Cybersecurity Certification Costs at a Glance
USD, direct from each vendor, as of September 2026. The first-year range assumes one exam attempt, self-study at the low end and an instructor-led course at the high end, plus any application and first-year maintenance fees.
| Certification | Exam fee | Other fees | Renewal | First year |
|---|---|---|---|---|
| CompTIA Security+CompTIA | $439 | No application fee. Retakes cost a new voucher. | $50 per year CE fee, 50 CEUs every 3 years | $439 to $1,500 |
| ISC2 Certified in Cybersecurity (CC)ISC2 | $199 | Often free through ISC2 promotions. No experience requirement. | $50 per year AMF | $0 to $250 |
| CISAISACA | $575 member, $760 non-member | $50 application fee after you pass. ISACA membership is $135 plus chapter dues. | $45 per year member, $85 non-member, 120 CPE every 3 years | $900 to $4,000 |
| CISMISACA | $575 member, $760 non-member | $50 application fee. Five years of experience required. | $45 per year member, $85 non-member | $900 to $4,000 |
| CRISCISACA | $575 member, $760 non-member | $50 application fee. Three years of experience required. | $45 per year member, $85 non-member | $900 to $4,000 |
| CISSPISC2 | $749 | Five years of paid experience required. Bootcamps run $3,000 to $5,000. | $135 per year AMF, 120 CPE every 3 years | $900 to $5,000 |
| CGRC (formerly CAP)ISC2 | $599 | Two years of experience required. | $135 per year AMF (one fee covers all ISC2 certs) | $750 to $3,000 |
| CCSPISC2 | $599 | Five years of experience required, CISSP can substitute for part of it. | $135 per year AMF | $750 to $4,000 |
| AWS Certified Security - SpecialtyAmazon | $300 | 50% off if you already hold an AWS cert. | Recertify every 3 years, $300 | $300 to $800 |
| Microsoft AZ-500Microsoft | $165 | Free annual renewal assessment on Microsoft Learn. | Free, yearly online renewal | $165 to $500 |
| CEHEC-Council | $950 to $1,199 | $100 eligibility fee if you skip official training. Official courses run $1,950 to $3,600. | $80 per year, 120 ECE credits every 3 years | $1,400 to $4,800 |
| OSCPOffSec | $1,749 course and exam bundle | $2,749 for Learn One with a year of access and two attempts. Retakes $249. | None, OSCP does not expire | $1,749 to $2,749 |
| GIAC GSECSANS / GIAC | About $1,000 exam only | The SANS course that pairs with it is $8,000 or more. | $499 every 4 years | $1,000 to $9,500 |
| GRC Engineering Club membershipCGE-P, CGE-AUD, CGE-AZ included | $0 (included) | $70 a year or $9.99 a month. Training, labs, exam, and certificate for all three. | None. Certs do not lapse. | $70 |
Training Is the Real Variable
Two people can sit the same $749 CISSP exam and spend $900 and $5,000 respectively. The difference is entirely how they prepared. Self-study with the official guide and a question bank runs $100 to $500. A live bootcamp runs $2,000 to $5,000 for the same exam. A SANS course paired with a GIAC exam runs $8,000 or more, which is why almost nobody pays for SANS out of pocket.
The question to ask before buying training is whether the credential tests knowledge or work. Knowledge exams reward a question bank and a schedule. Hands-on credentials like OSCP, the AWS and Azure security exams, and the CGE-P reward lab time, which you can get for the price of a cloud free tier and a membership that includes the labs. For a fuller map of which GRC credentials matter, read the GRC engineering certifications guide.
What $70 a Year Buys Instead
If your goal is a GRC or compliance role, most of the table above is the wrong purchase for a first credential. The GRC Engineering Club was built so that cost is not the thing between you and a certification. Membership is less than a single exam voucher, and the three certifications inside it come with the training and labs to earn them.
What $70 a year gets you in the GRC Engineering Club
Club membership is $70 per year, or $9.99 a month. Every certification in the Training Academy is included. Bought one at a time, the three current certifications are $350 each, so $1,050 of credentials come with a membership that costs less than most single exam vouchers.
- CGE-P, CGE-AUD, CGE-AZ: training, labs, exam, and certificate, no exam fee
- Hands-on AWS and Azure compliance labs you build in your own account
- Weekly private podcast and live Q&A with working GRC engineers
- Mock interviews, playbooks, and live builder sessions
- Local chapters and a Slack of 1,300+ GRC professionals
- Self-reported CPE hours for ISACA, ISC2, and IAPP renewals
Honest caveat: CGE-P is three years old and does not yet carry the name recognition of CISA or CISSP with HR screeners. It does carry a public capstone on GitHub that those exams cannot give you. Many members hold both. See CGE-P vs CISA for the fair comparison.
Frequently Asked Questions
How much does a cybersecurity certification cost?
Most cybersecurity certification exams cost between $165 and $1,199 per attempt in 2026. Entry-level exams like Microsoft AZ-500 ($165), AWS Security Specialty ($300), and CompTIA Security+ ($439) sit at the low end. Mid-career credentials like CISA and CISM ($575 to $760), CCSP and CGRC ($599), and CISSP ($749) sit in the middle. CEH ($950 to $1,199) and OSCP ($1,749 with training) are the most expensive common exams. Add training, a retake, and the first year of maintenance fees and a realistic first-year total is $900 to $5,000 per credential.
What is the cheapest cybersecurity certification?
ISC2 Certified in Cybersecurity (CC) is the cheapest recognized credential. The exam lists at $199 and ISC2 has run it free through its One Million Certified in Cybersecurity program, so many people pay only the $50 annual maintenance fee. Microsoft AZ-500 at $165 is the cheapest vendor security exam. For GRC specifically, GRC Engineering Club membership at $70 a year includes three certifications with no exam fee.
Are there hidden costs in cybersecurity certifications?
Yes. The exam fee is usually less than half of what you pay. ISACA charges a $50 application fee after you pass and $45 to $85 a year to keep the credential. ISC2 charges a $135 annual maintenance fee. CompTIA charges $50 a year in continuing education fees. EC-Council charges a $100 eligibility fee if you skip official training. Retakes cost a full new voucher almost everywhere. Study materials and bootcamps range from $100 to $8,000 on top.
Do employers pay for cybersecurity certifications?
Many do, but usually after you are hired and usually only for the exam voucher, not the training. If you are trying to break in, plan to fund the first credential yourself. That is why entry paths that cost under $500, like Security+, ISC2 CC, or a $70 a year Club membership with certifications included, are the practical starting points.
Which certification should I buy first for a GRC career?
Security+ if you need the vocabulary every job description assumes, ISC2 CC if you want the cheapest first line on your resume, and CISA if you are targeting IT audit and have the qualifying experience. If you want to build compliance automation rather than audit it, the CGE-P is the only certification designed for GRC engineers, and it is included in a $70 a year GRC Engineering Club membership or $350 standalone.