I have sat on both sides of this one. I worked a help desk for about two years before a SOC took me on, and later I screened junior analysts for the same team. Every month the resumes arrive with the same three badges in the header, and every month someone in the Discord asks which one to buy first. The answer depends on which stage of the pipeline you are stuck in, because the three certs are built for different stages.
What each exam actually tests
Security+ (SY0-701) is a vocabulary and judgment exam. As of November 2026, CompTIA’s exam page lists a maximum of 90 questions in 90 minutes, a pass mark of 750 on a scale of 100 to 900, and a mix of multiple choice and performance-based items. The domains cover the whole field at shallow depth: threat types, identity and access, cryptography basics, and the governance material that makes everyone’s eyes glaze over. Six weeks with a question bank gets most people through. It proves you can hold a security conversation.
CySA+ is the analyst exam. CompTIA’s page for the current English version, CS0-003, lists a maximum of 85 questions in 165 minutes with the same 750 pass mark; CompTIA retires it in English on December 22, 2026, and CS0-004 has been live since June 23, 2026. The questions sit one level deeper than Security+: here is a log excerpt, name the host that is beaconing; here is an alert, pick the action that counts as containment. It is still multiple choice, and you will struggle if you have never read a log while something was going wrong. CompTIA recommends four years of hands-on work before sitting it. Almost nobody waits that long.
BTL1 is a different animal. Centri, formerly Security Blue Team, sells it as a course plus a 24-hour practical exam. You get a browser lab with a breach already in progress and a set of investigation tasks: pull the phishing headers apart, find the persistence mechanism, trace the connection in the packet capture, write up what happened. The tools are the real ones, Splunk and Wireshark among them, and every answer comes out of the lab in front of you.
Who recognizes which
This is where people waste money, so I will be blunt.
HR filters know Security+. CompTIA’s framework alignment page says it maps to 20 DoD 8140 work roles in 2026, among the highest counts of any certification, so a large share of government and contractor postings require it by name, and plenty of private employers copied the habit. An applicant tracking system told to look for Security+ drops you without it, whatever else you have. CySA+ sits on the same DoD lists for the defensive roles, but far fewer postings name it.
Hiring managers are a different audience. The SOC leads I have worked with treat Security+ as table stakes and stop reading at that line. They notice CySA+ as a sign you studied the analyst side on purpose. BTL1 is the one that makes them look up from the resume, because many of them have sat it, and it reads as a day of evidence rather than a logo. The filter and the SOC lead are buying different products, and you will probably need both.
Cost and format, with this year’s prices
Training Camp’s 2026 voucher guide puts the CompTIA list price for both Security+ and CySA+ at $439 each after the June 1, 2026 increase, and sells the same vouchers itself for $373 and $361. That buys one attempt at a proctored, timed exam, and a retake is a second voucher unless you bought a bundle. Both expire after three years unless you earn continuing education credits or pay to renew.
Centri’s 2026 listing puts BTL1 at 399 pounds, roughly $500, for four months of course access, 23 browser labs with 100 hours of lab time, the 24-hour exam and one free resit, and the certification never expires. Counting the training, it is the cheapest of the three and the only one you never pay to keep.
The order that makes sense
If you are on a help desk now, Security+ first. You already do half the material: password resets under social pressure, phishing reports, MFA enrollments, lockouts at 8:55 on a Monday. The exam turns those tickets into the words a SOC uses, and the badge gets your resume through the filter that currently drops it. The full case for Security+ is its own post.
Then BTL1, before CySA+. BTL1 teaches you to work in the tools, and CySA+ questions get much easier once you have seen the thing they describe. A beaconing question is abstract until you have found a beacon in a lab at two in the morning.
CySA+ comes third, and only if you want it. Once you are in a SOC your employer will probably pay for it. If you are still trying to get in, I would rather you spent the voucher money on another month of lab time.
The cert gets the interview
Every panel I have sat on asked the same thing once the badges were out of the way. Walk me through an alert you worked. People with Security+ and nothing else recite the incident response lifecycle from the textbook. People who have worked a queue, in a job or in a lab, describe one specific alert: the query they ran, what it turned up, the close code they chose and the note they wrote. The second group gets the offer. The SOC interview post has the questions that come up most.
That is why the lab matters more than the third badge. ServiceDesk Simulator has a second desk, the Security Simulator, in beta: a queue of alerts and escalated tickets, a SIEM-style log search, sign-in history and an endpoint console, and every case closes with one of eight close codes and a note before the desk tells you what actually happened. The beta has a waitlist on the Security Simulator page, and it gives you an alert of your own to describe before anyone has hired you to work one.
Whichever lab you pick, that one, TryHackMe or BTL1’s own, the goal is an investigation you can narrate from the first query to the close code. Then buy the voucher for whichever filter is dropping you.