Career changers often pick between CEH and Security+ for a first certification, yet the two answer different questions: one proves broad defensive foundations, the other proves a survey of attacker techniques. This guide compares EC-Council's Certified Ethical Hacker (CEH) and CompTIA Security+ on prerequisites, what each exam actually tests, theory versus practical content, US Department of Defense (DoD) 8140 qualification, cost structure, renewal and the roles each credential supports. Credentials are listed alphabetically (CEH, then Security+), and the order is not a ranking. It is written for people entering security from IT or another field, and for managers who fund first certifications. It goes deeper than the single-credential pages: for full exam detail see the CEH Certification Guide and the CompTIA Security+ Guide. Facts are from EC-Council, CompTIA and DoD pages checked in November 2026; issuers change exams and fees, so confirm before you book.
Key takeaways
- Different purposes, not different difficulty levels. Security+ is a broad, vendor-neutral baseline across concepts, threats, architecture, operations and programme management; CEH is a survey of attack categories across 20 modules, viewed from the tester's side.
- Eligibility is the first practical difference. CompTIA recommends, but does not require, Network+ and about two years of experience; EC-Council requires either official training or two years of information security work experience plus a USD 100 application fee.
- Both are multiple-choice at the core, with different hands-on signals. Security+ mixes in performance-based questions within one 90-minute exam; CEH's 125-question knowledge exam is multiple-choice, and hands-on proof sits in the separate, optional 6-hour CEH Practical.
- DoD 8140 is role-based, not certification-based. DoD Manual 8140.03 replaced DoD 8570.01-M and qualifies people per work role and proficiency level; both issuers publish role mappings, and the DCWF Work Role Tool is where you confirm them.
- For most career changers, Security+ first, CEH later if the path is offensive. The exception is a candidate whose employer, contract or target role names CEH, or who already has two years in security and is aiming at testing.
The short answer
If you are new to security and have not yet chosen a specialism, take Security+ first. It assumes less, has no eligibility gate, and gives the vocabulary that every later credential, offensive or defensive, builds on. If you already have about two years in security operations or administration and want to move towards penetration testing or red teaming, or your employer or a contract names CEH, CEH can be the first security credential, ideally followed by the CEH Practical or another practical exam that proves hands-on skill. If you have no IT background at all, neither may be the right first step: the Entry Level Security Certifications Compared guide covers credentials that assume no experience.
Side-by-side comparison
| Item | CEH (EC-Council) | Security+ (CompTIA) |
|---|---|---|
| Current version | CEH v13, also branded "CEH AI" | V7 (SY0-701) live; V8 (SY0-801) expected on or around 17 November 2026 |
| Core exam | Exam 312-50: 125 multiple-choice questions, 4 hours, not open book | Up to 90 multiple-choice and performance-based questions, 90 minutes |
| Pass mark | Cut score per exam form, between 60% and 85% | 750 on a scale of 100 to 900 |
| Hands-on element | Optional CEH Practical: 6 hours, 20 challenges on the iLabs Cyber Range; CEH plus Practical gives CEH Master | Performance-based questions inside the main exam |
| Entry requirement | Official training, or two years of information security work experience, or an earlier CEH (v1 to v7) | None required; Network+ and about two years of experience recommended |
| Application step | Self-study route: eligibility application, USD 100 non-refundable fee, review in about 5 to 10 working days, approval valid 3 months | No application; book the exam directly |
| Content focus | 20 modules from footprinting and scanning to web, wireless, mobile, IoT and OT, cloud and cryptography | Five domains: general concepts, threats, architecture, security operations, programme management and oversight |
| Renewal | 120 ECE credits in three years and a USD 80 annual fee | 50 CEUs in three years and a USD 150 CE fee per period, or a no-fee route |
| Retakes | First retake immediately, then 14-day waits; at most five attempts in 12 months | No wait before the second attempt; 14 days before the third and later attempts; every attempt paid |
| Roles the issuer names | "45+ job roles", for example penetration tester, SOC security analyst, threat hunting analyst | Security analyst, security engineer, systems administrator |
Prerequisites and the eligibility gate
This is the most practical difference for a career changer, and it is often missed.
- Security+: CompTIA's V7 page recommends Network+ and two years in a security or systems administrator role; the V8 page describes the target candidate as a security administrator with about two years of hands-on experience. Both are recommendations. Anyone can book the exam.
- CEH, training route: attending official EC-Council training, directly or through an accredited training partner, gives eligibility without a separate application. EC-Council lists course bundles starting at USD 1,699 on demand and USD 2,499 for live online delivery.
- CEH, experience route: self-study candidates need at least two years of information security work experience, verified through EC-Council's application, with a USD 100 non-refundable fee. EC-Council says review takes about 5 to 10 working days after verifiers respond, and an approved application is valid for three months, so time your study to that window.
The consequence: a career changer with no security work history cannot self-study for CEH. They either pay for official training or wait until they have the experience. Security+ has no such gate, which is one reason it is the common first step. See the Career Change into Cyber Security Guide for how to build the experience that later credentials expect.
Theory versus practical: what each exam measures
Security+: breadth with simulated tasks
Security+ is a single exam that mixes multiple-choice questions with performance-based questions (PBQs), in which the candidate completes a task in a simulated environment instead of choosing an answer. The domain weights show where the marks are.
| Domain | V7 (SY0-701) | V8 (SY0-801) |
|---|---|---|
| General security concepts | 12% | 16% |
| Threats, vulnerabilities and mitigations (V8: and attacks) | 22% | 24% |
| Security architecture | 18% | 19% |
| Security operations | 28% | 27% |
| Security programme management and oversight | 20% | 14% |
Security operations is the largest domain in both versions, and governance, risk and programme topics still make up a meaningful share. That spread is the point: Security+ checks that a candidate can talk to auditors, architects and operations staff in the same language. It does not check that they can run a tool end to end.
CEH: a catalogue of attacks, tested by recall
CEH v13 is built around 20 modules: introduction to ethical hacking, footprinting and reconnaissance, scanning, enumeration, vulnerability analysis, system hacking, malware threats, sniffing, social engineering, denial of service, session hijacking, evading IDS, firewalls and honeypots, web servers, web applications, SQL injection, wireless, mobile platforms, IoT and OT, cloud computing and cryptography. EC-Council says the course covers more than 550 attack techniques with 221 labs, and v13 adds AI-related content, including labs that use AI assistance and coverage of attacks on AI systems.
The labs are part of the training. The 312-50 knowledge exam itself is 125 multiple-choice questions, so passing CEH shows that a candidate recognises techniques, tools and terms, not that they have performed an engagement. The hands-on signal comes from the separate CEH Practical: six hours, 20 challenges in EC-Council's iLabs Cyber Range. Holding both gives the CEH Master designation.
What that means for an employer reading a CV
| Credential held | Reasonable inference | What still needs evidence |
|---|---|---|
| Security+ | Broad baseline across controls, threats, operations and governance; can handle simple simulated tasks | Depth in any tool, investigation or testing skill |
| CEH (knowledge exam) | Familiar with the range of attack categories and their terminology | Ability to carry out authorised testing; defensive operations and governance |
| CEH Master | Has also completed timed practical challenges in a lab | Report writing, scoping and client handling for real engagements |
| Both Security+ and CEH | Foundations plus an attacker-side survey | Hands-on proof, unless CEH Practical is also held |
DoD 8140: how qualification works now
Much of the advice online still refers to DoD 8570 and its baseline certification chart. That framework is gone. DoD Manual 8140.03, effective 15 February 2023, "incorporates and cancels" DoD 8570.01-M. Under 8140 the unit of qualification is the DoD Cyberspace Workforce Framework (DCWF) work role, not the certification.
- Foundational qualification: one of education, training or a personnel certification. A certification must be accredited to ISO/IEC 17024, align with at least 70% of the work role's core tasks and knowledge, skills and abilities, and be approved by the Cyberspace Workforce Management Board.
- Residential qualification: on-the-job qualification covering the role's tasks, which may include a documented period of supervised work. A certificate alone never completes qualification.
- Proficiency levels: Basic, Intermediate and Advanced. An option mapped at a higher level also qualifies at the lower levels.
- Timelines: foundational requirements within 9 months of assignment to a work role, residential requirements within 12 months.
| Question | CEH | Security+ |
|---|---|---|
| What the issuer states about DoD 8140 | EC-Council states CEH is approved under DoD 8140, meeting baseline requirements for four of five Cybersecurity Service Provider roles (Analyst, Infrastructure Support, Incident Responder, Auditor), and lists DCWF work roles 111, 141, 511, 531, 541 and 661; it also states DoD recognises CEH Practical | CompTIA's SY0-701 page lists DoD 8140 work roles including cyber defense analyst, incident responder, vulnerability analyst, security control assessor, system administrator, network specialist, systems planner, IT project manager, information security manager and secure software assessor; the V8 page did not yet list roles when checked |
| Where to confirm | The DCWF Work Role Tool and the DoD 8140 qualification matrices on DoD Cyber Exchange, which are updated on an ongoing basis; then the hiring component, which may add its own requirements | |
| Version caution | Confirm the CEH version and whether the knowledge exam, the Practical or both are mapped for your role and level | Confirm that V8 is mapped before relying on it; V7 English retires on 11 June 2027 |
The practical rule for a candidate aiming at a DoD or defence contractor role: get the work role code and proficiency level from the job posting or hiring manager first, look it up in the matrix, then choose the credential. Choosing first and hoping it maps is the common mistake. See the NICE Workforce Framework Guide for how work roles are defined.
Job demand: how to read postings
No official source publishes a reliable, current count of postings that ask for one credential over the other, so treat any blog figure with caution. A more useful method is to sample postings for the exact role and location you want.
- Read the requirement wording: "Security+ or equivalent" usually signals a baseline or compliance requirement, often from DoD 8140 or a contract. "CEH, OSCP or similar" usually signals an offensive role where the employer will test practical skill at interview.
- Separate filters from differentiators: a credential named as mandatory is a filter you must pass; one named as "desirable" is a differentiator you can substitute with demonstrable work.
- Look at the role level: help desk, junior SOC and systems administrator postings lean towards baseline credentials; penetration tester postings at junior level often list several offensive credentials as alternatives. See the Penetration Tester Career Guide and the SOC Analyst Career Guide.
Cost and renewal over three years
Exam prices vary by country, voucher source and bundle, and neither issuer's pages checked state one global exam price, so compare the cost structure rather than a single number. Check current prices on each issuer's store for your region.
| Cost element | CEH | Security+ |
|---|---|---|
| Route to the exam | Official training (bundles from USD 1,699 on demand, USD 2,499 live online) or USD 100 application fee with two years' experience | Exam voucher only; training optional |
| Exam voucher | Price varies by region and training partner; voucher valid one year from receipt | Price varies by region; retake bundles are sold |
| Retake | Discounted retake voucher; five attempts in 12 months | Full price for each attempt |
| Annual or cycle fee | USD 80 a year under the ECE scheme | USD 150 per three-year period if renewing by uploading CEUs |
| Continuing education | 120 credits in three years, registered each calendar year by 1 February of the following year | 50 CEUs in three years |
| No-fee renewal routes | None stated in the ECE policy; the annual fee applies | Pass the latest Security+ release, earn a qualifying higher CompTIA certification, or complete CertMaster CE |
| Lapse | Suspension for up to 12 months, then revocation and a new exam | Certification expires at the end of the cycle |
Over a three-year cycle, CEH's fixed renewal cost is USD 240 in annual fees plus the time to earn 120 credits; Security+ is USD 150 plus 50 CEUs, or no fee through a qualifying route. The Certification Renewal and CPE Requirements Guide explains how to make one training activity count towards several schemes.
Threat model and career fit: which roles each unlocks
Each credential trains a different mental model, which is why the choice should follow the target role.
- Security+ trains the defender's whole-system view: how controls, architecture, operations and governance fit together. That is the model needed in SOC analyst, security administrator, junior engineer, GRC analyst and IT audit support roles, and it is the language of most security policies and audits.
- CEH trains the attacker's catalogue view: what techniques exist at each phase of an attack. That suits penetration testing, red team support, threat hunting and vulnerability assessment, and helps detection engineers recognise what they are looking at.
- Neither proves operational depth: SOC roles test log analysis and triage; testing roles test hands-on exploitation in a lab and report writing. Plan the credential after the first one around that: for example the CompTIA PenTest+ Guide or the OSCP Certification Guide for testing, and the Penetration Testing Certifications Compared guide for the full field.
Decision criteria
| Your situation | Sensible first credential | Why |
|---|---|---|
| Career changer from a non-security IT role, no specialism chosen | Security+ | No eligibility gate; broad foundations for any path |
| Career changer with no IT background | Neither yet; start with a credential that assumes none, and Network+ or equivalent networking study | Both issuers expect working IT or security experience |
| Target role is a DoD or contractor position | Whichever is mapped to the posted work role and level | DoD 8140 qualification is per work role |
| Two years in security operations, aiming at testing | CEH, then the CEH Practical or another practical exam | Meets the experience route; the practical adds hands-on proof |
| Employer or client names CEH | CEH | A named requirement is a filter |
| Aiming at GRC, audit or security administration | Security+ | Governance and operations content matches the work |
Worked scenarios
A help desk technician with 18 months in IT support wants to move into a SOC. They cannot self-study for CEH without two years of security experience, and the SOC postings they find ask for "Security+ or equivalent". They take Security+, build a home lab for log analysis, and revisit offensive credentials once they have spent time triaging alerts.
A systems administrator at a defence contractor is told their new position maps to a cyber defence analyst work role. Instead of guessing, they ask for the work role code and proficiency level, check the DoD 8140 matrix, find which options are listed for that level, and then pick the one that also fits their next career step. They plan the residential qualification with their manager, because the certificate alone does not complete it.
A SOC analyst with three years' experience wants to join an internal red team. They already meet CEH's experience route and use it for breadth, then sit the CEH Practical or another practical exam because the team lead says interviews include a lab exercise.
Where identity fits
Both syllabuses touch identity, from different sides. Security+ covers authentication, authorisation, access control models and privileged access as controls; CEH's system hacking, session hijacking, web application and cloud modules show how stolen or misused credentials are abused. A first-cert holder adds real value by applying both views to machine identities as well as people: service accounts, API keys and tokens are where many incidents start. See the Non-Human Identity (NHI) Guide and the Service Account Security Guide.
Measuring whether the credential is paying off
For managers who fund first certifications, track outcomes rather than pass counts.
- Role coverage: percentage of staff in DoD 8140 or contract-mapped roles who meet foundational qualification within 9 months of assignment.
- First-attempt pass rate: internal rate per credential, used to adjust study time and support, not to rank people.
- Renewal health: number of credentials within 90 days of expiry, suspension or missed annual fee.
- Applied skill: time for new analysts to triage alerts independently, or for new testers to deliver a reviewed report, before and after the credential.
Framework mapping
| Framework | Reference | How the certification choice relates |
|---|---|---|
| NIST SP 800-53 Rev 5 | AT-3 Role-based Training | Choose credentials that match the role's tasks, not a single list for everyone |
| NIST SP 800-53 Rev 5 | CA-8 Penetration Testing; RA-5 Vulnerability Monitoring and Scanning | Roles where CEH-type attacker knowledge, plus practical proof, supports the control |
| NIST CSF 2.0 | PR.AT-02 | Individuals in specialised roles receive training for relevant tasks |
| NIST CSF 2.0 | GV.RR-04 | Cyber security included in human resources practices, including qualification requirements in job design |
| ISO/IEC 27001:2022 | Annex A 6.3 Information security awareness, education and training | Role-appropriate education, including certification programmes |
| CIS Controls v8.1 | Control 14 Security Awareness and Skills Training | Role-specific skills training |
| DoD Manual 8140.03 | Foundational and residential qualification by DCWF work role | Defines which credentials count for DoD roles |
Common failure patterns
- Following an old 8570 chart: DoD 8570.01-M was cancelled by DoD Manual 8140.03; qualification is now per work role and proficiency level, so check the current matrix.
- Planning CEH self-study without the experience: the self-study route needs two years of information security work and an approved application valid for three months; without them the only route is official training.
- Treating CEH as hands-on proof: the knowledge exam is multiple-choice; employers testing practical skill look for the CEH Practical or another practical exam.
- Studying for the wrong Security+ version: SY0-801 is due on or around 17 November 2026 with different weights; match study material to the exam you book.
- Letting renewal lapse: missing CEH's annual fee or credits leads to suspension and then revocation; missing Security+ CEUs means expiry. Track both in one calendar.
Practitioner checklist
- Write down the target role and, for DoD work, the DCWF work role code and proficiency level.
- Check the role in the DoD 8140 qualification matrix or the DCWF Work Role Tool before choosing.
- Confirm whether you meet CEH's experience route or would need official training.
- Pick the Security+ version (SY0-701 or SY0-801) and buy study material for that version only.
- Download the current exam objectives or blueprint from the issuer and use it as the checklist.
- Budget for the route, voucher, a possible retake and three years of renewal fees.
- Pair the first credential with hands-on evidence: a home lab, write-ups, or a practical exam.
- Put renewal dates, credit targets and annual fees in a calendar the day you pass.
Standards and references
- US Department of Defense: DoD Manual 8140.03, Cyberspace Workforce Qualification and Management Program
- DoD Cyber Exchange: DoD 8140 Qualification Matrices
- EC-Council: Certified Ethical Hacker exam and eligibility
- EC-Council: Certified Ethical Hacker (CEH v13)
- EC-Council: EC-Council Continuing Education (ECE) Policy
- CompTIA: Security+ V7 (SY0-701)
- CompTIA: Security+ V8 (SY0-801)
- CompTIA: Continuing Education Renewal Fees
Related NHI Mgmt Group resources: CEH Certification Guide, CompTIA Security+ Guide, Entry Level Security Certifications Compared, Penetration Testing Certifications Compared, Career Change into Cyber Security Guide.