OffSec Certified Professional credential artwork

OffSec Certified Professional (OSCP)

Validates practical penetration testing skills, including enumeration, exploitation, privilege escalation, Active Directory attacks and professional reporting.

Summary

OSCP is OffSec's hands-on penetration testing certification, for people who want to do offensive security work. Instead of multiple-choice questions, you compromise machines in a roughly 24-hour lab exam and then submit a professional report.

Good fit if

  • You want to prove practical pentesting skills, not theory
  • You are aiming for pentesting, red team or offensive work
  • You can commit a few hundred hours to labs

Look elsewhere if

  • You are new to IT and security: Security+
  • You want security management or architecture: CISSP
  • You want a lower-cost pentesting exam first: PenTest+

Salary & jobs

Prerequisites

No required prerequisites. OffSec sets no formal prerequisites. Anyone can buy the course or the standalone exam.

TCP/IP networking

Recommended

A solid understanding of how hosts, ports, protocols and services communicate.

Windows and Linux administration

Recommended

Reasonable experience administering both operating systems from the command line.

Basic Bash or Python scripting

Recommended

Enough to read, adapt and run short scripts.

Cost

USD · Standard pricing
$1,749
Learn One costs $2,749 a year for 365 days of course and lab access, two exam attempts and Proving Grounds. The standalone exam is $1,699 for two attempts without the course. A retake costs $249.

What holders say

Respected, especially on top of experience

Holders say OSCP carries real weight with employers and HR, and works best on top of existing technical experience. One credited it for the foundation behind a later security architect role.

r/oscpLife after OSCP: was it worth it? (Aug 2026)

Sometimes tied to a raise or move

One holder said OSCP contributed to a $35,000 promotion but was only one part of the evaluation, and described it as a starting line rather than proof of being a strong tester.

r/oscpDid OSCP end up helping you? (Dec 2025)

Renewal

OSCP never expires. The OSCP+ designation is valid for three years from the day you pass.

OSCP
No expiry
OSCP+ validity
3 years
CPE route
120 credits over 3 years
Annual coverage
$145 / year USD
Annual Maintenance Fee; the $299 membership includes it

Renew OSCP+ by earning 120 CPE credits over the three years, passing the recertification exam in the six months before expiry, or passing another qualifying OffSec exam such as OSEP, OSWA, OSWE, OSED or OSEE before it expires. The CPE and qualifying-exam routes also need annual coverage through the membership or the maintenance fee. A 90-day grace period follows expiry.

OffSec CPE and maintenance handbook ↗

Alternatives

CompTIA PenTest+ credential artwork
PenTest+$439 required · Intermediate

Penetration testing knowledge in a shorter, cheaper exam with performance-based questions.

Certified Ethical Hacker credential artwork
CEH$1,050 required · Intermediate

A broader ethical hacking credential that HR filters and some government roles list.

Certified Information Systems Security Professional credential artwork
CISSP$884 required · Advanced

Security leadership and architecture rather than hands-on testing.

FAQ

Is the OSCP exam multiple choice?

No. It is a hands-on practical: just under 24 hours working through machines in a lab network, then 24 hours to submit a report.

What is the difference between OSCP and OSCP+?

Passing earns both. OSCP never expires. OSCP+ is the same achievement with a three-year clock, renewed through CPE credits, the recertification exam or another qualifying OffSec exam.

Do I need experience to take the OSCP?

No formal prerequisites. OffSec recommends TCP/IP networking, Windows and Linux administration and basic scripting first.

How much does the OSCP cost?

The PEN-200 Course + Cert Bundle is $1,749 for 90 days of labs and one attempt. Learn One is $2,749 a year with two attempts; the standalone exam is $1,699; a retake is $249.

Can I pass without the Active Directory set?

No. Every passing combination needs some Active Directory points, so the standalone machines alone cannot reach a pass.

Last updated October 2026