Which cert should I take?
Pick a cybersecurity certification that fits your goal, experience, budget and schedule. Take the one-minute quiz, explore how certs connect, or compare them all side by side.
> Compare 28 certs side by side
| Cert | Level | Difficulty | Approx. cost | Study hours | Exam | Best for |
|---|---|---|---|---|---|---|
| eJPTINE Security | Beginner | ♥♥♥♥♥ | $249–$299 | 84h | 48-hour exam window, auto-graded | Complete beginners who want a structured, low-risk first hands-on cert. |
| OSWPOffSec | Beginner | ♥♥♥♥♥ | $450–$1,749 | 76h | 4-hour hands-on exam against a live wireless network | Anyone who wants a short, focused wireless credential. |
| OSWAOffSec | Beginner | ♥♥♥♥♥ | $1,749–$2,749 | 89h | 24-hour hands-on exam against a set of black-box web applications | Newcomers who want a structured web-testing foundation and a step towards OSWE. |
| CJCAHack The Box | Beginner | ♥♥♥♥♥ | $490–$1,260 | 210h | Hybrid gray-box pentest + SIEM alert validation against a real corporate network segment | Newcomers who want both attacker and defender basics before choosing a side. |
| CPTACentri | Beginner | ♥♥♥♥♥ | £399 | 118h | Three-part practical exam, no multiple-choice questions | Beginners who like a broad, guided course covering Linux, AD, web and cloud basics. |
| BTL1Centri | Beginner | ♥♥♥♥♥ | Check vendor | 114h | One practical 24-hour incident response exam, graded with immediate feedback | Beginners who want a practical, well-known first defender cert covering phishing, forensics, SIEM and incident response. |
| PNPTTCM Security | Junior | ♥♥♥♥♥ | $499 | 172h | 5 days to complete the assessment + 2 days to write the report | Learners who want a realistic, report-and-debrief style exam that mirrors a real engagement. |
| OSDAOffSec | Junior | ♥♥♥♥♥ | $1,749–$2,749 | 117h | 24-hour hands-on exam analyzing a live, simulated attack | Defenders who want hands-on detection work tied to MITRE ATT&CK. |
| CRTPAltered Security | Junior | ♥♥♥♥♥ | $249–$499 | 124h | 24-hour hands-on exam + 48h to submit a report | Anyone who wants to learn Active Directory attacks and defences without a huge budget. |
| CWESHack The Box | Junior | ♥♥♥♥♥ | $490–$1,260 | 191h | Hands-on web penetration test against multiple real-world applications | People who want hands-on web exploitation and bug bounty skills on a budget. |
| OSIROffSec | Junior | ♥♥♥♥♥ | Check vendor | 112h | 8-hour exam proctored by an OffSec employee over a private VPN | Defenders who want a hands-on incident response exam built around Splunk and disk forensics. |
| BSCPPortSwigger | Junior | ♥♥♥♥♥ | $99–$600 | 166h | 4-hour hands-on exam, two vulnerable applications | Anyone serious about web security who wants a cheap, highly respected credential. |
| OSCP+OffSec | Intermediate | ♥♥♥♥♥ | $1,749–$2,749 | 365h | 23h 45m hands-on exam + 24h to submit report | Anyone who wants the certification most recruiters know by name. |
| CRTOZero-Point Security | Intermediate | ♥♥♥♥♥ | $500–$550 | 151h | 24 hours of lab time, which you can pause across a 7-day window | Learners who want real C2 and OPSEC tradecraft, not just exploits. |
| CDSAHack The Box | Intermediate | ♥♥♥♥♥ | $490–$1,260 | 128h | Security analysis, SOC operations & incident handling across multiple real networks | Analysts who want a practical SOC path covering SIEM, forensics and malware. |
| CWPEHack The Box | Intermediate | ♥♥♥♥♥ | $490–$1,260 | 129h | Hands-on Wi-Fi penetration test across ad-hoc wireless environments | Testers who want modern Wi-Fi coverage including WPA3 and enterprise networks. |
| eMAPTINE Security | Intermediate | ♥♥♥♥♥ | $599 | 144h | Dual exam design testing both concepts and hands-on skill | Testers who want a structured path into Android and iOS app security. |
| CPTSHack The Box | Junior | ♥♥♥♥♥ | $490–$1,260 | 391h | 10 days total: the hacking and the report both fit in the window | People who want the deepest pentest curriculum for the money and a report-heavy exam. |
| COAEHack The Box | Intermediate | ♥♥♥♥♥ | $490–$1,400 | 179h | Hands-on AI red-team assessment against realistic ML/LLM-integrated infrastructure | People who want a structured AI red-teaming path mapped to the OWASP LLM and ML lists. |
| CAPEHack The Box | Intermediate | ♥♥♥♥♥ | $490–$1,400 | 196h | Advanced Active Directory penetration test in a realistic multi-host AD environment | People who want to go deep on modern AD attack paths after CPTS. |
| eCPPTINE Security | Intermediate | ♥♥♥♥♥ | $599 | 251h | Practical exam in an INE lab. Recent candidates report about 24 hours and questions answered from your findings | Learners who want a practical pro-level pentest exam weighted heavily to Active Directory. |
| OSAI+OffSec | Advanced | ♥♥♥♥♥ | $1,749–$2,749 | 174h | 24h proctored engagement + 24h to submit report | Experienced pentesters who want to add AI and agent security to their toolkit. |
| OSEDOffSec | Advanced | ♥♥♥♥♥ | $1,749–$2,749 | 192h | 48-hour hands-on exam building working exploits against several targets | People who love assembly, debuggers and understanding how memory corruption works. |
| CRTEAltered Security | Advanced | ♥♥♥♥♥ | $299–$699 | 186h | 48-hour hands-on exam in an individual, fully patched Active Directory environment | Anyone who finished CRTP and wants multi-forest Active Directory attack paths built on feature abuse. |
| OSWEOffSec | Advanced | ♥♥♥♥♥ | $1,749–$2,749 | 264h | 47h 45m hands-on exam + 24h to submit report | Strong programmers who enjoy white-box source review. |
| OSEPOffSec | Advanced | ♥♥♥♥♥ | $1,749–$2,749 | 234h | 48-hour proctored exam | Experienced pentesters who want to beat modern defences and EDR. |
| OSEEOffSec | Advanced | ♥♥♥♥♥ | $9,000–$13,000 | 232h | 72-hour hands-on exam against fully patched, modern Windows targets | Seasoned exploit developers chasing the most respected Windows exploitation credential. |
| CWEEHack The Box | Advanced | ♥♥♥♥♥ | $490–$1,400 | 191h | Black-box and white-box web penetration test against modern, hardened applications | Web specialists who want black-box and white-box skills and to write exploits and patches. |
Prices are approximate, in US dollars unless a currency is shown, and change often. Confirm with the vendor before you buy.
> Frequently asked questions
What is the best first hands-on cybersecurity cert?
For most beginners, eJPT (about $249–$299) is the gentlest hands-on start, and CPTA and CJCA are broader guided options. Web-focused learners can start with OSWA or CWES.
Should I take OSCP+, CPTS or PNPT first?
PNPT is the most approachable of the three and mirrors a real engagement with a report and debrief. CPTS has the deepest curriculum for the money, and OSCP+ is the most widely recognised name. Many people move eJPT to PNPT or CPTS to OSCP+.
Do I need OSCP+ before OSEP or OSWE?
OffSec expects OSCP-level experience before OSEP and OSWE. You do not always need the cert itself, but you need the skills. Similar AD and pentest knowledge from CRTP or CPTS can also prepare you.
How much do pentesting certs cost?
Costs range from about $99–$600 for BSCP (plus a Burp Suite Professional licence) and $249–$299 for eJPT, to $1,749–$2,749 for OSCP+. Prices are approximate, in US dollars unless a currency is shown, and change often. Confirm with the vendor before you buy.
How long does it take to prepare for a cert?
It depends on the cert and your experience. eJPT is about 84 study hours, while OSCP+ is about 365 and CPTS about 391. The PWN PATH planner turns those hours into a schedule around your dates.