Who should skip it: If you already have 5+ years of hands-on security work, Security+ won't differentiate you from junior candidates in competitive markets. Go straight to CySA+ or CISSP depending on your path.

ISC2 Certified in Cybersecurity (CC) -- Free

This one doesn't get enough attention. ISC2 ran a "One Million Certified in Cybersecurity" program offering free exam vouchers, and while the free phase has wound down, the CC remains one of the most accessible entry-points in the field. It covers foundational security concepts and serves as a legitimate stepping stone toward CISSP.

For career changers with limited budget who want an employer-recognized credential before they can afford Security+, CC is worth considering. It's not as widely recognized as Security+ in job postings, but it's legitimate, backed by ISC2 (the CISSP organization), and free or low-cost to pursue.

Mid-Level: The Credentials That Separate You From the Crowd

CompTIA CySA+

CySA+ is where Security+ holders should go next if they're on the analyst or blue team track. It validates threat detection, analysis, and response skills at an intermediate level and directly prepares you for Tier 2 SOC analyst roles, threat hunting positions, and junior incident response work.

Salary ranges for CySA+ roles sit roughly $85,000 to $115,000 depending on location and employer. Washington D.C., San Francisco, Seattle, and New York pay 15 to 35% above national averages.

What's important to understand about CySA+ is that it works best as a bridge. Security+ gets you in the door. CySA+ proves you can actually do the analytical work once you're there. The real career leap happens when you combine CySA+ with a year or two of actual SOC work where you've touched a real SIEM, handled real incidents, and documented real control improvements.

Who should get it: Security+ holders with 1 to 3 years of experience who want to advance past entry-level roles without committing to CISSP yet.

Certified Ethical Hacker -- CEH ($1,299 to $1,399)

CEH has a complicated reputation in the security community, and I want to be honest about it.

The credential itself is legitimate. EC-Council has updated it significantly, CEH v13 includes AI-aware offensive skills and practical labs, and it satisfies DoD 8140 requirements for a range of government positions. CEH-enabled roles average around $126,000 annually, with the premium highest for government contracting and federal work.

Here's the honest reality though: in pure penetration testing circles, OSCP has become the de facto standard. Hiring managers for offensive security roles often treat CEH as a stepping stone rather than a destination. One hiring manager at a red team consultancy told me directly: "CEH tells me you understand the theory. OSCP tells me you can actually do it."

So CEH is worth it if you're targeting government or defense contractor positions where DoD 8140 compliance is a hard requirement, or if OSCP's cost and difficulty aren't accessible to you right now. It's less compelling if you're going directly into private sector penetration testing.

One important update for 2026: CEH was removed from the ISC2 approved CISSP experience waiver list effective April 1, 2026. If your career plan involved using CEH to reduce the CISSP experience requirement from five years to four, that pathway no longer exists.

Who should get it: Professionals targeting ethical hacking, penetration testing, or vulnerability assessment roles at government agencies or defense contractors. Not the best investment if OSCP is achievable.

Advanced Level: The Certifications That Actually Change Your Earning Trajectory

CISSP -- Certified Information Systems Security Professional ($749 exam)

CISSP is the most requested cybersecurity certification in senior job postings. Full stop. Many positions literally don't consider candidates without it. The salary premium is real and documented: CISSP-certified professionals see a $25,000 to $35,000 annual salary bump, and the $749 exam fee pays for itself in under two weeks of additional earnings once you're in a CISSP-level role.

Here's The Comparison That Matters

The caveat that matters most: CISSP requires five years of qualifying experience across two or more of its eight security domains. You cannot rush this. If you're at year two or three of your career, CISSP is something to plan for, not pursue right now.

If you pass the exam before you have the required experience, you earn the Associate of ISC2 designation. You then have six years to accumulate the needed experience. This is a legitimate strategy for ambitious professionals who want to signal their knowledge early and grow into the full credential.

CISSP is designed for management and strategic roles. It covers governance, risk, compliance, architecture, and leadership. Senior roles supported by CISSP include CISO, security director, security architect, and senior security manager, with salaries ranging from $150,000 to well over $200,000 at major tech companies when total compensation is included.

Who should get it: Professionals with 4 to 6 years of hands-on security experience who are ready to move into senior individual contributor or management tracks. This is the credential that unlocks executive-level earning.

Who should skip it: Anyone under two years of experience, anyone