Cisco just pushed through the biggest change to its security certification portfolio in more than six years, and it centers on one exam almost every security-focused Cisco candidate eventually has to sit: SCOR 350-701, the core requirement for CCNP Security and CCIE Security. On August 27, 2026, the exam moved from v1.1 to v2.0, and Cisco’s own team described it during a live session earlier that month as the biggest update to the security certification lineup since the current framework launched.<\/p>\n
If you passed SCOR years ago, are mid-study right now, or are trying to decide whether CCNP Security is even worth pursuing in 2026, the practical questions are the same: what actually changed on the exam, does an old pass still count, and what does this credential pay once you have it. Here’s what’s real, sourced directly from Cisco’s own certification team and the published exam blueprint, not secondhand guesswork.<\/p>\n
SCOR v1.0 launched in February 2020 and received exactly one minor update in the six and a half years since. Cisco’s own certification program manager, Francois Caen, called the new v2.0 blueprint the first major revision in that entire stretch, and said candidates who studied against v1.1 material should treat v2.0 as new content rather than a refresh. That’s a notably blunt admission from a vendor that usually frames updates as incremental. A similar pattern played out earlier this year when Cisco split its wireless track into a standalone CCNP Wireless certification<\/a>, rebuilding a legacy blueprint around how the technology is actually deployed today rather than a decade-old product catalog.<\/p>\n The reason for the overhaul is straightforward. The old blueprint reflected a 2020 security stack built around on-premises appliances and manually configured VPN tunnels. The new one reflects what a security engineer actually touches in 2026: cloud-delivered security, AI-integrated attack surfaces, and identity-first access models that replaced the old perimeter.<\/p>\n Cisco’s published exam topics document breaks the new blueprint into six weighted domains, and three of them contain content that simply did not exist on the old exam.<\/p>\n Domain 1.0 (Security Concepts, 20% of the exam) now includes a dedicated objective on vulnerabilities in AI and large language model systems: prompt injection, system prompt leakage, weaknesses in vector and embedding stores, and AI supply chain risk. It’s specific enough that a candidate needs to understand how an LLM-integrated application can actually be attacked, not just that AI exists as a buzzword.<\/p>\n The same domain now lists post-quantum cryptography as a named cryptography security component alongside PKI, TLS, and IPsec, and references PQC directly as an attack-surface consideration. This tracks with the wider industry timeline: NIST finalized its first three post-quantum encryption standards<\/a>, ML-KEM, ML-DSA, and SLH-DSA, back in August 2024, and enterprise security teams have spent the two years since figuring out migration paths. Cisco folding PQC into a foundational security exam in 2026 means the concept has moved from research curiosity to something a working network security engineer is expected to at least explain.<\/p>\n Domain 4.0, Secure Service Edge, is worth 10% of the exam on its own and covers SSE and SASE architecture, configuring Cisco Secure Access for both internet and private access, AI guardrails for data loss prevention, and reading Secure Access Investigate risk scores. None of this existed as a standalone domain on v1.1. It reflects how much of enterprise security has shifted away from site-to-site VPNs and toward cloud-delivered access brokering in just a few years.<\/p>\n Two separate objectives now name Splunk directly, once for ingesting cloud logging and monitoring data and once for orchestrating and automating security operations, alongside a broader objective on native AI and machine learning telemetry inside XDR and SIEM\/SOAR platforms. Cisco closed its acquisition of Splunk in March 2024, and this is the clearest sign yet that the integration has reached the certification curriculum, not just the product roadmap.<\/p>\n Here’s how the full domain breakdown weights out on the new exam:<\/p>\nWhat’s Actually New in the SCOR 350-701 v2.0 Blueprint<\/h2>\n
AI and LLM Security Gets Its Own Exam Objective<\/h3>\n
Post-Quantum Cryptography Enters the Core Curriculum<\/h3>\n
Secure Service Edge Is an Entirely New Domain<\/h3>\n
Splunk and Cisco XDR Show Up in Network Visibility<\/h3>\n