoft SC-200: fits teams built on Sentinel and Defender, and it tests KQL threat hunting. Microsoft’s study guide notes that associate certifications expire annually, with a free renewal. Third-party sources put the fee at $165.

For practical proof, TCM’s PSAA is a hands-on SOC analyst exam.

GRC lane

1. CGRC: suits framework and compliance work. ISC2’s CGRC has 125 questions over three hours, and third-party sources put the fee at $599. It needs two years of experience, but you can pass first and become an Associate of ISC2 for three years while you earn it.

2. CRISC: suits IT risk work. ISACA’s CRISC costs $575 for members and $760 otherwise, plus a $50 application fee, and asks for three years of experience.

3. CISA: suits audit work. ISACA’s CISA asks for five years of experience, with up to three waivable.

Offensive lane

1. CEH v13 (312-50): is EC-Council’s flagship. The knowledge exam has 125 multiple-choice questions over four hours. You qualify through official training (from $1,699) or two years of experience plus a $100 application fee. EC-Council says it’s approved for DoD roles such as Cyber Defense Analyst and Vulnerability Assessment Analyst. It’s a knowledge exam, so pair it with something hands-on.

2. CompTIA PenTest+ (PT0-003): is a broad exam that includes reporting. CompTIA recommends three to four years in a penetration tester role, and the fee is $439.

3. PNPT: is a five-day practical exam plus a live report debrief, $499 with training. TCM recommends that people without professional hacking experience start with its PJPT first.

4. OSCP (PEN-200): is the toughest proof of hands-on skill. OffSec’s exam is a proctored 24-hour practical, followed by 24 hours for the report, and the course bundle runs roughly $1,650 to $1,750.

What this stage means for your pay

At this level you own assessments instead of assisting. The BLS median for information security analysts was $129,180 in May 2025. Industry matters: BLS lists medians of $138,650 in the information industry, $132,410 in computer systems design, and $130,630 in finance and insurance. BLS doesn’t tie pay to any specific certification, so use job posts in your area to see what your target employers pay.

These credentials sit later in a career and are built on years of experience. Most readers can leave them off their list for now, but it helps to know where the path leads. Several of them let you pass the exam first and earn the experience afterward, which can shorten your timeline.

1. CISSP: is the best-known leadership credential. ISC2 lists five years of required experience and DoDM 8140.03 approval. Third-party sources put the exam at $749 and an annual maintenance fee of $135.

2. CISM: is ISACA’s management credential. ISACA lists $575 for members and $760 for non-members, plus a $50 application fee. ISACA also says the CISM exam outline will update on November 3, 2026.

3. CCSP: is ISC2’s cloud security credential. ISC2’s CCSP asks for five years of experience, including three in security, though third-party sources say holding CISSP satisfies it entirely. The exam is $599 per third-party source.

Beyond these, credentials like GIAC certifications from SANS are strong for senior technical work but are usually employer-funded.

Certifications you can take before you have the experience

• CGRC: pass first and become an Associate of ISC2, with three years to earn the experience.

• CISSP and CCSP: Associate of ISC2, with six years (third-party sources).

• CISM: ISACA gives you five years from passing to apply.

What this stage means for your pay

This is where experience, not any one exam, drives the biggest gains. BLS reports that the top 10% of information security analysts earned over $199,850 in May 2025. It lists the median for computer and information systems managers, a common next step, at $175,140. Advanced certifications can support that climb, but they work best alongside real engagements and leadership.

AI now appears in cybersecurity work in two ways: you use it to move faster, and you sometimes have to secure AI systems. The exams are following, so the version you study matters. You don’t need a separate AI credential to start.

• CompTIA’s Security+ V8 adds an objective on the security risks associated with AI, and CySA+ V4 adds AI and automation in security operations.

• PenTest+ (PT0-003) covers AI attacks such as prompt injection, and EC-Council built AI into CEH v13.

• CompTIA’s SecAI+ (CY0-001) launched February 17, 2026, with a maximum of 60 questions. Third-party sources put it at about $359.

• ISACA lists AI credentials: AAIA for audit, AAISM for security management, and AAIR for risk.

Learn the basics first, then add an AI credential once you have a base to build on.

Exam versions and prices are shifting this year, and timing mistakes are expensive. A voucher bought for a retiring version can leave you studying the wrong material. Here’s what to know before you book anything.

Mostly, yes. You can study for every certification here online, and many exams can be taken remotely. The details vary by provider, so check before you book. A little preparation avoids stressful surprises.

ISACA says CISM is offered at PSI test centers or remotely proctored. EC-Council runs live and on-demand courses through iClass and delivers CEH through its online exam portal. TCM says PNPT can be taken at home with no proctor, and OSCP is proctored. For CompTIA and ISC2 exams, check each provider’s page for test-center and online options. In every case, the certification body issues the credential, not whoever taught you.

Exam fees are only part of the picture, so here’s what four realistic routes add up to. Your total depends on study materials, retakes, and whether an employer helps pay. Use these as a starting budget, not a quote.

Totals exclude taxes, retakes, and renewals. Security+ and PenTest+ renew every three years, CISSP and CGRC carry annual maintenance fees, and CEH needs continuing-education credits plus an $80 annual fee. To spend less, ask your employer to reimburse exam fees, use the free official exam objectives, and buy vouchers close to your test date.

A certificate gets you the interview, and your proof gets you the job. Build a small home lab, write up what you learn, and keep one sample report or investigation summary you can walk an interviewer through. Bug bounty programs offer real practice for the offensive lane. Then avoid the usual traps:

• Collecting several entry-level certifications before applying anywhere.

• Studying for a retiring exam version.

• Jumping to OSCP or CISSP before you have the basics or the experience.

• Using exam dumps, which build no skill and can get a certification revoked.

A simple test: copy ten job posts for your target role into a spreadsheet and count which certifications repeat.

Exams reward structure, and many people learn faster with a live instructor than a stack of videos. JanBask Training’s cybersecurity programs are built around live, online, instructor-led classes with a 4-week job assistance program that includes resume and interview preparation. Here’s how they line up with the lanes above.

A few honest notes. JanBask training builds your knowledge, but the credentials themselves come from CompTIA, EC-Council, ISC2, or ISACA, and you’ll still register for and pass those exams. JanBask’s GRC certificate is a JanBask completion certificate, not an ISACA or ISO credential. Not sure where to start? A free career counseling session can map your background and budget to a first step.

The path is shorter than the long lists make it look. Security+ opens the first door, one lane-specific certification shows where you’re headed, and hands-on proof backs it up. Exam versions are shifting this year, so match your study materials to the exam code. Beyond the exams, a small lab, a few write-ups, and clear communication do the rest.