A final-year student at MUBS messages me after a career talk: “Should I buy CEH this month or Security+?” Another graduate already working helpdesk in Kampala asks whether OSCP is realistic before they have ever read a firewall log. Both questions are really about sequencing, money, and the job you want next, not about which logo looks busiest on LinkedIn.
I advise Applied Computing students, lecture at Nkumba, and hire or recommend juniors into cybersecurity and VAPT support work. This comparison is practical. It starts with CompTIA Security+, branches into defensive versus offensive paths, and tells you when ISC2 CISSP is still too early.
Pick the job family before the voucher
Rough clusters for Kampala and remote-friendly roles:
IT support moving into security: identity, hardening, tickets, basic risk language.
Blue team / SOC: alerts, logs, triage, detection.
Offensive / VAPT: scoped testing, reporting, remediation advice.
GRC / leadership: policy, audits, vendor risk, management communication.
Certifications should match the cluster. Collecting four logos before you can explain TCP handshake troubleshooting wastes savings.
CompTIA Security+: the sensible first professional cert
For most students I coach, CompTIA Security+ is the first paid exam worth scheduling. CompTIA describes it as validating practical skills for core security functions. The current V7 path (SY0-701) remains the active choice for people certifying now, while CompTIA has publicly signalled a V8 update planned around November 2026 on the same product pages.
Why it fits Uganda graduates:
Broad vocabulary: threats, architecture, identity, cryptography basics, operations, governance.
Recognised by many HR filters for junior security and hybrid IT roles.
Pairs well with Network+ knowledge or strong Packet Tracer experience from class.
Study pattern that works beside campus loads: one domain per week, weekend labs on a home VM, weekly practice questions, and a short written explanation of each miss. Memorising dumps without labs fails you in interviews even if you scrape a pass.
After Security+: choose blue or red on purpose
Defensive lean: CompTIA CySA+ or similar analyst-focused credentials, plus SIEM labs. Aim at SOC analyst and incident response junior posts. Build a home lab that ingests sample logs. Learn to write a tidy triage note.
Offensive lean: practical entry exams such as eJPT-style hands-on tests, then longer labs toward OSCP when your fundamentals are stable. Read my VAPT career primer before you spend heavy money on offensive vouchers. Scope discipline matters more than tool screenshots.
I push students to pick one lane for twelve months. Switching every time a YouTube advert appears is how people own PDFs and still cannot clear a helpdesk-to-security interview.
About CEH and expensive multiple-choice trophies
EC-Council’s CEH is widely marketed. In technical hiring conversations I join, practical proof beats a trivia-heavy badge. If your budget is tight, put money into Security+, a solid practical lab subscription, and documented write-ups before you chase a costly multiple-choice brand. Marketing spend is not the same as skill.
ISC2 CISSP: leadership weight, not a student starter
The ISC2 CISSP page positions the credential for experienced security professionals. ISC2 also publishes experience requirements and an exam outline. In short, CISSP expects years of relevant work across domains. Passing an associate path without experience is possible in some cases, but hiring managers still ask what you have operated.
For a fresh MUBS or Nkumba graduate, CISSP is usually the wrong first purchase. Come back to it when you are leading projects, writing policies, or bridging audit and engineering. Until then, Security+ plus proof of work wins.
Cost realism for Kampala students
Exam vouchers, retakes, and learning platforms add up in UGX quickly. Order spending like this:
Free or low-cost labs and official objective lists.
One primary exam aligned to your next job application.
A second exam only after you used the first in interviews or on the job.
Employer sponsorship when you can show a study plan and a role target.
Borrow books, form a BBC study group, and teach each other weekly. Shared accountability cuts retake risk.
What actually gets you hired beside the cert
A GitHub or blog with lab notes (routing break-fix, log triage, hardening checklist).
Python automation for boring tasks; see Python as a first language.
Clean English reports. Security work is communication work.
References from lecturers or internship supervisors who saw you handle production-like pressure.
I have recommended candidates with Security+ and strong labs over candidates with two louder logos and no artefacts.
Worked decision example
Case: Aisha finishes Applied Computing, has Network+ level Packet Tracer skill, helpdesk internship at an ISP, savings for one exam.
Goal: junior security analyst within nine months.
Choice: CompTIA Security+ now.
Parallel: weekly Blue Team labs, one public write-up per month.
Defer: OSCP and CISSP.
Revisit in a year: CySA+ or a practical junior pentest cert if her team’s needs clarify.
Case: Brian already holds Security+, loves breaking lab VMs ethically, and has a supervisor willing to scope internal test networks.
Choice: practical offensive pathway and documented VAPT-style reports.
Defer: management certs.
Study cadence that survives semester pressure
A realistic plan for an Applied Computing student taking Security+ beside coursework:
Monday to Thursday: 45 minutes on one exam domain, notes in your own words.
Friday: 20 practice questions, write every miss.
Saturday: two-hour lab (firewall rules on a VM, password policy demo, or Wireshark capture you generated yourself).
Sunday: teach one concept to your BBC study partner for fifteen minutes.
Teaching forces clarity. Students who only consume video feel prepared until the performance-based questions arrive. Official domain lists on the CompTIA Security+ pages should drive the calendar, not random playlists.
If English exam wording feels heavy, practise paraphrasing each objective aloud in simple Kampala English, then match it back to the formal term. That habit also improves incident reports at work.
Same-day takeaway
Before you pay anyone tonight:
Write your target job title for the next 12 months in one sentence.
Open the official Security+ page and download or list the exam domains.
Score yourself honestly 1 to 5 on each domain.
Plan four study weeks around your weakest two domains, with weekend labs.
Schedule the exam only after two full practice tests at your passing target.
Certifications are tools. In Kampala’s market, the first tool should broaden your language and clear HR filters. Specialise second. Lead later. Spend like an engineer, not like an advert clicked you.