RMFInsider

“How much do cybersecurity certifications actually cost?” The exam fee is the number everyone quotes and it is roughly half the real total. As of 2026, a first cert done honestly runs about $500 to $800 all in: voucher, study material, and a realistic chance of one retake. A three cert stack built over three years lands closer to $2,500 to $4,500 once renewal fees and continuing education are counted. The renewals are the part nobody budgets for, they never stop, and an expired certification can cost you a DoD work role assignment, which is a much more expensive problem than the fee you skipped.

The five cost buckets

• The exam voucher. Published, easy to find, and the only number quoted in the articles you have already read.
• Study material. Anywhere from zero to several hundred dollars depending on how much you are willing to assemble yourself.
• Retake risk. Price it in as a probability, not a surprise. Vendors do not discount a second attempt.
• The renewal or maintenance fee. Annual, recurring, and owed for as long as you hold the credential.
• Continuing education. Measured in hours first and dollars second, and the hours are the real cost.

Bucket one: the exam voucher, as of 2026

Published 2026 pricing, approximate and worth re-checking at the vendor before you buy, because these have moved upward in each of the last several years:

• CompTIA Security+: roughly $439 for a United States voucher.
• CompTIA CySA+: roughly $425 to $450.
• ISC2 Certified in Cybersecurity (CC): roughly $199, with ISC2 having run free exam and training offers through its One Million Certified in Cybersecurity program.
• ISC2 CISSP: roughly $749 for the Americas region.
• ISACA CISA or CRISC: roughly $575 for members and $760 for non-members, which is the rare case where the membership fee pays for itself on a single exam.
• GIAC GSEC: roughly $999 for the exam alone, and dramatically higher if bundled with SANS training.
• AWS Certified Security Specialty: roughly $300.
• Microsoft AZ-500 security associate: roughly $165.

Two patterns are visible immediately. Vendor cloud exams are the cheapest serious credentials on the board, and the training-attached credentials are an order of magnitude above everything else. If budget is the constraint, that spread should shape your plan more than any ranking of which cert is best. The ranked list of entry level certifications worth paying for is useful here precisely because it sorts by return rather than by prestige.

Bucket two: study material

This bucket has the widest range and the greatest room to control. A video course plus a practice exam bank from a reputable instructor runs roughly $50 to $200 as of 2026. Official vendor bundles that pair training with a voucher run several hundred dollars more and are occasionally worth it for the included retake. A full instructor-led bootcamp runs into the thousands and is almost never the right purchase for a self-funded career changer.

You can also run this bucket at close to zero. Vendor documentation, NIST publications, free lab platforms, and open courseware cover the material for every baseline cert on the list above. I have passed exams off free material and a library card. The free cybersecurity training resources actually worth your evenings roundup is where I would start before spending anything, because the paid course is a convenience purchase, not a requirement.

Bucket three: retake risk

Price a retake into your first cert, because the alternative is discovering it mid-panic. Vendors do not offer a free second attempt as standard. CompTIA requires a new voucher for a retake, and while there is no waiting period before a second attempt, a third attempt and beyond requires a fourteen day wait. ISC2 and ISACA likewise charge full price on a retake. So a voucher priced at roughly $439 has a realistic 2026 ceiling of roughly $878 before you have bought a single book.

The practical mitigation is not optimism. It is a practice exam threshold. Do not book the real exam until you are scoring consistently above the pass mark on fresh practice sets you have not seen before. Spending roughly $60 on a practice bank to avoid a retake at roughly $439 is the clearest return on investment in this entire article.

Bucket four: the renewal fees nobody budgets for

Here is the bucket that turns a one-time purchase into a subscription. Every major certification body charges to keep the credential active, and the fee is owed every year whether or not the cert is doing anything for you.

CompTIA continuing education fees

CompTIA’s continuing education program as of 2026 charges an annual fee and requires continuing education units on a three year cycle: A+ at roughly $25 per year with 20 units, Network+ at roughly $50 per year with 30 units, Security+ at roughly $50 per year with 50 units, CySA+ at roughly $50 per year with 60 units, and SecurityX at roughly $50 per year with 75 units.

The redeeming feature is the renewal pyramid. Passing a higher CompTIA exam automatically renews the qualifying certifications beneath it, and the fees for those lower credentials are waived. Hold a stack and you pay at your highest level only. Which means the person paying three separate CompTIA fees is paying for a structure they could opt out of by passing one exam.

ISC2 annual maintenance fees

ISC2 charges an annual maintenance fee: roughly $50 per year for Certified in Cybersecurity and roughly $135 per year for CISSP as of 2026. CISSP additionally requires 120 continuing professional education credits across a three year cycle, with an annual minimum so you cannot leave all of it to year three. Over a three year window that is roughly $405 in fees on top of the original $749 exam. Whether the entry level credential earns its keep at roughly $50 per year is a fair question, and the honest case for and against the ISC2 CC works through it.

ISACA and GIAC

ISACA maintenance as of 2026 runs roughly $45 per year for members and roughly $85 for non-members, plus 120 continuing professional education hours on a three year cycle with a 20 hour annual minimum. GIAC works differently and more bluntly: renewal runs roughly $499 every four years, which is the highest maintenance cost on this list by a wide margin.

Bucket five: continuing education costs hours before it costs dollars

Fifty units over three years sounds trivial until you try to source them while working full time. The units themselves can be free: vendor webinars, conference recordings, published articles, documented on-the-job training, and higher education all qualify under the various programs. What they cost is calendar. Roughly seventeen qualifying hours a year, logged and documented, is a few weekends you will not get back.

The failure mode is predictable. You hold three certifications on three different cycles with three different unit definitions, and in month thirty-four you are frantically watching webinars at double speed to avoid losing a credential. The fix is boring: log units the week you earn them, and consolidate your stack so you are tracking one cycle instead of three. The renewal and continuing education mechanics for CISSP, Security+ and CySA+ post lays out what counts for each program.

The multi-year total for a realistic stack

Take a common career changer path: Security+ in year one, CySA+ in year two, a cloud security associate exam in year three. Approximate 2026 numbers, including one retake somewhere in there because that is realistic:

• Exam vouchers: roughly $1,030 to $1,090 across the three.
• One retake: roughly $439.
• Study material at a modest level: roughly $300 across three years.
• CompTIA continuing education fees: roughly $150 over the three year cycle, paid at your highest level only.
• Cloud recertification when it comes due: roughly $0 to $300 depending on vendor, since Microsoft renewals are free online while AWS recertification carries a fee.

Total: roughly $1,900 to $2,300 over three years for a credible three cert stack with one failure absorbed. Add CISSP at the end of that run and the next three years carry another roughly $749 plus roughly $405 in maintenance. None of that includes the opportunity cost of the study hours, which is the largest line item and the one no invoice shows.

Where the free and funded routes cut the bill

A significant share of this spend is avoidable, and the routes are underused mostly because they require paperwork rather than money. Employer tuition and certification benefits are the obvious one, and a federal contractor with a work role to fill has a direct incentive to pay for the cert that qualifies you for it. Ask before you buy. I have watched a colleague pay out of pocket for an exam the contract would have funded, which is a uniquely annoying way to lose roughly $439.

Beyond employers there are scholarship and apprenticeship routes that cover vouchers outright, and the funded paths in through CyberCorps SFS, apprenticeships and employer paid certs overview covers who qualifies. Veterans should also check benefit reimbursement for certification exams, which covers test fees for approved credentials and is separate from tuition benefits.

Why letting one lapse is the expensive mistake

Everything above is budgeting. This part is risk. In the DoD space your certification is not a decoration, it is a qualification tied to your assigned cyber work role, and an expired credential can make you ineligible for the role you are currently performing. That is not a billing inconvenience. That is a conversation with your program manager about whether you can keep doing your job while you re-qualify.

So treat the maintenance fee as a line item in your household budget, not an annual surprise email. Fifty dollars on a calendar reminder is cheaper than a re-examination, and dramatically cheaper than losing a billable position on a contract.

The honest summary is that certifications are a real expense and a necessary one, and the way to keep the total down is to buy fewer of them in a deliberate order rather than more of them opportunistically. If you want a sequenced plan that tells you which exam to buy this quarter and which to defer, plus the job search campaign that makes the spend pay back, Zero to Hired is built around exactly that tradeoff.