Skip to content
CertGPS
Comparison

CEH vs OSCP: Naming an Attack or Carrying It Out

CEH's 125 questions test whether you know attack techniques; OSCP's 24-hour practical tests whether you can use them. Who needs which, what each costs, and the order.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

CEH vs OSCP: Naming an Attack or Carrying It Out

If a contract or job posting names CEH, you need CEH, and nothing OffSec sells will stand in for it. If nobody is asking for a specific credential and you want to work as a penetration tester, OSCP's 23 hours and 45 minutes of proctored hacking says more about you than 125 multiple-choice questions can. Between the two sits the CEH Practical, a $550 add-on from EC-Council that puts CEH candidates on live machines.

The exams side by side

CEHOSCP
IssuerEC-CouncilOffSec
FormatKnowledge exam (312-50) of multiple-choice questions; optional CEH Practical of 20 challenges on live virtual machinesProctored practical in a private VPN, followed by a written report
Questions or targets125 questionsThree standalone machines and one Active Directory set of three
Time4 hours; Practical 6 hours23 hours 45 minutes, then 24 hours for the report
Passing scoreSet per exam form, between 60% and 85%70 of 100 points
Price$950 remote voucher plus $100 application on self-study; Practical $550; training from $1,699$1,699 exam only; $1,749 with 90 days of PEN-200
ExperienceOfficial training, or two years in information securityNone required; TCP/IP, Windows and Linux administration and basic scripting recommended
Renewal3 years; 120 credits and an $80 annual feeOSCP never expires; OSCP+ lasts three years. Extensions need annual coverage plus CPEs or a qualifying exam; $799 recertification without AMF issues a new three-year certification

Which job each one is for

CEH fits people who need to talk about attacks without running them every day: security operations center (SOC) analysts, auditors, system administrators with security duties, and anyone on a defense contract. EC-Council states that both the knowledge exam and the Practical are approved under US Department of Defense (DoD) 8140. On the self-study route EC-Council asks for two years of information security work, which tells you where it pictures the candidate.

OSCP is the credential for the person doing the testing: a junior penetration tester, an administrator moving into offensive work, or an analyst who wants evidence of hands-on skill. OffSec sets no prerequisites but recommends real Windows and Linux administration and some scripting first. If you're not there yet, PenTest+ vs OSCP covers the gentler entry points.

Recognizing an attack versus running one

The CEH knowledge exam spreads its 125 questions across nine domains under blueprint v5.0. Network and Perimeter Hacking is the largest at 24%, Reconnaissance next at 17%, and wireless, cloud and cryptography get 5% each. EC-Council's handbook gives each of the 20 sub-domains six or seven questions, so the exam rewards breadth: which Nmap scan a firewall drops, which tool cracks which hash, which phase an action belongs to. None of it requires having compromised a host.

OSCP rewards the opposite. You earn its 100 points only by getting shells: 20 for each standalone machine, split between a low-privilege foothold and root, and 40 for an Active Directory set you begin with a supplied domain account. OffSec limits Metasploit to one machine and bans automated exploitation tools and AI chatbots. Then you write a report a stranger could repeat, and missing screenshots can cost you the exam.

EC-Council's own hands-on test is the CEH Practical: six hours and 20 challenges in the iLabs Cyber Range, covering scanning, user enumeration, hash cracking, web application exploitation, SQL injection and weak cryptography. EC-Council's FAQ says it is open book. Passing both CEH exams earns the CEH Master title. It is a real practical exam, but it allows about 18 minutes per challenge, whereas OSCP asks you to chain a foothold into domain compromise over a full day and then document every step.

Pricing CEH Master against OSCP

The self-study bill for CEH Master comes to $1,600 at EC-Council's listed prices: the $100 application fee, the $950 remote voucher and the $550 Practical. OffSec's cheapest OSCP route is $1,699 for the exam alone, or $1,749 with 90 days of PEN-200 course and lab access. Taking official CEH training instead starts at $1,699 for the course before you add the Practical.

Upkeep differs more. CEH costs $80 a year and 120 continuing education credits every three years. OSCP never lapses; only the OSCP+ designation does, and extending it requires annual coverage plus CPEs or a qualifying exam. Passing the $799 recertification exam without the maintenance fee instead issues a new three-year certification.

Holding both, and in which order

A tester needs both when a client or an employer on government work wants CEH on the paperwork. EC-Council's CPE policy awards 40 credits for passing a certification exam related to IT security, so an OSCP pass counts for a third of a CEH renewal cycle. Neither credential waives a year of CISSP experience; ISC2's approved list has no EC-Council or OffSec certification on it.

On order, take whichever one your next job asks for. If both are open, OSCP first is usually the better use of money for a would-be tester, since CEH can be added later if a contract demands it. Someone already in a DoD-mapped SOC role who wants to move toward offense is better off the other way round: CEH secures the current role, and OSCP comes once the lab hours have built up. Our penetration tester career progression covers what follows.

Where we land

If you're self-funding a move into penetration testing, we'd skip CEH and put the money toward OSCP. If CEH is required, take the Practical as well: $550 turns a vocabulary test into something closer to evidence of skill, and the CEH Master title is what we'd put on a CV next to OSCP. Against that, a recruiter filling a contract that names CEH will pass over an OSCP holder without it, and some readers will need the credential that clears the filter before the one that impresses the interviewer.

Sources