Security+ SY0-801 Launches November 17: Six Fundamentals to Master Now

The short version: CompTIA Security+ SY0-801 launches on November 17, 2026, and SY0-701 stays available for about six months afterward. Six fundamentals carry across both versions: physical security, IoT, zero day attacks and disclosure, RFID and NFC, automation and orchestration, and incident response. Getting comfortable with them now prepares you for either exam and for the job itself.

Last week we covered how to choose between SY0-701 and SY0-801, so this week let’s set the calendar aside and talk about the material itself. The most useful thing you can do before launch day is get comfortable with the fundamentals that show up no matter which exam code you sit.

Here are six of them. None of them are new, none of them are going away, and every one shows up in real security work long before it shows up on an exam.

1. Physical Security: Why the Server Room Still Matters

It is easy to think of cybersecurity as purely digital, but an attacker who gets physical access to a server room has skipped past most of your defenses. Locked doors, badge readers, cameras, and visitor logs exist because a person standing next to the hardware can unplug it, copy it, or carry it out the door. That is why disk encryption matters so much. If someone walks off with a drive from a storage array, encryption means they have hardware, not data. Security+ treats physical controls and encryption as partners, and that pairing is a habit worth building early.

2. IoT: The Attack Surface You Are Wearing

Ask people to name an Internet of Things device and most will say a smart speaker. The real definition is much broader. A smartwatch counts. So do a baby monitor, a connected car, a smart thermostat, and the badge reader on that server room door. If it connects to a network, it is part of your attack surface. IoT devices often ship with default credentials, rarely get patched, and can sit on the same network as laptops full of sensitive data. Learning to inventory, segment, and harden them is a skill employers notice.

3. Zero Day Attacks and Responsible Disclosure

A zero day is a vulnerability the vendor does not know about yet, which means there is no patch when attackers start using it. You cannot patch your way out of a zero day, so defense depends on layers: least privilege, network segmentation, monitoring, and a plan for when something slips through. The other half of the story is disclosure. Bug bounty programs and efforts like the Zero Day Initiative reward researchers for reporting flaws responsibly instead of selling them. Finding vulnerabilities the right way is a real career path in security.

4. RFID and NFC: Wireless You Use Without Thinking

Every time you tap a card or phone to pay, you are using near field communication, a short range form of RFID that works within a few centimeters. Many RFID tags have no battery at all and draw their power from the reader’s signal. That convenience is why these technologies show up in employee badges, inventory tags, and payment systems, and it is also why Security+ asks you to understand their risks, from cloned badges to skimming. Short range does not mean no risk.

5. Automation and Orchestration

Computers are very good at doing the same task the same way thousands of times. People are not. Automation takes repetitive security work, like provisioning accounts, applying baseline configurations, or handling a common alert, and makes it consistent. Orchestration ties those automated steps together across tools. The payoff is fewer human errors and faster response, but a badly written script will repeat a mistake just as reliably as it repeats the right steps. CompTIA’s published SY0-801 objectives expand this area to include AI-assisted workflows, so this is a topic that grows with the new version rather than resetting.

6. Incident Response: Deciding What Counts

Here is a question that trips people up: what is a security incident? The real answer is that an incident is whatever your organization defines it to be. A single failed login might be noise at one company and a reportable event at another. Good incident response starts with those definitions, then moves through preparation, detection, analysis, containment, eradication, recovery, and lessons learned. If you only remember one thing, remember that the plan gets written before the incident, not during it.

Build Your Foundation Before Launch Day

None of these six topics belongs to one exam version. They are the shared foundation SY0-701 and SY0-801 are both built on, and they are the same ideas you will use on the job. If you are partway through SY0-701, keep going, since it stays available for about six months after launch. If you are aiming for SY0-801, these six are a great place to start. Either way, pick one topic from this list each week and make sure you can explain it to a friend in plain language, with one real-world example. If you can teach it, you know it.

Talk to you next week.