CompTIA CySA+ Readiness: The Analyst Credential Above Security+
Signature Course No. 442 — A Signature AI Socratic Coaching Course.
Built for Security+ holders and working analysts — your coach starts where you are.
A New Kind of Learning
Socratic coaching, delivered by an agentic AI coach.
Not a course you watch. An AI coach you work with.
The Lighthouse Coach begins by discovering how you think about the subject, teaches what is missing, and gives you realistic practice before asking you to prove that you can use it. You may test out of concepts you already understand, while capstones turn the learning into a practical plan, decision, conversation, or other real-world result.
The curriculum is deliberately authored; the AI delivers it through coaching. It is not an AI randomly generating lessons.
A coach that teaches by asking — not by lecturing
The Lighthouse Coach is an AI Socratic coach built on Cognosco Learning's CompTIA CySA+ Readiness: The Analyst Credential Above Security+ course, in the Risk, Safety & Compliance category. It does not play videos at you. It holds a conversation: it asks you a question, listens to your answer, names the misconception it hears, affirms what you got right, and asks the next question — the way a great coach works in the room.
An analyst's first product is not an action. It is a conclusion someone else can trust. That is this course's premise. Security+ proves you know the vocabulary and the foundations; CySA+ asks whether, handed the outputs of a working security operation — telemetry that disagrees with itself, a scanner report longer than anyone can remediate, an intelligence brief written by someone selling something — you can decide what matters, what to do first, what to hand to whom, and how to say it so a manager, an engineer, or an executive acts on it correctly. The running workplace is Tanglewood Logistics, a fictional regional freight and warehousing company whose small security operations center you join on the first page: tight margins, warehouses around the clock, and systems it cannot afford to have down — precisely the trade-offs this credential tests.
It starts with seeing clearly. You will place the examination itself before you study for it: the four enduring blueprint domains, the analyst's seat — watches, judges, and directs attention — and the currency rule, verify the current objectives on CompTIA's official site before you schedule and again before you sit. Then the seeing half of the credential: intelligence weighed on source, confidence, and relevance; records read for exactly what they can prove; detections built as testable hypotheses; a queue triaged as a series of decisions; a vulnerability re-scored for your own estate; a hunt that can fail honestly; evidence kept so conclusions survive challenge; and every finding written at the strength its evidence earns.
It works in two movements. First, Module 1 — Seeing Clearly: Intelligence, Evidence, and Detection Judgment — work through Concepts 1–9, finishing with The Analyst Judgment Memo; then, Module 2 — Acting Well: Response, Tooling, Risk, and the Examination Itself — work through Concepts 10–18, finishing with The Response and Readiness Brief.
Both capstones produce real artifacts — an Analyst Judgment Memo on a tangled Tanglewood morning: intelligence weighed before it is acted on, an alert cluster's records sorted into proves, suggests, and cannot show, severity re-decided on peak-season facts, a bounded hunt designed, two standing findings re-scored and placed, and the memo closed with what would change the assessment and what is still not known; and a Response and Readiness Brief carrying an incident from first signal to an honest close — scoped from its records, contained at a stated price, eradicated against the adversary's return, recovered in two audiences' versions, folded into the remediation program with owners and expiries, and ending in your own readiness ledger, audited domain by domain.
The honesty standard is part of the course. This course promises readiness and refuses to promise a pass: the examination belongs to CompTIA, its objectives change, and your result depends on work only you can do. It teaches to the enduring blueprint domains — security operations, threat and vulnerability management, incident response and management, and reporting and communication — so a revision changes your checklist, not your competence, and it instructs you to verify the current objectives and version on CompTIA's official site before you schedule and again before you sit. One line binds the whole course: state every claim at the strength the evidence earns — no stronger, no weaker.
The course is self-paced and always on — roughly 30 minutes per concept, about 9 hours in full, taken in as many sittings as you like. You can type your answers, or talk out loud: the Voice Coach speaks its questions and listens to your spoken replies. Learners who already know the material can test out concept by concept.
CompTIA CySA+ Readiness: The Analyst Credential Above Security+ is part of The Lighthouse Signature Series — the online counterpart to the one-day, in-person learning Cognosco Learning delivers.
Course Facts
One full concept, coached end to end — free: verify your email and we’ll send you a link to start.
Already enrolled? Enter the course →
Diagnose → Learn & Practice → Prove → Capstone
Every learner moves through the same discipline a Cognosco instructor would insist on in the room.
Diagnose
The Coach starts where the course starts: with the blueprint and the seat. Take the four blueprint domains and name the one in which you could least defend a decision today, in front of a senior analyst asking why that, why first, why not the alternative — and the evidence that tells you so; say when you last verified the current objectives from the issuing body's own page, and what you have been trusting if the answer is never; and describe the analyst's seat in your own organization — who decides what gets attention, who patches, who decides — and where the analyst's authority ends. Every concept opens with three questions that locate where you actually stand, and your answers shape how deeply the Coach works the concept with you. Everyone begins with Module 1 — no skipping the foundations you only think you have.
Learn & Practice
Work each concept in conversation with the Coach — spoken or written — then practice it against realistic situations until it holds up.
Prove
Every concept ends in proof: answer the check cold and demonstrate the skill. Know it already? Test out and take credit immediately.
Capstone
Finish with two capstones — The Analyst Judgment Memo for Module 1 and The Response and Readiness Brief for Module 2 — that pull the whole course together, and earn the certificate.
What You'll Learn
State every claim at the strength the evidence earns. Every skill in this course is the same discipline at a different depth: separate what the evidence proves, what it suggests, and what it cannot show — then write and speak only the first two, labeled as what they are. Context beats the printed number, every time: a severity score, an intelligence rating, a metric on a dashboard each arrives pre-computed by someone who did not know your estate, and the analyst's job is the re-computation.
Module 1 builds the seeing half. The Analyst Above the Foundation; Intelligence Is a Claim, Not a Fact; What a Record Can and Cannot Prove; Detection Is a Hypothesis; Triage: Severity Is a Decision; The Score Is Not the Risk; Hunting on a Hypothesis; Evidence Discipline; and Say It at the Strength the Evidence Earns — the examination placed, intelligence weighed, records sorted, detections tested, the queue decided, vulnerabilities re-scored, hunts bounded, evidence preserved, and the conclusion written at its earned strength.
Module 2 builds the acting half. The Remediation Order You Can Defend; Scoping and the Containment Trade-Off; Eradication, Recovery, and the Lesson That Lands; Tools Answer Questions; Analysts Decide; Identity Signals: Privilege Tells the Story; Network and Cloud Signals; Risk, Metrics, and the Report That Misleads; How the Examination Thinks; and The Readiness Audit — the order defended as a program, incidents scoped and contained at a stated price, tooling held at its decision rights, identity and cloud signals read at depth, metrics that cannot mislead an honest reader, and your own readiness audited without self-deception.
And it holds its boundary throughout. Another course in this library teaches the daily floor practice of the analyst's desk — the routines, queues, and habits of the working shift. This course stands one level above them and tests judgment about them at credential depth: given the routine's output, what do you conclude, what do you doubt, what do you do next, and what do you refuse to claim? Deep incident-response craft and deployment engineering appear only where the credential blueprint itself names them, and then only as judgment questions, never as craft tutorials.
What you will learn
- Map the CySA+ blueprint, verify its current objectives, and place every study hour against a named domain
- Weigh threat intelligence by source, confidence, and relevance to your own estate — and refuse intelligence that cannot support a decision
- Reason from logs and telemetry: state what a record proves, what it suggests, and what it cannot show
- Build and test detection reasoning: baseline, anomaly, hypothesis, and the discipline of the false positive
- Triage alerts by evidence and business context, and escalate at the right strength and speed
- Judge vulnerabilities in context — beyond the printed score — and defend a remediation order others must live with
- Design a threat hunt that can fail honestly: hypothesis, data, test, and a stated stopping rule
- Handle evidence and records so an investigation survives scrutiny: collection, preservation, and limits
- Run incident judgment through its phases — scoping, containment trade-offs, eradication, recovery, and lessons that change something
- Judge the tooling questions the blueprint asks: what each class of tool can decide, what it cannot, and where automation must stop
- Read identity, network, and cloud signals as an analyst: privilege, movement, and control-plane evidence
- Communicate findings at earned strength — to responders, managers, and executives — and audit your own readiness without self-deception
Everything in the course
- All 18 concepts of CompTIA CySA+ Readiness: The Analyst Credential Above Security+, in 2 modules
- A starting-point check first — the Coach finds where you actually stand before teaching
- Learn, Practice, Prove for every concept — no passive video watching
- A test-out on every concept: prove you know it and move on
- The Voice Coach: talk with the Coach out loud — it speaks, listens, and replies
- A personal Learner Record of your work across the course
- Two capstone exercises: The Analyst Judgment Memo and The Response and Readiness Brief
- A printable session summary whenever you pause
- The Lighthouse Coach completion certificate (Signature Series)
- Your progress is saved as you go — stop anytime, resume where you left off
Built for analysts ready to prove judgment above the foundation
Security+ holders and equivalent practitioners — preparing for the CySA+ credential as the next step above the foundation; and working analysts — in a security operations center, a managed service, or a small internal team — who do the work daily and want the credential that certifies the judgment behind it.
IT professionals moving toward the analyst seat — system and network administrators whose roles increasingly include detection, triage, and response duties.
Team leads — who need to know what the credential actually certifies, so they can judge what a CySA+ holder should be trusted to decide. This course assumes foundation knowledge at Security+ depth: common protocols, basic cryptography vocabulary, identity fundamentals, and the names of the standard controls. It does not re-teach those foundations — where a concept depends on one, it names it and moves on.
Prefer to learn live and in person? The same material anchors Cognosco's one-day programs — browse the in-person catalog.
Start with The Analyst Above the Foundation
$195 — introductory price. One payment. No subscription, no password to manage.
Here is exactly what happens when you enroll:
- Pay securely with Stripe — you are taken straight into the course
- Create your learner profile and begin the Module 1 starting-point check
- Save the access key you are given — it restores your enrollment on any device
- Learn at your pace; your progress is stored in your browser on your device
For the full voice experience, use Chrome and allow the microphone when asked. Typing your answers works everywhere, all the time. Questions before you enroll? Email hello@cognoscolearning.com.
Before you enroll
What is a Socratic coaching session?
A conversation, not a video. Your coach asks a question; you answer — out loud by voice, or by typing — and the coach responds to what you said: naming the misconception it hears, affirming what you got right, and asking the next question. You advance only when you have mastered each concept, so a finished course means the learning held.
How long does it take — and how long do I have?
About 30 minutes per concept. Learn in sittings of any length; your progress is saved as you go. You have a full year from purchase to finish, and you can revisit and retake within that year.
What does the certificate verify?
That you completed every concept and both capstones of this course. Anyone can confirm a Cognosco certificate online — enter its certificate ID on our verification page.
What if it isn't for me — what are the refunds?
If you have not started, cancel for a full refund within seven days of purchase. Once you have started, there is no cash refund — stop before finishing and we credit the full amount you paid toward any other course in the library (credit valid one year from your original purchase). Once you complete the course, no refund or credit applies.
More Signature Courses are coming
CompTIA CySA+ Readiness: The Analyst Credential Above Security+ is Signature Course No. 442. Leave your email and we'll send you news of future Signature Courses and Lighthouse updates as they are announced — nothing else.