Both exams end with you inside an Active Directory domain and a report someone else could follow. TCM Security's PNPT gets you there over five unproctored days, starting from public research, and finishes with a live debrief. OffSec's OSCP gives you 23 hours and 45 minutes under a proctor and hands you a domain account to start. For most readers the choice comes down to whether the employers they're applying to filter for OSCP by name.
The two exams side by side
| PNPT | OSCP | |
|---|---|---|
| Issuer | TCM Security | OffSec |
| Format | Network penetration test from external OSINT to the domain controller; no flags, no proctor | Proctored practical: three standalone machines and one Active Directory set of three |
| Time | Five days to test, two days to report, then a 15-minute live debrief | 23 hours 45 minutes, then 24 hours to upload the report |
| Passing | Compromise the domain controller, submit a professional report and pass the debrief | 70 of 100 points |
| Price | $499 with 12 months of training and one free retake | $1,699 exam only; $1,749 with 90 days of PEN-200; $2,749 a year for Learn One with two attempts |
| AI tools | Allowed if you disclose their use in the report | Banned, OffSec's own KAI included |
| Experience | None; PJPT first if you have no professional experience | None; TCP/IP, Windows and Linux administration and basic scripting recommended |
| Renewal | Doesn't expire (since April 17, 2023) | OSCP never expires; OSCP+ lasts three years. Extending an existing OSCP+ requires annual coverage plus CPEs or a qualifying exam; a $799 recertification exam can instead earn a new three-year certification without the annual fee |
Where each exam lets you in
The PNPT is built as an external-to-internal engagement. TCM's pass conditions start with open-source intelligence (OSINT) to work out how to attack the network, then ask you to use Active Directory attacks to get past antivirus and egress controls, move laterally and vertically, and take the domain controller. Nobody gives you a foothold. If your research turns up nothing usable, the internal part of the week never begins.
OSCP skips the outside. Its Active Directory set, worth 40 of the 100 points, starts with a supplied username and password, which OffSec describes as a simulated breach. The other 60 points come from three standalone machines at 20 each, half for a low-privilege shell and half for root or administrator. OffSec's exam guide lists four combinations that reach 70, from the full Active Directory set plus three low-privilege flags to a single Active Directory machine plus all three standalones rooted.
That makes the PNPT a single attack path with one finish line, and OSCP a set of separate compromises where partial credit adds up. Someone strong on Windows privilege escalation but weak on domain attacks can still pass OSCP. They can't pass the PNPT.
Reports, debriefs and the rules on tools
Both exams grade the write-up. OffSec wants every step, command and piece of console output, a screenshot for each flag taken from an interactive shell, and enough detail for a reader to repeat the attack; a thin report can cost points or the whole exam. TCM asks for "a detailed, professionally written report" within two days, then sits you in front of its assessors, whom it describes as senior penetration testers, for a 15-minute debrief. Explaining a finding to someone who can push back is daily work in consulting, and OSCP doesn't test it at all.
The tool rules point the other way. OSCP allows Metasploit against one machine only and bans SQLmap and other automatic exploitation tools, mass scanners such as Nessus, and AI chatbots. TCM's exam page says all tools are allowed, including AI-enabled ones, and its May 2026 policy requires you to disclose where, why and how you used AI. There's no proctor, though TCM monitors network traffic in the exam environment. For a hiring manager, an OSCP pass says more about what you can do unaided under a clock. A PNPT pass says more about how you'd run and explain an engagement.
Training, lab time and money
TCM's $499 includes five on-demand courses (Practical Ethical Hacking, Windows and Linux Privilege Escalation, OSINT Fundamentals and the External Pentest Playbook), more than 45 hours in all, with 12 months of access. The labs run on your own machine, and TCM's minimum is 8GB of RAM. Both exam attempts have to fall inside the voucher's 12 months.
OffSec's PEN-200 page puts the course at 321 hours of content, plus challenge labs, three of which OffSec built to resemble the exam. The $1,749 bundle gives 90 days of that and one attempt; Learn One gives a year and two attempts for $2,749. If you've prepared elsewhere, the exam alone is $1,699. Even at the cheapest OffSec route, OSCP costs more than three times the PNPT.
Holding both, and the order
The skills overlap heavily: Active Directory enumeration and attacks, Windows and Linux privilege escalation, pivoting and reporting. TCM's own learning path treats the PNPT as its professional-level network exam, and our penetration tester career progression covers where each sits.
Upkeep is light. The PNPT never needs renewing. OSCP doesn't either, but the OSCP+ designation that comes with a pass today does, and OffSec's maintenance handbook accepts external industry training toward its 120 CPEs, subject to review. Neither credential appears on ISC2's list of credentials that waive a year of CISSP experience. If you're weighing a third option with a longer exam and a heavier report, see OSCP vs CPTS.
Our view
Take the PNPT first if you're paying for it yourself and the jobs you want don't name OSCP. It costs less than a third of OffSec's cheapest course bundle, it tests the full engagement, and the debrief is practice for the part of consulting that technical exams skip. Take OSCP when a posting, a client contract or your employer asks for it. Some practitioners will argue OSCP should come first because its proctor and AI ban make the result harder to doubt, and in markets where recruiters filter on the four letters they have a point.
Sources
- TCM Security: PNPT: format, pass requirements, $499 price, training courses, voucher validity, retake, proctoring and monitoring, tool rules, system requirements, non-expiry, checked October 2026
- TCM Security: AI tools and certification exams: May 2026 disclosure policy, checked October 2026
- OffSec PEN-200 course page: prices, 321 hours of content, recommended background, OSCP and OSCP+ difference, checked October 2026
- OffSec pricing: Course + Cert Bundle and Learn One terms, checked October 2026
- OSCP+ Exam Guide: time, points, passing combinations, restrictions, AI ban, reporting, updated October 12, 2026, checked October 2026
- OffSec CPE Program and Annual Maintenance Handbook: 120 CPEs, $145 fee, $799 recertification exam, external training credits, checked October 2026
- ISC2 CISSP Experience Requirements: approved waiver list, which includes neither credential, checked October 2026