Skip to content
CertGPS
Comparison

OSCP or CPTS: A 24-Hour Exam or a Ten-Day Engagement

OSCP gives you 23h45m and bans most automation; HTB CPTS gives ten days, a scope letter and a graded report. How the two exams, prices and syllabi differ.

MR
Michael Rodriguez
Penetration Testing Lead
Published
Updated
Read time
6 min
On this page

Related certifications

Topics

OSCP or CPTS: A 24-Hour Exam or a Ten-Day Engagement

Both certify a junior penetration tester who can work through an Active Directory network alone, but they test it differently. OffSec's OSCP gives you 23 hours and 45 minutes, bans most automation and scores you in points. Hack The Box's CPTS gives you ten days and a letter of engagement, and an instructor can fail you on the report alone. For most readers the choice turns on whether the job postings in front of them ask for OSCP by name.

The two exams side by side

OSCPCPTS
IssuerOffSecHack The Box
FormatProctored practical: three standalone machines and an Active Directory set of three, then a written reportBlack-box web, external and internal test of an Active Directory network, with flags to submit and a written report
Time23 hours 45 minutes, then 24 hours to upload the report10 days, with lab and report on the same deadline
Passing standard70 of 100 points, with documentation that lets a reader repeat each stepA points minimum HTB doesn't publish, plus a report an instructor judges commercial grade
Price$1,699 exam only with two attempts; confirm the attempt-validity window; $1,749 with 90 days of PEN-200 and one attempt$210 standalone voucher; $550 Silver Annual plan with CJCA and one specialist exam voucher
PrerequisiteNone; TCP/IP, Windows and Linux administration and basic scripting recommended100% of the 28-module Penetration Tester job-role path
ResultsWithin 10 business days of the reportWithin 20 business days
ValidityOSCP for life; OSCP+ for three years, renewableNo expiry and no renewal

Which tester each one fits

OffSec writes OSCP for penetration testers, security analysts and consultants, and recommends you arrive already comfortable with networking, Windows and Linux administration and some Bash or Python. It suits someone who has that background and needs a credential that HR screens recognize. If a contract or a posting names OSCP, CPTS won't stand in for it.

HTB pitches the CPTS path at people entering penetration testing with little or no experience, and lists junior testers, vulnerability analysts and incident handlers among its audience. The mandatory path starts at network enumeration with Nmap and builds from there, so a system administrator or SOC analyst gets a syllabus and a test in one purchase. A working tester gets less from it, because all 28 modules and their skills assessments must be finished before the voucher can be redeemed.

Points on a clock, or an engagement with a client

OSCP scoring is mechanical. Each standalone machine is worth 20 points, 10 for initial access and 10 for privilege escalation, and the Active Directory set is worth 40. You start the set with a supplied domain username and password, so it's an assumed-breach test. The restrictions shape your plan: Metasploit modules and Meterpreter against one machine only, and no SQLmap, mass scanners, commercial tools or AI chatbots, including OffSec's own KAI. A flag counts only with a screenshot from an interactive shell showing the file and the target's IP address, and OffSec won't accept missing screenshots after submission.

CPTS is black-box. A letter of engagement sets scope and objectives, and you test web applications and an external perimeter as well as the internal domain. HTB lists "manual & automated exploitation" among its knowledge areas, and the path has its own modules on Metasploit and SQLMap, two tools OSCP restricts or bans. Its certification page lists no banned tools. An instructor checks your points against the threshold first, then marks the report, which can fail you even if you captured every flag. Each candidate gets a dedicated lab that can be reset at any time.

The time pressure differs more than the hours suggest. OSCP packs the testing into one day and gives you a second for the report. CPTS spreads both over ten days on a single deadline, and if no report is uploaded in time the voucher expires along with the free retake.

What each syllabus teaches that the other skips

Web testing takes 12 of the 28 CPTS modules: proxies, ffuf, login brute forcing, SQL injection, SQLMap, cross-site scripting, file inclusion, file uploads, command injection, a module on verb tampering, IDOR and XXE, and attacking common applications. There's also a vulnerability assessment module and a full module on documentation and reporting. Active Directory gets one long module, backed by pivoting and both privilege escalation modules, and the path ends with Attacking Enterprise Networks, a simulated engagement from start to finish.

PEN-200 covers ground the CPTS path has no module for: client-side attacks, antivirus evasion, fixing public exploits, and, according to OffSec's course page, exploitation of Amazon Web Services. Its syllabus gives Active Directory three units of its own, and the course ends in nine challenge labs, three of them built to resemble the exam.

Cost, retakes and upkeep

OffSec's retake policy adds a cooling-off period to the price. After a first failure you wait four weeks before booking again, and after a second, eight. OffSec's pages disagree on whether standalone attempts have a 90- or 120-day window, so confirm the deadline in your purchase terms before planning a second try. The 365-day Learn One subscription at $2,749 includes two attempts and a year of lab time.

HTB's Silver Annual plan costs $550 from October 12, 2026 and bundles CJCA plus one specialist voucher, usable for CPTS. HTB's subscriptions help page also lists the standalone CPTS voucher at $210. The retake comes with an instructor's written feedback on what you missed. Most of the cost sits in the path, which needs HTB Academy access and which HTB estimates at 45 days of work. The voucher's one-year clock starts at purchase, so buy it once you can see the end of the path.

Upkeep is where CPTS is cheapest, because it has no renewal at all. OSCP never expires, but under OffSec's maintenance handbook OSCP+ lasts three years and renews through 120 continuing professional education (CPE) credits with the $145 Annual Maintenance Fee, a $799 recertification exam, or a higher OffSec exam. If you earn CPTS after OSCP+, OffSec's CPE handbook accepts external courses with proof of completion, up to 40 credits a year, provided the work was done after your certification date and a reviewer judges it relevant.

One OSCP change needs watching. OffSec's exam-structure blog still announces scaled scoring from December 1, 2026, but its linked announcement returns 404 and the current exam guide gives a 70-point pass mark. Read the guide again before booking a December date.

Our view

For someone learning penetration testing from scratch and paying their own way, we'd take CPTS first. The path teaches in a sensible order, and an exam with a scope letter and a graded report looks more like client work than a 24-hour sprint does. OSCP is the one to buy when a hiring manager or contract asks for it. By then the CPTS path will have covered much of PEN-200's ground, though not evasion, client-side attacks or AWS. A tester with a job offer that depends on OSCP should skip the detour. For the other practical options, see PNPT vs OSCP and our penetration tester career progression.

OffSec's maintenance handbook distinguishes extending an existing certification from obtaining a new one. Extending OSCP+ requires annual maintenance coverage, including when using a qualifying exam; passing the $799 recertification exam without that coverage instead issues a new three-year certification.

Sources