Certification Roadmap
Practical guide to certifications mapped to AYSEC tracks (2026).
AYSEC Certification Roadmap
A practical guide to certifications mapped to AYSEC tracks. Updated for 2026.
Universal Foundation
| Cert |
Owner |
Cost (~USD) |
Format |
Notes |
| (ISC)² CC |
(ISC)² |
Free first 1M signups (rolling); $50 annually after |
MCQ |
Best free starter cert |
| CompTIA Security+ |
CompTIA |
$402 voucher |
MCQ + perf |
Industry HR-recognized; 3-year renewal |
| Google Cybersecurity Cert. |
Google (Coursera) |
Free aid; $49/mo subscription |
Coursera modules |
Beginner-friendly career cert |
Recommended path for everyone: ISC2 CC → CompTIA Security+ → choose specialization.
Penetration Testing / Red Team (AYSEC-101 / 106 / 201)
| Cert |
Owner |
Cost |
Difficulty |
When |
| eJPT |
INE |
~$249 |
Beginner |
After AYSEC-101 M01–07 |
| PNPT |
TCM Security |
~$399 |
Intermediate |
After AYSEC-101 M01–13 |
| HTB CPTS |
HackTheBox |
~$210 (≈ Academy fee) |
Intermediate |
Excellent OSCP prep |
| OSCP |
OffSec |
~$1,499 incl. lab |
Hard |
After AYSEC-101 capstone-ready |
| OSEP |
OffSec |
~$1,799 |
Hard |
Advanced offensive |
| OSWE |
OffSec |
~$1,799 |
Hard |
Web + source-code review |
| CRTO |
Zero-Point Security |
~$399 |
Intermediate |
Modern red-team operator |
| OSCE3 |
OffSec |
bundle |
Very hard |
OSEP + OSWE + OSED |
| CEH |
EC-Council |
~$1,200 |
Easy-Mid |
HR-recognized but theory-heavy |
SOC / Blue Team (AYSEC-102 / 103)
| Cert |
Owner |
Cost |
Difficulty |
When |
| CompTIA CySA+ |
CompTIA |
~$392 |
Beginner-Mid |
After AYSEC-102 M01–07 |
| BTL1 |
Security Blue Team |
~$399 |
Intermediate |
Practical; 24-hour exam |
| BTL2 |
Security Blue Team |
~$649 |
Hard |
Advanced |
| Microsoft SC-200 |
Microsoft |
~$165 |
Mid |
Sentinel + Defender |
| Microsoft SC-100 |
Microsoft |
~$165 |
Hard |
Cybersecurity Architect Expert |
| Microsoft SC-300 |
Microsoft |
~$165 |
Mid |
Identity + Entra ID |
| GIAC GCIA |
GIAC |
~$2,499 (with course) |
Hard |
Network intrusion analyst |
| GIAC GCDA |
GIAC |
similar |
Hard |
Detection analyst |
| GIAC GCIH |
GIAC |
similar |
Hard |
Incident handler |
| Splunk Core Cert. User / Power User |
Splunk |
$130 each |
Mid |
Free training |
| Elastic Certified Engineer |
Elastic |
$400 |
Mid |
Elastic SIEM stack |
DFIR (AYSEC-103)
| Cert |
Owner |
Cost |
When |
| GIAC GCFE |
GIAC |
~$2,499 (with FOR500) |
After AYSEC-103 M01–06 |
| GIAC GCFA |
GIAC |
~$2,499 (with FOR508) |
After AYSEC-103 capstone |
| GIAC GREM |
GIAC |
with FOR610 |
Reverse engineering malware |
| GIAC GNFA |
GIAC |
with FOR572 |
Network forensics |
| CHFI |
EC-Council |
$1,200 |
Broader, vendor-style |
| CCFE |
IACRB |
$400 |
Cyber forensics examiner |
GRC (AYSEC-104)
| Cert |
Owner |
Cost |
When |
| (ISC)² CGRC (formerly CAP) |
(ISC)² |
$599 |
Entry GRC |
| CISA |
ISACA |
$760 |
Gold standard for IT audit |
| CRISC |
ISACA |
$760 |
Risk management |
| CISM |
ISACA |
$760 |
Security management |
| ISO 27001 Lead Implementer |
PECB / BSI / others |
$999–$1,500 (with course) |
After AYSEC-104 capstone |
| ISO 27001 Lead Auditor |
PECB / BSI / others |
$999–$1,500 |
Audit-track |
| CIPP/E, CIPP/US |
IAPP |
$550 |
Privacy specialty |
| CDPSE |
ISACA |
$760 |
Privacy + tech |
Cloud Security (AYSEC-105)
| Cert |
Owner |
Cost |
When |
| AWS Cloud Practitioner |
AWS |
$100 |
Foundation |
| AWS Solutions Architect Associate |
AWS |
$150 |
Architectural baseline |
| AWS Certified Security – Specialty (SCS-C02) |
AWS |
$300 |
After AYSEC-105 M01–10 |
| Azure AZ-900 |
Microsoft |
$99 |
Foundation |
| Azure AZ-104 |
Microsoft |
$165 |
Architectural baseline |
| Microsoft SC-100 |
Microsoft |
$165 |
Cybersecurity Architect Expert |
| Microsoft SC-500 |
Microsoft |
$165 |
Cloud + AI Security Engineer (replacing AZ-500 after Aug 2026) |
| GCP Cloud Digital Leader |
Google |
$99 |
Foundation |
| GCP ACE / Professional Cloud Architect |
Google |
$200 |
Architectural baseline |
| GCP Professional Cloud Security Engineer |
Google |
$200 |
Specialty |
| (ISC)² CCSP |
(ISC)² |
$599 |
Vendor-neutral capstone |
AppSec & Bug Bounty (AYSEC-106)
| Cert |
Owner |
Cost |
When |
| Burp Suite Certified Practitioner (BSCP) |
PortSwigger |
$99 (requires Burp Pro) |
After AYSEC-106 M04–11 |
| eWPT / eWPTX |
INE |
$249 / $399 |
Web pentesting |
| OSWE |
OffSec |
$1,799 |
Advanced web + source-code review |
| CSSLP |
(ISC)² |
$599 |
Secure software lifecycle |
Hardware / IoT / OT (AYSEC-150 / 153)
| Cert |
Owner |
Notes |
| GIAC GICSP |
GIAC |
ICS/SCADA |
| CompTIA SecurityX (CASP+) |
CompTIA |
Broader senior practitioner |
Reverse Engineering (AYSEC-202)
| Cert |
Owner |
Notes |
| GIAC GREM |
GIAC |
Malware RE |
| OSED |
OffSec |
Exploit development |
| CRTO |
Zero-Point Security |
Modern red-team |
Suggested Sequencing
Year 1 (foundations)
ISC2 CC → CompTIA Security+ → choose one specialization →
First specialty cert (eJPT / CySA+ / SC-200 / Cloud Practitioner)
Year 2 (mid)
Mid-tier specialty cert in your chosen track (PNPT / BTL1 / SC-200 / AWS SS / BSCP / CGRC)
+ One adjacent foundational cert
Year 3+ (senior)
Top-tier cert (OSCP / GCFA / CCSP / CISA / OSWE)
+ Soft skills (board comms, leadership)
Important 2026 Update — CISSP Experience Waiver Cuts
Effective April 1, 2026, ISC2 cut its CISSP experience waiver list from ~50 certifications down to 25. Removed: CEH, CISA, CRISC, OSCP, and others. CompTIA Security+ survived the cut, strengthening its position as a strategic foundation cert for those targeting CISSP. Verify the current list at https://www.isc2.org before relying on a waiver.
Free Training that Maps to These Certs
- Microsoft Learn — full SC- and AZ- paths free.
- AWS Skill Builder — many courses free.
- TryHackMe — Pre-Security, Cyber Sec 101, SOC L1, Jr Pentester paths.
- HackTheBox Academy — many free modules; full CPTS path is paid.
- PortSwigger Web Security Academy — 100% free; preps for BSCP.
- APISec University — 100% free.
- Splunk Fundamentals 1 — free.
- LetsDefend free tier — SOC training.
How to Choose
- Start with a free or cheap foundational cert (CC, Security+, AZ-900).
- Choose your track (AYSEC 101–106) before paying for a specialty cert.
- Pick the cert at the depth one step ahead of your current skill, not three.
- Buy with cash where possible. Renewal fees compound.
- Don't collect certs without portfolio. Two well-deserved certs > five paper certs.