Security+
セキュリティ＋
Lines served: Education Line · Sep 2026
CompTIA Security+ (SY0-701), earned September 2026: threats and attacks, security architecture, operations and incident response, and governance. The formal credential behind the detection stack it interchanges with.
The credential and the build are the same node
On the map this station shares an interchange with the Security Observability Stack, and that is not decoration. I sat Security+ while already running detection and response for eight sites as the sole responder. The exam did not teach me to do the job; it made me name the things I was already doing, and showed me where my naming was sloppy.
Earned September 2026 against the SY0-701 objectives, valid through 2029.
What it actually covers
| Domain | What it asks about |
|---|---|
| Threats, attacks and vulnerabilities | Attack types, threat actors, and how exposure is identified |
| Security architecture | Segmentation, zero trust, resilience, secure design |
| Security operations | Monitoring, hardening, incident response, digital forensics |
| Governance, risk and compliance | Policy, frameworks, audits, third-party risk |
The operations domain is the one that overlapped hardest with the day job. The governance domain is the one that changed how I write things down.
Where it changed my practice
Two places, concretely.
Risk language. I had been describing findings in terms of what a thing is — an unpatched host, an open port. The framing the exam drills is impact and likelihood against an asset, which is the framing a non-technical owner can actually make a decision with. That is the difference between reporting a vulnerability and getting it funded.
Control categories. Preventive, detective, corrective, compensating. Naming which one a control is exposes the gaps: it is easy to accumulate detective controls, notice everything and prevent nothing, and feel busy while the exposure is unchanged.
What a certification does not tell you
It is worth being straight about this, because a wall of CompTIA logos invites the assumption that the paper is the point.
Security+ is a broad, entry-to-intermediate credential. It establishes vocabulary and coverage. It does not establish that someone has tuned a noisy ruleset, sat with a compromised endpoint at 6am, or defended a cardholder data environment through an audit. The stations on the Projects line are the evidence for that; this one is the evidence that I can talk about it in the same terms as everyone else in the field.
Both matter. Neither substitutes for the other.
Stack: Threats & attacks · Security architecture · Operations & incident response · Governance & risk
Transfers: Security Observability Stack (P)