Conceptual illustration of three cybersecurity certification stages arranged around a decision compass.
Conceptual illustration; not an exam, certification, or testing result.

Security+, CEH, or CISSP? How Their Goals and Prerequisites Differ

Compare Security+, CEH, and CISSP by scope, experience, exam format, post-exam steps, and maintenance using current issuer sources. No hands-on testing or ranking.

Quick answer

Security+, CEH, and CISSP answer different questions. Security+ is the broadest baseline of the three and uses recommended experience rather than a formal work-experience application. CEH narrows toward ethical-hacking knowledge, with an official-training route or an experience-based eligibility route and a separate optional practical exam. CISSP is a broad experience-based credential: passing the exam is only one step, because full certification also requires qualifying experience and endorsement.

Choose by stage, not prestige. Investigate Security+ when you need a broad security foundation; CEH when ethical-hacking concepts are the defined next specialization and you meet the current route; CISSP when your work already spans multiple security domains or you deliberately understand the Associate of ISC2 path. Delay the exam decision when prerequisites, role direction, maintenance workload, or evidence of current readiness remain unclear.

Evidence and scope

Research basis
Source-led research (E1): official issuer sources reviewed; no hands-on testing.
Information checked
Target market
United States primary; issuer requirements may apply internationally but candidate rules must be checked
Direct evaluation
Not performed
Scope
Current issuer-stated goals, recommended or required experience, exam structure, post-exam credential path, and maintenance obligations for CompTIA Security+, EC-Council CEH, and ISC2 CISSP
Main limitation
No exam, training course, candidate application, registration, testing center, endorsement, renewal, support, accessibility, accommodation, or employer workflow was directly tested.

This comparison uses official issuer pages to distinguish three certification stages. It does not rank the credentials, recommend one universal order, predict exam difficulty or pass probability, or promise employment, salary, promotion, or career outcomes.

Key facts

  • Security+ SY0-701 (V7) covers broad cybersecurity concepts and uses up to 90 multiple-choice and performance-based questions in 90 minutes.
  • CompTIA describes prior IT and security work as recommended experience for Security+, not as a formal application requirement.
  • The current EC-Council page labels the knowledge exam CEH AI and specifies 125 multiple-choice questions over four hours. CEH Practical is a separate optional six-hour exam with 20 challenges.
  • CEH eligibility can proceed through official training or an experience-based application route; current candidate rules must be verified.
  • Full CISSP certification requires five years of cumulative experience in two or more of eight domains, with at most a one-year waiver.
  • Passing the CISSP exam without enough experience can lead to Associate of ISC2 status; that status is not the CISSP credential.
  • All three credentials carry continuing-maintenance obligations, but their scope and lifecycle are not directly interchangeable.

These boundaries are supported by the current Security+ certification page, CEH exam page, and CISSP experience requirements.

Who should use this comparison

Use this comparison if you are deciding which credential stage to investigate next and you want to separate issuer requirements from common internet sequences. It is most useful when you can describe your current technical baseline, relevant work experience, intended role or capability, and whether you need broad foundations, an ethical-hacking specialization, or a broad experience-based credential.

This page is not a training-course comparison. It does not tell you which course to buy, estimate how long you will study, calculate exam or renewal cost, or determine whether an employer will value one credential. Those decisions require separate evidence.

For broader route context, read the cybersecurity learning-path guide before choosing a credential stage.

Related decisions: Compare the certification-course evidence in the Security+ course comparison, turn the chosen stage into a bounded workflow with the cybersecurity course and lab study plan, and use the certification study-path planner for objective-level planning.

The three stages at a glance

On a small screen, swipe horizontally to view all columns.

Issuer-stated credential boundaries checked September 3, 2026
Credential Primary stage Experience boundary Assessment boundary Use this decision condition
Security+ Broad cybersecurity foundation and operational baseline Recommended IT/security experience; the current certification page does not state a formal work-experience application Up to 90 multiple-choice and performance-based questions; 90 minutes Investigate when broad concepts and operational security are the current gap.
CEH Ethical-hacking knowledge specialization Official training route or experience-based application route; current recommendations and application rules apply 125-question knowledge exam over four hours; optional separate practical exam Investigate when ethical-hacking knowledge is the defined specialization and the route fits your background.
CISSP Broad experience-based security practice across eight domains Five years in two or more domains for full certification, with a one-year maximum waiver; Associate route exists Computerized adaptive exam with 100 to 150 items and up to three hours, followed by certification application and endorsement Investigate when your experience already supports broad domain responsibility or you knowingly choose the Associate path.

Takeaway: the credentials are not three versions of the same exam. The useful comparison is between the scope you need, the experience you can document, the assessment model you accept, and the maintenance commitment you can sustain.

How to choose a certification stage

1. Start with the capability, not the badge

Write the work you want to become more capable of performing. Security+ spans general concepts, threats, architecture, operations, and program oversight. CEH centers on ethical-hacking knowledge. CISSP spans eight broad security domains and is positioned for experienced practitioners, managers, and executives. Review the current Security+ certification page, current CEH scope, and CISSP domains and experience.

2. Separate recommended experience from formal eligibility

Security+ lists recommended experience, but the current certification page lists recommended experience and does not state a work-experience application. CEH has route-specific eligibility: candidates may use official training or apply through the experience route. CISSP requires qualifying experience for the full credential even if the exam is passed. Check current CEH eligibility and CISSP experience rules.

Security+ appears on ISC2’s current approved credential list for a one-year CISSP experience waiver. That does not make Security+ a mandatory prerequisite and does not remove more than one year of the CISSP requirement.

3. Match the assessment model

Security+ combines multiple-choice and performance-based questions. The current CEH/CEH AI knowledge exam is multiple-choice; the separate CEH Practical exam uses 20 challenges over six hours and supports the optional CEH Master designation. The current CEH exam page and CEH Practical page distinguish the two assessments.

CISSP is a computerized adaptive exam with 100 to 150 items and a maximum of three hours. Check the current ISC2 exam format.

4. Verify what happens after passing

For CISSP, passing the exam does not by itself complete the full credential. The candidate must satisfy the experience requirement and complete the certification application and endorsement process. Review ISC2 endorsement.

Candidates without enough experience may become an Associate of ISC2 and have up to six years to earn the required experience. The Associate designation does not identify the exam on the badge and should not be represented as already holding CISSP. Read the Associate of ISC2 boundary.

5. Include maintenance in the stage decision

Security+ currently requires 50 continuing-education units over a three-year renewal cycle. Review current CompTIA continuing education. CISSP currently requires 120 continuing professional education credits over three years. Review current ISC2 member policies.

CEH is subject to EC-Council’s current continuing-education policy, but this article did not establish the exact current credit, fee, or activity requirements with the same confidence. Verify them before purchase. Maintenance workload is part of credential fit, not an afterthought.

Issuer requirements compared

The comparison below keeps unlike requirements separate. A recommendation, an eligibility application, a full-certification experience requirement, and a post-exam endorsement are not equivalent controls.

Security+

Formal application gate
The current certification page lists recommended experience; it does not state a work-experience application gate.

Practical component
Performance-based questions are part of the exam format; this article did not test them.

CEH

Formal route
Official training or an experience-based eligibility application, depending on the candidate’s route.

Practical component
A separate optional CEH Practical exam; not silently included in the standard knowledge exam.

CISSP

Full-certification gate
Five years of qualifying experience in two or more domains, with at most a one-year waiver, followed by application and endorsement.

Practical component
The current cited exam is not represented as a hands-on lab exam; ISC2 describes it as experiential and domain-based.

Alternatives to taking an exam now

A valid decision can be to delay all three credentials. Before paying or scheduling, you can:

  • map your intended work to the current exam domains and identify the smallest knowledge gap;
  • build foundational networking, systems, identity, governance, or security-operations knowledge first;
  • complete authorized practical projects and document what you can actually do;
  • confirm that your work experience satisfies the issuer’s definitions before pursuing an experience-based credential;
  • compare current training only after the target exam and objective version are fixed;
  • resolve accommodation, testing, language, support, budget, maintenance, or employer-policy questions before committing.

Delaying is especially appropriate when the credential is being chosen mainly because of prestige, salary marketing, social-media sequences, or an employer requirement that has not been verified in writing.

Unknowns and limitations

  • No exam, course, candidate application, testing center, practical assessment, endorsement, renewal, support, accommodation, accessibility, or employer workflow was directly tested.
  • The former CompTIA objective URL now resolves to a partner-resources page rather than the objective document. This refresh therefore uses CompTIA’s current Security+ certification page for the exam code, format, duration, and recommended experience, plus the current continuing-education page for renewal.
  • No current exam or training price, tax, retake, refund, discount, annual fee, or total-cost model is included.
  • No pass rate, relative difficulty, prestige, employer demand, salary, promotion, placement, job-readiness, or return-on-investment claim is made.
  • Issuer marketing testimonials and outcome statistics are not treated as independent evidence.
  • Candidate-specific experience, education, waivers, eligibility, accommodations, ethics, legal restrictions, and application results require individual verification.
  • Exam codes, outlines, delivery, experience lists, maintenance rules, and issuer policies can change.
  • No affiliate relationship, commission, commercial CTA, winner, ranking, or score is included.

Recheck the required issuer sources after , or earlier if an exam version, eligibility route, experience requirement, Associate rule, endorsement process, or maintenance policy changes.

Make a stage decision

  1. Name the work. Describe the capability or responsibility you want to build.
  2. Inventory your baseline. Record relevant systems, networking, security, governance, development, audit, or ethical-hacking experience.
  3. Check the formal gate. Separate recommendations from applications, work-experience requirements, waivers, and post-exam steps.
  4. Choose the assessment. Confirm whether the exam format and any separate practical component match the evidence you want to build.
  5. Account for maintenance. Verify current credits, fees, ethics, renewal, and continuing-development workload.
  6. Choose, sequence, or delay. Select one bounded next step, or deliberately build experience before committing.

The decision is complete when you can explain why the credential’s documented scope and formal requirements match your current stage without relying on a salary promise, prestige ranking, or universal certification ladder.

Methodology

This E1 comparison was assembled from 13 issuer-controlled pages checked on . The source set covers the Security+ SY0-701 certification details and continuing education, CEH scope, eligibility, knowledge exam and practical exam, and CISSP scope, outline, experience, Associate route, exam delivery, endorsement, and maintenance.

Fourteen approved claims were mapped to the article. The same comparison dimensions were applied to each credential: primary scope, formal or recommended experience, assessment, full-credential path, and maintenance. Unknown or non-comparable fields remain visible; no score or winner was calculated.

A qualitative United States English search sample showed recurring stage, prerequisite, beginner, and sequencing questions, but no search-volume or commercial-demand claim is made. No exam, training, registration, candidate, employer, price, affiliate, or outcome research was performed.

Sources

  1. Security+ (Plus) Certification, CompTIA. Checked September 3, 2026.
  2. Continuing Education: Work Experience, CompTIA. Checked September 3, 2026.
  3. Certified Ethical Hacker (CEH/CEH AI), EC-Council. Checked September 3, 2026.
  4. About the CEH Exam (current CEH/CEH AI page), EC-Council. Checked September 3, 2026.
  5. CEH Certification Requirements, EC-Council. Checked September 3, 2026.
  6. Certified Ethical Hacker Practical, EC-Council. Checked September 3, 2026.
  7. CISSP Certification, ISC2. Checked September 3, 2026.
  8. CISSP Exam Outline, ISC2. Checked September 3, 2026.
  9. CISSP Experience Requirements, ISC2. Checked September 3, 2026.
  10. Associate of ISC2, ISC2. Checked September 3, 2026.
  11. Before Your ISC2 Exam, ISC2. Checked September 3, 2026.
  12. Endorsement, ISC2. Checked September 3, 2026.
  13. Member Policies, ISC2. Checked September 3, 2026.