What do cybersecurity certifications pay?
Nov 3, 2026 · 6 min read
Everyone wants the number, so here it is, with the honest fine print up front: a certification does not come with a salary. The ranges below are broad U.S. figures for the roles each credential is commonly tied to. Your actual pay will be set mostly by your experience, your role, your location, and whether you hold a clearance, with the cert acting as a door opener and a tiebreaker.
These are approximate, widely reported ranges for U.S. base salaries, rounded on purpose. They blend entry postings and mid-career roles, so treat them as a map, not a quote. Two people with the same cert routinely land $30,000 or more apart. One more thing: no certification vendor publishes official salary figures for its own certs. ISC2, ISACA, CompTIA, Cisco, and EC-Council do not report pay per credential. The closest official industry sources are the ISC2 Cybersecurity Workforce Study and CompTIA's State of the Tech Workforce report, which track pay and hiring across the field as a whole, not per cert.
The 11 certifications, roughly ranked by pay band (broad compiled ranges)
| Certification | Roles it is commonly tied to | Typical U.S. range (approx.) |
|---|---|---|
| ISC2 CC | Entry-level security support, junior analyst | $50,000 to $75,000 |
| Network+ | Network technician, NOC analyst, junior network admin | $55,000 to $85,000 |
| Security+ | SOC analyst, security analyst, security-focused sysadmin | $65,000 to $100,000 |
| CCNA | Network administrator, network engineer | $65,000 to $100,000 |
| CySA+ | SOC analyst (mid-tier), incident responder, threat hunter | $80,000 to $115,000 |
| PenTest+ | Penetration tester, red team associate | $85,000 to $125,000 |
| CEH | Penetration tester, security consultant | $85,000 to $125,000 |
| CISA | IT auditor, compliance and assurance roles | $90,000 to $130,000 |
| CCSP | Cloud security engineer, cloud security architect | $105,000 to $145,000 |
| CISM | Security manager, GRC lead, director-track roles | $115,000 to $160,000 |
| CISSP | Security architect, senior engineer, security manager | $115,000 to $165,000 |
Read the table the right way
The ranking is mostly an experience ranking in disguise. CISSP and CISM sit at the top because both require five years of verified security experience before you can even hold them, per ISC2's CISSP rules and ISACA's CISM rules, and the people who earn them are mid-career by definition. CC and Network+ sit at the bottom because they are first steps for people with little or no experience. The cert did not create the pay gap; the career stage did. This is why "get CISSP, get $150K" marketing is misleading: pass the CISSP exam tomorrow with no experience and you become an Associate of ISC2, not a senior architect.
The middle of the table is where certs genuinely move money. A SOC analyst with Security+ who adds CySA+ and a year of ticket work becomes a credible candidate for mid-tier analyst and responder roles, a real jump. A network engineer who adds CCNA to experience they already have unlocks postings that were filtered against them. In both cases the cert works because it is bolted onto experience, not instead of it.
A few notes by tier
Entry tier (CC, Network+, Security+, CCNA). At this level the range is wide because the same credential covers students, help desk staff crossing over, and experienced admins formalizing their skills. Expect the lower half of the range with no experience and the upper half if you pair the cert with a year or two of IT work. Government and contractor roles anchored to DoD 8140 baselines are a steady source of Security+ jobs at fair pay.
Analyst and offense tier (CySA+, PenTest+, CEH, CISA). These certs pay when they certify a specialty an employer is short on: SOC depth, testing skills, or audit capacity. Penetration testing ranges are the most volatile here, because a small number of very senior testers pull the top of the band up while junior testing roles are fewer and more competitive than the marketing suggests. Audit is the quiet earner: CISA holders in regulated industries are rarely unemployed.
Senior tier (CCSP, CISM, CISSP). Cloud security remains one of the best paid specialties in the field, which keeps CCSP strong. CISM and CISSP overlap heavily in pay because they draw from the same senior pool; directors and CISOs sit above these ranges entirely, and at that point the credential is table stakes rather than the reason for the salary.
What actually moves your number
- Experience. The biggest factor, and it is not close. Years in role beat letters after your name.
- Role and specialty. Cloud security, offensive security, and architecture pay more than generalist support at the same seniority, which is why CCSP and the pentest certs punch above their level.
- Clearance. In U.S. defense and government contracting, Security+ plus an active clearance is a combination that regularly outearns fancier resumes without one.
- Location and industry. Finance, tech, and defense pay more; so do major metro areas, though remote roles have narrowed the gap.
- The cert itself. It gets you past automated screening and into the interview. After that, you are the product.
So which cert is "worth it"?
The one that unlocks the next role on your path. If you are choosing between two, our comparison of Security+ vs CySA+ and the head-to-head on CISSP vs CISM break down the audiences, and the study guides cover cost, format, and difficulty for all 11. Run the math on your own situation: a $400 exam that moves you into a role paying $15,000 more is the best investment in this industry. A $750 exam you are not ready to use is a donation.
One last pattern worth knowing: the largest pay jumps in security usually come from changing roles, not from annual raises in the same seat. A certification earns its keep at exactly that moment, when it qualifies you for a posting you could not have applied to before. Plan your certs around the moves you want to make in the next two years, and the salary question mostly answers itself.
Sources
No vendor publishes official per-certification salary figures. The industry references named in this post are the ISC2 Cybersecurity Workforce Study (isc2.org) and CompTIA's State of the Tech Workforce report (comptia.org). The ranges in the table are broad ranges compiled from job postings and salary reporting, not official numbers from any vendor.
Pick your next role, then practice for its exam.
Get Premium: 2,200 questions, 11 certs, $12/year