Skip to main content
Offensive Security (Pentest / Red Team)Listed as a primary cert for that lane. Back to pathway
Back to certifications

OffSec · Offensive security benchmark

OSCP

Finding a route into a target, escalating privileges and documenting an authorised penetration test.

View certification details
Understand the subject

Finding a route into a target, escalating privileges and documenting an authorised penetration test.

Apply it to the work

Useful on scoped testing engagements where you must turn enumeration into a defensible finding and give the client enough detail to fix it.

Build practical evidence

Be able to work in Linux, troubleshoot TCP/IP and adapt small scripts. Practise keeping evidence as you go; reconstructing it at report time is painful.

What you will learn to do

Understand the subject

Finding a route into a target, escalating privileges and documenting an authorised penetration test.

Apply it to the work

Useful on scoped testing engagements where you must turn enumeration into a defensible finding and give the client enough detail to fix it.

Build practical evidence

Be able to work in Linux, troubleshoot TCP/IP and adapt small scripts. Practise keeping evidence as you go; reconstructing it at report time is painful.

Certification essentials

Requirements, costs and keeping it current.

Check the vendor record and ongoing commitment alongside the career guidance.

Pricing view
Market

Vendor record

Renamed

The PEN-200 exam now awards OSCP+, which carries a three-year validity, alongside the lifetime OSCP designation. Existing OSCP holders keep their credential.

Source: OffSec · Read 17 September 2026

Sourced fields only; this does not mean every exam detail has been verified. Pricing and renewal policies have their own sources and check dates. Confirm the currency, tax and final booking total with the vendor.

Role-fit guidance is TechWaymark editorial interpretation. It is separate from the recorded vendor facts and does not measure hiring outcomes.

Costs and renewal

Exam cost
US$1699
Exam format
24-hour practical exam + 24-hour report · TechWaymark-held detail; confirm the exam version with the vendor
Keeping it current

OSCP does not expire. Keeping OSCP+ current requires renewal on a 3-year cycle: 120 CPE credits or an eligible exam route, with maintenance coverage where required.

Renewal sources & exceptions

Extending OSCP+ requires annual AMF or AMP coverage, including the exam-extension route. OffSec also offers a paid recertification exam to earn a new 3-year credential without extending the existing one. These fees are not required to retain lifetime OSCP.

Renewal policy checked 2026-09-28. Check the linked provider policy for current fees and eligibility.

OSCP+ standalone exam product: two attempts within 120 days, no PEN-200 training or labs. This is not the Course + Certification bundle. Confirm tax and the current standalone exam terms before purchase. Vendor price checked 2026-09-24. Check the vendor record before booking.

Current vendor pricing source ↗
Preparation and practical skills

Recommended prior knowledge

  • Solid Linux command line
  • Networking + TCP/IP fundamentals
  • Comfort with Python or Bash scripting
  • Exposure to Active Directory

Common misconceptions

  • OSCP makes you a senior pentester, it's a competent-junior benchmark.
  • Try Harder solves everything, methodology and notes matter more.

What this cert does NOT guarantee

  • Six-figure salary day one
  • Red team operator roles
  • Bug bounty income

Practical skills that matter

  • Enumeration
  • Privilege escalation (Win/Linux)
  • Active Directory attacks
  • Web app exploitation
  • Buffer overflows (legacy)
  • Report writing
Alternatives and related certifications

Where this fits

  • None required
This cert
OSCP

Alternative routes

No single right path. These adjacent options reach similar roles.

  • PNPT
    Practical Network Penetration Tester, strong AD focus, cheaper, vendor-neutral.
  • HTB CPTS
    Hands-on path with comparable rigor and modern web/AD coverage.
  • eJPT → eCPPT
    Affordable INE pathway for self-taught testers.
  • Bug bounty portfolio
    Public writeups and CVEs can substitute for certifications at many shops.

Adjacent & overlapping

  • PNPT
  • CPTS
  • eCPPT
  • CRTO
  • OSEP
  • OSWE
  • pnpt
  • cpts
  • ejpt
Career outcomes and limitations

Realistic first roles

Junior Penetration Tester
Red Team Operator
Application Security Engineer
Offensive Security Consultant
UK role salary estimate
£45k–£68k
TechWaymark practitioner estimate, not survey data. Varies meaningfully by country and employer tier.

How people actually get here

  • Sysadmin / Linux engineer
  • Network engineer
  • Software developer with security interest
  • Self-taught HTB / THM grinders
Market saturation · Moderate

Real-world career variations

Internal red team
Consulting pentester
Application security
Purple team

Timeline expectations

  1. Months 0–2Foundation reading, concepts, vocabulary.
  2. Months 2–4Hands-on labs, documented home projects.
  3. Months 4–6Practice exams, weak-area drills, exam.
  4. Post-examUse target vacancies to guide applications and projects. There is no guaranteed time to a first role.

Study resources

Study options

Choose the right mix for your goals and experience. Links below go to official and third-party resources.

Guided study

Structured resources from established providers can help build knowledge and skills.

Compare study options →

Third-party providers. Commercial terms, pricing and availability apply.

Practice environments

Explore suitable environments for practical work. Check the tools, features and access you need.

Compare practice resources →

External resources. Check current costs and access requirements.

Resources are selected for relevance. Compare access, syllabus coverage and total cost; a listing does not imply a commercial partnership.

Compare the resources for OSCP
CourseProvider source

OffSec PEN-200 (Learn One subscription)

Video + Labs

Check the resource provider for current local pricing
View resource
Exam guideProvider source

OffSec OSCP exam guide and FAQ

Reading

Free resource; confirm current access terms
View resource
LabsExternal resource

HTB Academy. Penetration Tester Path

Hands-on

Check the resource provider for current local pricing
View resource
LabsExternal resource

TJ Null OSCP-like box list

Hands-on

Free resource; confirm current access terms
View resource
BookExternal resource

RTFM: Red Team Field Manual v2

Reading

Check the resource provider for current local pricing
View resource
LabsExternal resource

PortSwigger Web Security Academy

Hands-on

Free resource; confirm current access terms
View resource

Check the current syllabus, access terms and total cost before choosing. Resource inclusion does not guarantee exam success.

Optional home projects

Build something you can explain.

Ideas to explore after choosing a certification, using your own tools and keeping evidence of your work.

Example project evidence
Project evidence map (example)
Scoped assessment notesScope and inputs
Sanitised technical finding and retest planDecisions and reasoning
Evidence record (example)
EvidenceWhat to capture
Scoped assessment notesShow the inputs, scope and decisions behind this record. Another learner can follow the evidence trail without guessing omitted assumptions.
Sanitised technical finding and retest planInclude the evidence supporting your conclusion. The report stays within scope and contains no real credentials or sensitive data.

Produce a reproducible report for an isolated target

You have permission to assess one deliberately vulnerable training machine. The handover must let another tester reproduce the finding and an administrator understand the fix.

Authorised security lab Your own tools Evidence guidance
View project guide
Track this certification

Editorial route and career guidance. No separate external evidence review is recorded for this assessment.

Editorial evidence review: pending · UK market. Vendor facts and prices elsewhere on this page have their own sources and check dates.