What 2026 CISSP, Security+, CEH & OSCP Exam Changes Mean for You

Book now or wait? That is the decision, because an exam outline freezes on its published date, and the appointment you hold decides which version you sit.

CompTIA's SY0-801 goes live November 17, 2026; SY0-701 retires June 11, 2027. ISC2's reweighted CISSP outline does not arrive until April 15, 2027, while its shortened experience waiver list took effect April 1, 2026 at 25 approved credentials. CEH and OSCP changes center on format and retake policy rather than a dated blueprint swap.

That split is what makes scheduling the hard part.

What Actually Changed in 2026: CISSP, Security+, CEH & OSCP at a Glance

Only two of these four credentials have confirmed, dated exam changes on the calendar right now. One is a 2027 deadline you can plan around; the other lands in November 2026, so timing matters immediately.

CISSP 2026 Outline: Domain Weight Changes and the Current-Outline Deadline

The Deadline That Actually Matters

Two dates decide which exam you sit. Exams taken on or after April 15, 2027 follow the new 2027 outline; anything earlier runs on the April 15, 2024 outline.¹ ISC2 sets the 2027 start date but does not separately publish a last test date, which is why April 14, 2027 reads as the implied final day under the current outline. Treat both as booking deadlines. If you want the 2024 version, schedule with enough slack that one reschedule cannot push you past the line. If you are targeting the 2027 version, do not book before that window opens.

Old vs New Weights, Domain by Domain

Both outlines total 100%, so no new domain is being added. The weight shifts between domains that already exist.

• Domain 1, Security Governance and Risk Management (renamed from Security and Risk Management in 2024): 16% down to 13.6%
• Domain 2, Asset Security: 10% up to 12%
• Domain 3, Security Architecture and Engineering: 13% down to 12.8%
• Domain 4, Communication and Network Security: 13% down to 12.8%
• Domain 5, Identity and Access Management: 13% up to 13.6%
• Domain 6, Security Assessment and Testing: 12% down to 11.2%
• Domain 7, Security Operations: 13% down to 12.8%
• Domain 8, Software Development Security: 10% up to 11.2%¹

What That Means for Your Study Plan

Domain 1 sheds the most weight, 2.4 points, while Domain 2 gains the most at 2 points and Domain 8 follows at 1.2.¹ If Domain 1 was your largest block of study hours, trim it rather than delete it: at 13.6% it stays tied for the heaviest domain in the 2027 outline. Push the reclaimed time into asset security and secure software development.

Domain 3 barely moves, 13% to 12.8%, so if architecture and engineering is your weak area, the shift is no reason to deprioritize it. It remains one of the largest domains and the one where thin fundamentals cost the most questions.

One caution: this is a reweighting, not a content rewrite. Most objectives carry over, so keep your existing knowledge base and adjust where you spend the marginal hour.

CISSP Experience Waiver List Changes: Who Qualifies Now

Effective April 1, 2026, ISC2's revised CISSP experience waiver list carries 25 approved credentials, down from roughly 50 on the version before it.¹

The Baseline Does Not Move

CISSP still asks for five years of cumulative paid work in at least two of the eight domains. A waiver removes exactly one year, taking you to four.² It never removes the experience requirement, and you can use only one waiver: a qualifying degree and a qualifying credential cannot be stacked for two years.² Eligible degrees remain a bachelor's or master's in computer science, information technology, or a related field.

Who Fell Off the List

The removals are the part people check first. Gone: CEH, CISA, CRISC, OSCP, OSCE, GSEC, GCIH, GCFA, GCIA, CIA, CPP, CCE, CWSP, and CCSK, plus a set of EC-Council, GIAC, INE, Juniper, Cisco CyberOps, and Zscaler credentials.³ Most GIAC certifications were dropped, but GICSP, GISF, GISP, and GSLC remain. CCSP, CISM, SSCP, and GICSP are retained. ISC2 screens against a public exam outline, ANAB ISO/IEC 17024 accreditation or a proctored exam, and at least 90% alignment with two or more CISSP domains.²

Three Candidates, Three Outcomes

• Degree holders: unchanged if your bachelor's or master's is in computer science, IT, or adjacent.
• Credential holders: check the revised list before you plan. Losing waiver status does not revoke your CEH or OSCP; it only removes its use toward CISSP. Applications submitted on or after April 1, 2026 that rely on a removed credential get no waiver.
• Career changers: no waiver path unless a degree or retained credential applies, so plan on the full five years.

The Fallback

If a removed credential was your route, the endorsed-experience path still works. A CISSP in good standing endorses the experience you claim, and the application proceeds on that basis. Plan for the fifth year, not the fourth.

Security+ 2026 Exam Updates: Objectives, Format, and Renewal

Security+ is changing in 2026: CompTIA's new SY0-801 exam launches on November 17, 2026, while SY0-701 retires in English on June 11, 2027.¹ Candidates planning a late fall or winter test date should study for the new version rather than assume the old outline still applies. The current V7 exam remains available until that retirement date, but new study plans should target SY0-801.

New version, new weights

The published SY0-801 objectives are organized into five domains: General Security Concepts at 16%, Threats, Vulnerabilities, and Attacks at 24%, Security Architecture at 19%, Security Operations at 27%, and Security Program Management and Oversight at 14%.² Security Operations carries the heaviest weight, so operational monitoring, incident response, and hardening topics deserve extra lab time. If you built a study plan around the old outline, rebuild it around these weights before you book.

Format and scoring

The exam allows a maximum of 90 questions in 90 minutes, mixing multiple-choice items with performance-based questions.¹ The passing score is 750 on a 100 to 900 scale. Time management matters because performance-based items can take longer than multiple-choice ones, so practice configuration and troubleshooting tasks rather than memorizing definitions alone.

Renewal and the entry-level role

Renewal stays on a three-year cycle with 50 continuing education units and a $150 CE fee for the full three-year period³, not an annual charge. Security+ also remains the only one of these four certifications with no formal experience prerequisite. That keeps the entry timeline measured in study hours, not years of prior employment, which is why it still anchors most entry-level plans.

CEH and OSCP 2026: Blueprint, Practical Exam, and Retake Policy Changes

The two hands-on credentials diverge sharply in 2026: CEH still asks 125 questions in 4 hours, while OSCP throws 6 target machines and a 23.75-hour clock at you. That gap explains why hiring managers read them differently.

CEH: Knowledge First, Range Second

EC-Council's base exam is a four-hour, 125-question multiple-choice test with a reported passing band of 60% to 85% depending on the form.¹ The 20-challenge, 6-hour practical range is required for CEH Master, not for the base CEH credential.¹ Eligibility runs through EC-Council's official training or an approved self-study path. Retakes are fee-based when you need one, though official training packages can bundle free retake benefits; the voucher comes through the ECC EXAM portal and proctoring fees still apply per attempt.¹

OSCP: The 24-Hour Exploitation Test

OffSec's exam now pairs 3 standalone machines worth 60 points (20 each, split between initial access and privilege escalation) with a 3-machine Active Directory set worth 40 points, where credentials simulate a breach.³ You get 23 hours 45 minutes to attack and 24 more hours to upload documentation.² Through November 30, 2026, you need 70 of 100 raw points⁴; from December 1, 2026, OSCP+ moves to scaled scoring, so no single universal raw threshold applies.³ A standalone exam purchase includes 2 attempts valid for 120 days but no course materials or labs.⁵ Retake waits run 4 weeks after a first failure, 8 after a second, then 12, with additional attempts at $249 and no lifetime cap.⁵

What Each One Actually Proves

CEH signals that you know the vocabulary, tooling, and methodology behind ethical hacking, plus range work if you pursued Master. OSCP proves you can break into live systems under a deadline and document it. For a penetration testing or red team role, the 24-hour practical carries more evidentiary weight; for compliance, audit, or governance work, CEH's breadth often satisfies the checkbox.

CISSP vs Security+ vs CEH vs OSCP: Cost, Experience, Prep Time, and Renewal

CISSP and Security+ publish clear 2026 exam prices and renewal terms, so you can budget for them directly. CEH and OSCP are more often sold with training or lab access, which makes the sticker price harder to compare. The table below lines up what each credential asks in money, experience, study time, and upkeep.

Related Articles

How to Time Your Exam Before or After the Changes

Timing is a risk trade: rush a familiar exam before the current CISSP outline retires, or spend more weeks learning the new domain weights. Neither choice is automatically safer. Your prep depth and your appointment date decide it.

Three Decision Rules

• Already 60% or more through CISSP prep: book before the current-outline cutoff. You have already invested in domains that may shrink or grow, and rebuilding your plan now can cost more than finishing. Confirm the cutoff with ISC2 before you pay.
• Starting from zero: study to the new outline. A study plan built around an exam version that will be gone by your test date is wasted effort.
• Mid-prep when the cutoff passes: remap your remaining hours to the reweighted domains. Do not restart from lesson one; shift emphasis and keep your practice-question log.

Confirm What Governs Your Date

For CISSP, ask ISC2 support which outline governs your specific appointment date, not the day you bought a voucher. Get that answer in writing and read the reschedule window before committing money. Scheduling early to lock in a price can backfire if your test date lands after the switch, and a discounted voucher is no bargain if moving the appointment triggers a fee or forfeits it.

Security+, CEH, and OSCP follow a simpler rule. Their version changes are content refreshes, not hard deadlines, so book within 60 to 90 days of finishing prep instead of racing a calendar date.

An expired outline does not invalidate a certification you already hold. It only changes the exam you sit next.

Questions to Ask Yourself

Study Resources and Prep Adjustments for the New Outlines

A course recorded against last year's objectives and a question bank rebuilt for the current ones cost about the same. Only one of them prepares you for the exam you are actually booking.

Check the version, not the marketing page

Every credible product names the objective version it maps to, plus a publication or last-updated date. Look for that version code on the product page, in the book's front matter, or in the changelog. If you cannot find it, assume the material predates the change. For CISSP, match the product to the outline you will actually test under, whether that is the current outline or the one arriving with the 2027 refresh.

What stale material costs you

Reweighted domains get over-studied, retired domains get memorized for nothing, and genuinely new objectives get skipped. The usual symptom is a practice score that plateaus while your domain-level results do not line up with the official weightings.

AI and integrity rules

Where a certifying body has published a position on AI-assisted question generation or on remote-proctoring integrity flags, read it before exam day. Read it as knowing the rules, not as a warning: the candidate agreement and testing-center policy spell out what is allowed.

A prep stack that survives an outline change

• Official objectives document first: free, authoritative, and the only list that matters.
• Version-matched question bank second: mapped to that same document.
• Hands-on practice last: OSCP and CEH practical components cannot be drilled with flashcards alone.

Career and Salary Impact: What Employers and Pay Data Signal

Employers are raising the bar on what counts as evidence of skill, and the pay data shows credentials sit inside a wide band rather than at a premium on their own.

The pay band

The most recent federal wage data, from May 2025, puts Information Security Analysts at a median of $129,180, with the middle half of the occupation earning between $97,810 and $163,500 and total employment near 190,650. That spread, roughly $66,000 from the 25th to the 75th percentile, is the honest frame for any certification question: credentials help you move within the band, they do not reset it.

Which credentials postings actually name

A 2026 analysis of 2,694 deduplicated cybersecurity listings found 74.8% mention no specific certification and only 6.9% explicitly require one. Among postings naming any tracked credential, CISSP appears in 17.6% overall and accounts for 70% of those mentions. A separate academic corpus of the same size reports lower rates: CISSP 10.3%, Security+ 7.0%, CEH 5.1%, and OSCP 2.7%. CyberSeek-cited counts give CISSP 82,494 U.S. listings and Security+ 70,019 over a year. Seniority matters: Security+ is the entry-level screen, often written as "Security+ or equivalent experience"; CEH clusters mid-level and in DoD 8140 roles; CISSP dominates senior, architect, and management postings; OSCP is valued for offensive work even where its all-market frequency is uncertain.

Why timing a CISSP costs more

Because CISSP is usually a named requirement for senior and architect roles, a mistimed exam can stall a promotion or an application outright. Security+ is more often a baseline filter, frequently satisfied by experience, so a delayed update costs less. Certification is rarely the sole pay lever: role, location, and hands-on experience still dominate the spread.