comptia a+ network+ security+

The CompTIA Trifecta in 2026: The Order, Timeline, and Cost I’d Actually Plan For

You have seen it thrown around on Reddit and in every “how do I break into IT” thread: the trifecta. People say it like everyone already knows what it means, how long it takes, and what it costs. So you are left doing the math in your head, worried you are about to sink a year of evenings and more than a thousand dollars into the wrong sequence. That is a fair thing to worry about. Getting the order wrong does not just waste money on a voucher, it can mean studying for the harder exam before you have the foundation to actually pass it.

Here is the short version so you can stop guessing.

The quick answer

The CompTIA trifecta is three certifications, taken in this order: A+, then Network+, then Security+. That order is not arbitrary. A+ gives you the hardware and operating-system fundamentals, Network+ builds the networking layer on top, and Security+ assumes you already understand both before it teaches you to secure them.

If you are a working adult studying on evenings and weekends, plan for roughly six to twelve months across all three. On cost, budget somewhere in the range of $900 to $1,100 or more at US list price for the exam vouchers alone, before you spend a cent on study materials. I will break both of those down properly below, because the averages hide a lot.

One nuance up front that the generic definitions skip: if you already work in IT, you may not need A+ at all. More on that in a minute.

The order, and why it holds

The three certs stack on purpose. Each one assumes the last.

A+ is the odd one out because it is actually two exams, not one: Core 1 (220-1201) and Core 2 (220-1202), and you have to pass both to earn the single A+ certification. Those are the current V15 exam codes. If you find a study guide or a Reddit post referencing the older codes, it is out of date. That older version retired in September 2025. Core 1 covers hardware, networking basics, mobile devices, and troubleshooting. Core 2 covers operating systems, security, software, and operational procedures.

Network+ is a single exam, currently N10-009. It is up to 90 questions in 90 minutes, and you need 720 out of 900 to pass. It spans five domains covering networking concepts, implementation, operations, security, and troubleshooting. This is where the abstract stuff from A+ turns into subnets, protocols, and why a given network is slow.

Security+ is also a single exam, currently SY0-701. Up to 90 questions in 90 minutes, a mix of multiple choice and performance-based questions, and you need 750 out of 900 to pass. Its five domains cover general security concepts, threats and vulnerabilities, security architecture, operations, and governance. It is the one most job listings actually ask for by name, and it is the one that satisfies the US Department of Defense baseline for a lot of roles.

If you take them out of order, Security+ will feel like reading a manual in a language you half understand. The vocabulary assumes the network layer you get from Network+, which assumes the hardware layer you get from A+.

Should you skip A+? The honest 2026 debate

This is the part most articles will not touch, so let me be direct.

A+ exists for people entering IT with little to no prior experience. It is the help-desk and desktop-support foundation. If that is you, do not skip it. The two exams are your on-ramp, and skipping them tends to show up later as gaps you have to backfill anyway.

But if you already work in IT, already fix machines, already understand what a subnet is, A+ can be redundant. There is a real and reasonable camp in 2026 that argues an experienced person should go straight to Network+ and Security+, or even swap Network+ for Cisco’s CCNA if networking is the actual career target, and pair that with Security+. That is a legitimate path. CCNA is more networking-heavy and vendor-specific; Network+ is vendor-neutral and broader. Neither is “wrong.”

My honest read: if you are new, do the full trifecta in order. If you already have a year or two of hands-on IT experience, consider going Network+ then Security+ and saving the two A+ vouchers. Do not skip A+ just to save time if you cannot comfortably explain how DNS or a default gateway works, because the money you save on the voucher you will lose twice over in failed attempts.

The real timeline and cost, in one table

Here is what I would actually plan for as a working adult. Study hours assume you are starting near-zero on each topic and studying part-time. Costs are US list price for the voucher, which you should treat as a ceiling, not a promise. CompTIA regularly runs discounts, bundles, and student pricing, so always check CompTIA for current pricing before you buy.

Cert	Exam(s)	Study time (part-time)	Voucher list price (US)
A+	Core 1 (220-1201) + Core 2 (220-1202)	2 to 4 months	~$253 per core (two vouchers)
Network+	N10-009	1.5 to 3 months	~$369
Security+	SY0-701	2 to 3 months	~$404
Trifecta total	4 exams	~6 to 12 months	~$900 to $1,100+ list

A few honest caveats on that table. The study times are wide on purpose, because your starting point changes everything: someone who already builds PCs will blow through A+ Core 1. The costs are voucher-only. Add study materials on top, whether that is a book, a video course, a lab, or practice tests, and the all-in number climbs. And remember all three certs renew every three years, which you can handle through CompTIA’s CertMaster CE, by earning continuing-education units, or by passing a higher-level cert that automatically renews the ones below it.

A realistic run at it

Picture the version of this that actually happens. You start A+ Core 1 in January, studying maybe an hour on weeknights and a longer block on Sunday. Hardware clicks fast, mobile and networking basics take longer. You pass Core 1 in late February, then give Core 2 six weeks and pass it in April. You are now A+ certified, one exam fee lighter than you expected because you caught a CompTIA bundle.

You roll into Network+ with momentum. It is harder than it looks because subnetting demands practice, not reading, but you sit N10-009 in June and clear it. You take two weeks off, then start Security+. This one has performance-based questions that drop you into a simulated scenario, and no amount of highlighting a textbook prepares you for those. You grind timed practice through July and August and pass SY0-701 in early September. Roughly eight months, four exams, and you now hold the full trifecta going into the back half of the year.

That is a normal, unglamorous, completely achievable timeline. It is not a bootcamp sprint, and it does not need to be.

The one study mistake that costs people months

Reading is not studying, and it is the single most expensive mistake on this path. You can read a Security+ book cover to cover, feel confident, walk in, and fail, because recognition is not recall. Passively rereading highlighted notes creates a feeling of familiarity that collapses the moment the exam asks you to produce the answer cold.

What works is active recall and timed practice. Quiz yourself before you feel ready. Sit full-length practice exams under the clock so the 90-minute limit stops being a surprise. And for Security+ especially, practice the performance-based questions specifically, because they are a different muscle than multiple choice and they are where unprepared people bleed both time and points. If you want the deeper study-per-cert breakdown, I wrote a companion piece on the CompTIA certification path and how I would study for each.

FAQ

How long does the trifecta take?

For a working adult studying part-time on evenings and weekends, plan for roughly six to twelve months across all four exams. If you already work in IT and skip A+, you can compress that meaningfully. If you are starting from zero, lean toward the top of that range and do not rush the foundation.

Which cert should I take first?

A+, unless you already work in IT. A+ (both Core 1 and Core 2) builds the hardware and operating-system base that Network+ and Security+ quietly assume. Take them in order: A+, then Network+, then Security+.

Is CompTIA still relevant in 2026?

Yes. Security+ in particular still shows up by name in job postings and satisfies the US Department of Defense baseline for many roles. The vendor-neutral, foundational nature of these certs is exactly why hiring managers still recognize them. They are a floor, not a ceiling, but they are a floor employers trust.

What does the trifecta cost?

At US list price, budget roughly $900 to $1,100 or more for the four exam vouchers alone (A+ is two), before study materials. Treat those as ceilings: CompTIA runs discounts, bundles, and student pricing regularly, so check their site for current numbers. Then remember renewal every three years.

What comes after the trifecta?

Experience first, then senior certs. Certifications like CISSP and CISA are the next rung, but they require real work experience, not just more studying. If you are curious what that jump feels like, I wrote about how hard the CISSP really is and why it tests judgment, not recall.

Where I fit in, and how I can help

Let me be honest about who is writing this. I am a software engineer by training (NUST), and I have spent years building machine-learning and product tools. My connection to the security world is real but modest: across 2022 and 2023 I delivered cybersecurity webinars for a software vendor, GFI Software, sometimes solo and sometimes alongside their regional channel manager, covering topics like security directives, email security, network performance, and firewall-as-a-service, plus general marketing work with cybersecurity companies. I do not hold these certifications, and I am not going to pretend I do. What I do have, from building the practice tools, is a clear view of exactly where people waste time and money on this path, and it is almost always the same place: they read instead of practicing.

That is the gap I built PrepClubs to close. Because this is a stacking journey, you can practice the whole trifecta in one place with the A+, Network+, and Security+ prep banks. These are original practice questions written to the current exam objectives, not the real exam and not affiliated with CompTIA, with performance-based questions where they matter, timed forms that mirror the real clock, and a full explanation on every single question so a wrong answer teaches you something. Every test starts with a free 25-question diagnostic so you can see where you stand before paying anything, and if you want the full set, it is ten full-length forms behind a one-time payment with 30-day access and a Pass Guarantee. It is a one-time purchase, not a subscription, because the goal is to get you certified and out the door, not to bill you every month.

Start with the free diagnostic, find out how far you actually are from a passing score, and build your plan around the answer instead of a Reddit thread. That is the honest way to spend the next six to twelve months and the thousand-odd dollars: on the sequence and the practice that actually get you there.

The CompTIA Certification Path: A+, Network+, Security+ (and How I’d Study for Each)

If you are staring at the CompTIA site trying to figure out which cert to start with, in what order, and whether any of it will actually get you hired, you are not overthinking it. The pathway diagrams are genuinely confusing. They show five career tracks, a dozen certs, arrows going everywhere, and no clear answer to the only question you have: what do I do first, and what do I do next.

Here is the short version, and then I will walk through the reasoning. For almost everyone starting in IT or trying to move into security, the path that works is A+ first, then Network+, then Security+. People in the field call it the CompTIA trifecta. It maps cleanly to real job roles, each cert builds on the last, and Security+ is the one that unlocks the most doors, including the roles that require it on paper.

I am going to lay out why this order, what each cert is actually for, how long each one realistically takes, and the one preparation mistake I see cost people a retake fee more than any other. I am not a certifying body and I have opinions about how to study that come from building the tools people study with, so I will be upfront about where that lens comes from near the end.

The quick answer: the trifecta, in this order

CompTIA groups its certifications into career pathways (core, infrastructure, cybersecurity, data, and professional skills). That is useful for CompTIA and confusing for you. Ignore the map for a second and think in terms of jobs.

A+ is the help desk and IT support cert. It proves you can fix, configure, and support hardware, operating systems, and basic networks.
Network+ is the networking cert. It proves you understand how data actually moves: subnets, routing, ports, protocols, and the vocabulary every other IT role assumes you already have.
Security+ is the entry security cert. It proves you understand threats, cryptography, access control, and secure configuration, and it is the one that appears in job requirements and on U.S. government contractor lists (DoD 8570 / 8140).

If your goal is a security or SOC analyst role, and it is for most people reading this, the honest fastest credible route is A+ to Network+ to Security+. You can skip A+ if you already work in IT and can prove it. You should not skip Network+ before Security+, because Security+ assumes you already understand networking, and candidates who jump straight to it from zero tend to fail the network-heavy questions.

The certs are stackable for a reason. Each one assumes you learned the last one. Skipping a rung does not save time, it just moves the studying to a worse place: the exam room.

What each CompTIA cert is really for

A+ (Core 1 220-1101 and Core 2 220-1102)

A+ is two exams, not one. Core 1 (220-1101) covers hardware, networking basics, mobile devices, virtualization, and troubleshooting. Core 2 (220-1102) covers operating systems, security fundamentals, software troubleshooting, and operational procedures. You need to pass both to hold the cert.

People underestimate A+ because it sounds basic. The content is broad, not deep, and the exams punish you for having gaps. If you have never opened a machine or reimaged a laptop, A+ is where you close those gaps. If you have been doing hands-on support for a year, A+ is mostly confirming what you already know, and you can move fast.

Roles it maps to: help desk technician, desktop support, field service, IT support specialist.

Network+ (N10-009)

Network+ is the rung people most want to skip and most regret skipping. The current exam (N10-009) covers networking concepts, implementation, operations, security, and troubleshooting. In plain terms: what a subnet is, how routing and switching work, what happens on each OSI layer, which ports go with which services, and how to diagnose a network that is down.

Here is why it matters for the security path specifically. Almost every attack and almost every defense is a networking event. If you do not understand how traffic normally flows, you cannot recognize traffic that is wrong. I spent 2022 and 2023 delivering vendor webinars on network performance and firewall-as-a-service topics, and the single clearest pattern was that the people who struggled with security concepts were almost always the people missing the networking layer underneath. Network+ fills that layer.

Roles it maps to: network administrator, network support, junior network engineer, and it is the foundation for the security roles that come next.

Security+ (SY0-701)

Security+ (SY0-701) is the destination for most people on this path. It covers general security concepts, threats and vulnerabilities, security architecture, security operations, and governance and risk. It is broad, it is current, and it is the cert hiring managers and contract requirements actually name.

Security+ is also the point where memorization stops being enough. The exam includes performance-based questions that drop you into a simulated scenario and ask you to do something, not recite something. You cannot re-read your way through those. You have to have practiced the reasoning under time pressure, which is the mistake I want to talk about below.

Roles it maps to: security analyst, SOC analyst, junior security engineer, and it is a baseline requirement for many government-adjacent roles.

The trifecta at a glance

Cert	Exam code(s)	What it proves	Realistic study time	Where it takes you
A+	220-1101 and 220-1102	IT support fundamentals, hardware, OS, troubleshooting	6 to 10 weeks (two exams)	Help desk, desktop and field support
Network+	N10-009	How networks work: routing, subnets, ports, OSI, troubleshooting	4 to 8 weeks	Network admin, and the foundation for security
Security+	SY0-701	Threats, crypto, access control, secure ops, governance	6 to 10 weeks	SOC analyst, security analyst, government-adjacent roles

Study times assume a working adult putting in steady evenings and weekends, not a bootcamp sprint. Move faster if you already work in IT, slower if this is brand new.

The one mistake that costs people a retake

Here is the thing nobody tells you loudly enough, and it is the reason I care about how people study rather than just which certs they pick.

Reading is not studying. Answering timed questions is studying.

Almost everyone preps for these exams the same way: buy the video course, buy the study guide, watch and read cover to cover, feel ready, book the exam. Then they walk in, hit the performance-based questions and the tricky multiple-choice items where two answers both look right, and they freeze. The knowledge was in there. The retrieval was not. Recognizing a concept when a video explains it is a completely different skill from producing the right answer, on the clock, when the question is deliberately trying to trip you.

This is not a CompTIA quirk. It is how the brain works. Passive review builds familiarity, which feels like competence. Active recall under time pressure builds competence. The gap between the two is exactly where retakes happen, and retakes on these exams are not cheap.

So the study loop that actually works is boring and effective: read or watch a domain once, then spend most of your remaining time answering practice questions on that domain, checking why each wrong answer is wrong, and doing timed full-length practice exams close to test day so the clock stops being a surprise. When your practice-exam scores are consistently above the passing line on questions you have not seen before, you are ready. Not when you finished the video course.

If you want a practical rule: for every hour you spend reading, spend two hours answering questions. Most people invert that ratio and pay for it.

Where CISSP and CISA fit (the senior rung)

The trifecta gets you in the door. Two certs come up constantly for the next step, and it is worth knowing where they sit so you do not chase them too early.

CISSP is a senior, management-leaning security cert from (ISC)2. It is broad and deep across eight security domains and it formally requires several years of experience. It is a fantastic target once you are actually working in security. It is the wrong first cert.
CISA is an audit and governance cert from ISACA, aimed at people who audit and assess information systems rather than run them day to day. Lower search demand, but high value in the right roles, and it also expects experience.

Both are exams where the “read cover to cover and hope” approach fails even harder than it does on Security+, because the questions test judgment, not recall. You are picking the best answer among several defensible ones. That is a skill you can only build by drilling the question style repeatedly.

How I would sequence it if I were starting today

A+ if you are new to IT, or skip it if you already work in support and can show it.
Network+, no skipping, because Security+ assumes it.
Security+, and treat the performance-based questions as the real exam.
Get hired, get a year or two of real experience, then aim at CISSP or CISA depending on whether you want to run security or audit it.

Do not collect certs for their own sake. Each one should be tied to a job you actually want. A stack of certs with no hands-on experience behind it reads as exactly that to anyone hiring.

FAQ

Do I need A+ before Network+ and Security+?

Not strictly. A+ is not a prerequisite for the others. But if you are new to IT, A+ builds the base the other two assume. If you already work in support, you can start at Network+.

Can I skip straight to Security+?

You can register for it with no prerequisites, but I would not. Security+ assumes networking knowledge. People who skip Network+ tend to lose the network-heavy questions and end up paying for a retake, which costs more than just doing Network+ first.

What order should I take the CompTIA trifecta in?

A+, then Network+, then Security+. Each builds on the last, and Security+ is the one most job requirements name.

How long does the whole path take?

Realistically four to seven months of steady evening-and-weekend study for someone starting fresh, faster if you already work in IT. The bottleneck is almost never reading time, it is how much timed question practice you put in.

Are CompTIA certs worth it in 2026?

For entry into IT and security, yes. Security+ in particular still shows up in job requirements and government contractor lists. Just remember that the cert opens the door and your hands-on ability keeps you in the room.

Is CISSP a good first certification?

No. CISSP is a senior cert that expects years of experience. Start with the trifecta, get working, and target CISSP later.

Where I am coming from, and what I would actually use to prep

I am a software engineer by training (NUST) and I have spent years building ML and product tools. My direct brush with the security world was delivering cybersecurity webinars for a software vendor across 2022 and 2023, sometimes solo and sometimes alongside the regional channel manager, on topics like security directives, email security, network performance, and firewall-as-a-service, plus a few partner sessions. I am not a certified exam-passer and I am not going to pretend to be one. What that work did give me was a very clear view of the gap between people who could talk about a security concept and people who could actually apply it under pressure. It is the same gap that shows up in the exam room.

That gap is why I ended up building practice-question banks. My team runs PrepClubs, and this year we launched practice banks for exactly the certs on this path: CompTIA A+ (both Core 1 220-1101 and Core 2 220-1102), Network+, Security+, plus the senior rung, CISSP and CISA. Each one has a free 25-question diagnostic so you can find your weak domains before you spend a cent, and then ten full-length practice forms if you want to drill properly. To be clear about what it is: these are original practice questions, not the real exam, and we are not affiliated with CompTIA, (ISC)2, or ISACA. Access is a one-time payment with 30-day access and a Pass Guarantee, not a subscription. Start with the free diagnostic. If you can already clear it comfortably, you may not need us at all, and that is fine, that is the point of making it free.

The certs you pick matter less than how you prepare for them. Read once, then drill questions until the clock stops scaring you. That is the whole game.