Exam fee: US$575, members; US$760, non-members
Why it’s on our list: CISA is a highly regarded certification with strong industry recognition. It appears frequently on industry lists, and 45,775 job postings explicitly seek candidates with this credential. With over 151,000 certified professionals, CISA offers a vast networking pool of auditors and security experts and an average salary of $155,362.
Certified Information Systems Security Professional (CISSP)
If CRISC and CISA represent specialty certifications for the midcareer analyst, CISSP is a generalist cert, a logical progression from Security+ for someone who’s been around for a while. Advanced-level analysts interested in getting CISSP certified will need to know all the ins and outs of security and risk management, asset security, operations, security assessment and testing, and more. Offered by ISC2, the CISSP certification requires five years of full-time experience in at least two of its eight domains. The exam is adaptive, ranging from 100 to 150 questions, including multiple-choice and drag-and-drop formats. Candidates who pass at 100 questions have demonstrated mastery across all domains.
Exam fee: US$749
Training fees: US$248.75, online self-paced training; US$720, online instructor-led bootcamp; and learners can inquire for pricing details on instructor-led classroom training
Why it’s on our list: If you’re looking for a job, earning a CISSP can help you stand out. With over 70,082 job postings explicitly seeking this certification and an average salary of $168,060, it ranks as the most in-demand security credential and is frequently highlighted on industry lists.
“The certification I get questions about the most is the CISSP,” says Tim Bandos, CISO at Digital Guardian. “I do believe this certification is a hot one, given its reputation in the cybersecurity industry.” Beyond its career benefits, CISSP boasts a strong professional network of 91,765 certified professionals. It provides a broad foundation in cybersecurity, and professionals can further specialize within the ISC2 ecosystem through certifications such as the CCSP for cloud security.
For more, see “CISSP certification: Requirements, training, exam, and cost.”
Certified in Risk and Information Systems Control (CRISC)
CRISC certification centers on risk analysis and management. Candidates need to know how to balance the likelihood of a risk happening against the potential damage that would ensue if it does. Overall, the goal is to help understand an organization’s tolerance for risk, categorize it, and quantify it. As ISACA, the organization that offers the cert, puts it, you’ll be aiming for a career where you “build a well-defined, agile risk-management program, based on best practices to identify, analyze, evaluate, assess, prioritize and respond to risks.” This is an area of security analysis that offers a promotion path to the top of the org chart — but it’s not for beginners, as CRISC requires three years of experience across two of four domains. The exam features 150 multiple-choice questions, testing IT risk management and control implementation skills.
Exam fee: $50 application fee, $575 (ISACA members) / $760 (non-members)
Training fee: ISACA offers four resources: online review course, US$895; annual subscription to question bank, US$399; print or digital review manual, US$139; discounts available for ISACA members
Why it’s on our list: CRISC is the most cited certification focused explicitly on IT risk management and mitigation. Often pursued after CISA, CRISC commands the highest average salary among ISACA certifications at $165,890 and an average pay premium of 10%. With a strong community of 30,000 certified professionals, it is a top choice for those specializing in risk and control.
For more, see “CRISC certification: Exam, requirements, training, potential salary.”
Cisco Certified Network Professional (CCNP) Security
Cisco offers a Cisco Certified Network Professional (CCNP) Security certification that focuses on security concepts and architecture, user and device security, network security, assurance, and cloud application management. While there are no prerequisites for the CCNP, in Cisco’s leveling professional-level certifications such as this one are meant to build on associate-level certifications. Cisco advises that most candidates in the certification have between three to five years of experience in network security. By demonstrating expertise with this credential, graduates can succeed in numerous roles, including security engineer, security analyst, and network security engineer. This certification is valid for three years and can be renewed by retaking the exam before its expiration or by taking continuing education credits.
Training fees: Professionals can avail of instructor-led training from Cisco and accredited partners (prices vary), or a US$6,000 annual subscription to Cisco U All Access, which provides learning pathways for professional-level certifications.
Exam fees: Professionals must take a core exam for US$400, plus one of seven exams for a concentration area for US$300.
Why it’s on our list: As with AWS in cloud computing, Cisco is the undisputed leader in computer networking, holding an even greater market share at 76%. For security professionals seeking a vendor-specific certification in networking, Cisco certifications open doors. Additionally, Cisco offers a progressive learning curve: Professionals can start with an associate-level certification, such as the Cisco Certified Network Associate (CCNA) — which has a straightforward pass-or-fail exam — before advancing to the CCNP. Professionals with the CCNP earn an impressive average salary of $168,159.
CompTIA Advanced Security Practitioner (CASP+)
CompTIA’s Advanced Security Practitioner, which is being rebranded SecurityX, spans four domains: security architecture, operations, engineering and cryptography, and governance, risk, and compliance. The program is ideal for advanced cybersecurity professionals, such as senior security engineers or architects who wish to progress toward better lateral or vertical opportunities, including CISO. The current 165-minute exam, set to expire on CASP’s rebranding to SecurityX, consists of 90 multiple-choice and performance-based questions. Certificate holders must renew every three years with 75 continuing education units (CEUs) from CompTIA’s Continuing Education program. The certification carries a significant industry cache: It was developed in partnership with Target, GDIT, RICOH, and ExxonMobil and is approved by the Department of Defense to meet 8140.03M requirements. While there are no enforced prerequisites, CompTIA recommends 10 years of IT experience, with at least 5 years in security.
Exam and training fees: US$509, exam; US$955, exam, study guide, exam practice, and retake; US$1,485, exam, study guide, exam practice, retake, and on-demand content and hands-on lab training
Why it’s on our list: CASP+ recommends several certifications as prior experience, including Security+. Professionals can use Security+ as a stepping stone to CASP+, earning two blue-chip certifications in succession. Among CompTIA’s most respected credentials, CASP+ ranked as the second most frequently cited after Security+, highlighting its strong industry recognition.
CompTIA Security+
The CompTIA Security+ certification teaches risk analysis and automation across five domains: security concepts, operations, architecture, program management, and threats, vulnerabilities, and mitigations. Numerous enterprises have contributed to the development of Security+, including Microsoft, Deloitte, and Zoom. The Security+ cert opens up varied opportunities, including network security analyst, penetration tester, and security architect. The 90-minute exam consists of a maximum of 90 multiple-choice and performance-based questions; candidates must score 750 on a scale of 900. Certificate holders must renew the cert by taking 50 CEUs through CompTIA’s Continuing Education program within three years. Note: CompTIA will likely retire the exam by 2026.
Training and exam fees: US$404, exam; US$581, exam, retake, study guide; US$1,111, exam, retake, study guide, hands-on lab training, exam prep, e-learning
Why it’s on our list: CompTIA Security+ is a highly respected cert, tying with ISACA’s CISM for the most mentions on industry lists. With 63,260 job postings explicitly seeking Security+ as a qualification and a large alumni base of 265,992 certified professionals — comparable to a large university — it provides strong job demand and a built-in professional network for career growth.
For more, see “CompTIA Security+: Prerequisites, objectives, and cost.”
GIAC Security Essentials (GSEC)
The GIAC Security Essentials certification offers a curriculum comparable to CompTIA Security+. Topics covered include everything from cryptography and the cloud to incident handling and endpoint security. GSEC is suited for security administrators, forensic analysts, and penetration testers who have an IT background but need to validate their knowledge as a practitioner. Candidates must score 73% or more on the four-hour, 106-question exam, which can be administered with a proctor online or onsite. Professionals must take the 36 continuing professional education credits within four years to renew GSEC, a standard consistent for all GIAC certs.
Training fees: On-demand and in-person options priced at local rates
Exam fees: US$999; retakes, US$899
Why it’s on our list: GIAC is one of the most respected certifying bodies in cybersecurity, with 36,878 job listings explicitly seeking a Global Information Assurance Certification (GIAC). Out of all GIAC certifications, the GSEC certification was the most frequently cited. As a practitioner certification in the GIAC ecosystem, GSEC provides a strong knowledge base, making it an excellent starting point for a successful cybersecurity career. While not an official prerequisite, GSEC can also provide foundational knowledge for GIAC Cloud Security Automation (GCSA), GIAC Network Forensic Analyst (GNFA), and GIAC Reverse Engineering Malware (GREM), each of which offers an average pay premium of 10%.
Offensive Security Certified Professional (OSCP+)
To earn the OffSec Certified Professional certification, candidates must complete the affiliated course, Penetration Testing with Kali Linux, and pass the subsequent exam. The course covers 10 modules, including information gathering, vulnerability scanning, client-side attacks, and fixing exploits. Certificate holders will have shown mastery of penetration testing methodologies ideal for new roles, such as ethical hacker, incident responder, or threat hunter. The OSCP exam is hands-on; test-takers must compromise systems within a lab environment.
OffSec does not enforce prerequisites but recommends candidates be familiar with TCP/IP networking, scripting in Bash and Python, and Linux and Windows, which they can learn through its Network Penetration Testing Essentials Learning Path.
Training and exam fees: US$1,749, Kali Linux course plus exam
Why it’s on the list: After the C|EH, OSCP+ was the second most frequently cited OffSec certification on industry lists. As of Nov. 1, 2024, OSCP was rebranded to OSCP+ to reflect a more rigorous exam format. The new 24-hour hands-on assessment requires candidates to exploit a vulnerability in a lab environment, followed by an additional 24 hours to submit a comprehensive penetration testing report. The exam also now includes an updated Active Directory (AD) section with an assumed compromise scenario. Penetration Testing with Kali Linux is also recommended preparation for PEN-300: Advanced Evasion Techniques and Breaching Defenses — one of three courses required for the Offensive Security Certified Expert (OSCE) certification, which offers an average pay premium of 11%.
Systems Security Certified Practitioner (SSCP)
The ISC(2) SSCP certification covers seven domains: security concepts, access control, incident response, cryptography, network security, systems and application security, and risk identification, monitoring, and analysis. It is ideal for various professionals, including security analysts, systems engineers, network analysts, database administrators, and security consultants. The three-hour exam consists of 125 multiple-choice questions; candidates must earn 700 out of 1,000 points to pass and undergo a process validating their professional experience. Those who earn the SSCP must abide by ISC(2) ‘s code of ethics and pay an annual maintenance fee that supports the organization and its initiatives, including its members-only network of cybersecurity pros.
To qualify, the SSCP requires one year of experience. Those without the experience requirement can bypass it with a relevant undergraduate or graduate degree in computer science or a related subject.
Training fees: Free, exam outline, flashcards, a practice quiz, and a study app; US$90 for 90-day access to on-demand training
Exam fee: Varies by country (US$249 for candidates in North and South America)
Why it’s on our list: SSCP is often featured on industry lists and is a strong foundation for those pursuing CISSP or CCSP.
