Security+ V8: what moved, and how to relabel notes you already wrote
Security+ V8 raises General Security Concepts to 16 per cent and cuts Program Management to 14, adds objective 2.6 on AI threats, moves mitigation into Security Operations and renumbers some objectives. Relabel old notes by topic, not by number.
An objective number in old notes can now point at a different topic.
The weights, side by side
V8 is expected on or around 17 November 2026, so check the CompTIA page for its launch before you book SY0-801.
The five domains keep their order, but the shares change. V7 has 28 objectives. V8 has 27.
| Domain | V7 weight | V8 weight | V8 objectives |
|---|---|---|---|
| 1 General Security Concepts | 12% | 16% | 3 |
| 2 Threats, Vulnerabilities and Mitigations (V7) or Attacks (V8) | 22% | 24% | 6 |
| 3 Security Architecture | 18% | 19% | 4 |
| 4 Security Operations | 28% | 27% | 8 |
| 5 Security Program Management and Oversight | 20% | 14% | 6 |
Security Operations stays the largest domain. The notable swing is in the two ends: concepts up four points, Program Management down six.
Four content moves
- A new objective on AI. V8 objective 2.6 asks you to summarise threats and vulnerabilities of AI usage. It has no V7 equivalent, so no V7 objective maps to it.
- Mitigation changes domain. V7 objective 2.5, mitigation techniques, leaves the threat domain. In V8 it sits inside objective 4.1, applying mitigating controls. The threat domain is renamed Threats, Vulnerabilities and Attacks.
- Governance is reframed. Objective 5.1 becomes governance, risk and compliance artifacts: policies, standards, procedures and guidelines.
- AI appears in operations too. Objective 4.6, automation and orchestration, covers scripts and tools that speed up secure work, including AI-assisted work.
The numbering trap
Domain 3 keeps objectives 3.1, 3.3 and 3.4 in place, and Domain 5 keeps 5.1 to 5.6 one to one. Elsewhere numbers move. In Domain 1, V7 1.3 and 1.4 become V8 1.2, change management, and 1.3, cryptography. In Domain 4, V7 4.6, identity and access management, is V8 4.5, and V8 4.6 means automation and orchestration. These matches are the CredenTrek book's judgement, not an official CompTIA crosswalk.
So a flashcard labelled "4.6" in your V7 deck now points at the wrong topic. Do not trust an old number. Relabel by topic.
A relabelling routine
- List your note files or deck names.
- Next to each, write the topic in your own words, such as "identity and access".
- Look the topic up on the V8 objective list and write the V8 number beside it.
- Move anything filed under threat mitigation into your operations notes.
- Start one new file for objective 2.6.
An hour of this saves you from revising the right fact under the wrong heading.
Re-split your hours
If you use 80 hours, the V8 weights give this split: Security Operations 22, Threats and Attacks 19, Architecture 15, Concepts 13, Program Management 11. Under V7 the same 80 hours would have gone 22, 18, 14, 10 and 16. The biggest change is Program Management, which loses five hours, while Concepts gains three.
What V7 material still does
Most of Domains 3, 4 and 5 map across, and core topics such as cryptography, change management and incident response carry over. Keep the V7 material that teaches those well. Then add a V8 source for objective 2.6, check that the practice bank names SY0-801, and re-sort mitigation under operations.
Questions readers ask
Is there a new objective in Security+ V8?
Do V7 objective numbers still match in V8?
Can I use V7 notes to study for V8?
This article is independent and is not endorsed by CompTIA. Facts change: confirm them on the official page before you act.