Skip to content
Domain

Penetration Testing

Penetration Testing is offensive security with permission. You'll think like an attacker to find vulnerabilities before the bad guys do. This domain is hands-on, technical, and requires creativity and persistence.

PT19 certifications

Why PT matters

Finding vulnerabilities before attackers do saves organizations millions. Pentesters provide the offensive perspective defenders need. You'll get paid to hack (legally), help fix real problems, and stay ahead of the latest attack techniques.

Key areas

  • Network and web application pentesting
  • Vulnerability assessment and exploitation
  • Social engineering attacks
  • Red team operations
  • Wireless security testing
  • Report writing and remediation guidance

Career path in PT

  1. Entry level
    Start as junior pentester, running scans and basic tests
  2. Mid level
    Become senior pentester, leading engagements and red teams
  3. Senior level
    Advance to principal consultant or security architect

Essential skills

Exploitation techniquesTool proficiency (Metasploit, Burp Suite, Nmap)Scripting and automationReport writingCreative problem-solving

Typical roles

Pay and outlook for these roles

US figures from the Bureau of Labor Statistics for the closest BLS occupation to each role. BLS doesn't report pay by specialty and counts most of these roles only within a wider occupation, so each card covers every job in it.

Certifications for PT

Entry1

INE Security

Entry

INE Security Junior Penetration Tester

Proves you can scan, exploit and pivot through a live lab, answering 45 questions during a 48-hour practical exam

Exam
$250
Study
2-4 months

Intermediate7

EC-Council

Intermediate

Certified Ethical Hacker

Tests recognition of attack techniques across nine domains in a 125-question exam, with an optional six-hour hands-on Practical leading to CEH Master

Exam
$950
Study
4-6 months

CompTIA

Intermediate

CompTIA PenTest+

Covers a full penetration test from scoping to report, including Active Directory, cloud and AI attacks, through scenario-based questions rather than a live lab

Exam
$439
Study
2-3 months

TCM Security

Intermediate

Practical Network Penetration Tester

Five-day external-to-domain-controller pentest, followed by a written report and a live debrief with TCM Security assessors

Exam
$499
Study
3-6 months

GIAC

Intermediate

GIAC Certified Web Application Defender

Proves you can prevent and detect common web application flaws, from injection to OAuth and API abuse, the defender's counterpart to GWAPT

Exam
$999
Study
3-5 months

OffSec

Intermediate

OffSec Wireless Professional

A 3h45m proctored practical in which you recover wireless keys by hand and reach the access point in two of three live scenarios

Exam
$799
Study
2-4 months

GIAC

Intermediate

GIAC Web Application Penetration Tester

Proves you can test web applications as an attacker would, on a GIAC exam that includes hands-on CyberLive tasks in live virtual machines

Exam
$999
Study
3-5 months

Advanced7

OffSec

Advanced

OffSec Certified Professional

Proctored 24-hour practical with an Active Directory set; passing now awards lifetime OSCP plus a three-year OSCP+

Exam
$1,699
Study
3-6 months

CompTIA

Advanced

CompTIA SecurityX

CompTIA's senior engineering and architecture exam, formerly CASP+, scored pass/fail and built almost entirely on scenario and requirements-based objectives

Exam
$544
Study
6-12 months

GIAC

Advanced

GIAC Penetration Tester

Proves you can plan and run an enterprise penetration test, from reconnaissance to Kerberos and Entra ID attacks, in an exam with CyberLive tasks

Exam
$999
Study
4-6 months

Hack The Box

Advanced

Certified Penetration Testing Specialist

Proves you can attack web, external and internal Active Directory targets over ten days, then write a commercial-grade report

Exam
$210
Study
4-8 months

Zero-Point Security

Advanced

Certified Red Team Operator

Proves you can run adversary simulation with Cobalt Strike; the £399 course includes unlimited free exam attempts

Exam
$529
Study
3-6 months

Expert4

OffSec

Expert

OffSec Web Expert

Proves you can find chained web vulnerabilities by reading source code, then automate the full attack in one unattended script within 48 hours

Exam
$1,749
Study
4-8 months

OffSec

Expert

OffSec Experienced Penetration Tester

Proves you can breach a defended corporate network and reach a set objective in a proctored 48-hour practical that never expires

Exam
$1,749
Study
6-12 months

OffSec

Expert

OffSec Exploit Developer

Proves you can reverse engineer Windows binaries and write exploits that bypass DEP and ASLR, across three tasks in a 48-hour proctored exam

Exam
$1,749
Study
6-12 months