CEH vs PenTest+ vs OSCP (2026): Which Pen Testing Cert Is Right?

By Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3   Published: 10/13/26   8 min read
Cyber Security Careers

Updated October 8, 2026: Prices and exam details below were checked on the official CompTIA, EC-Council and OffSec sites on this date. The current versions are CEH v13, PenTest+ PT0-003 (launched December 17, 2024; CompTIA estimates retirement in 2027 and has not announced a replacement) and the OSCP+ exam OffSec has run since November 1, 2024.

If you want to become a penetration tester, three certifications come up again and again: EC-Council’s CEH, CompTIA’s PenTest+ and OffSec’s OSCP. They test very different things. CEH is a broad multiple-choice exam about attacker tools and techniques. PenTest+ mixes multiple-choice with hands-on simulations and adds the planning and reporting side of a real engagement. OSCP is a 24-hour hacking exam where you break into machines and then write a professional report.

This comparison puts all three side by side and tells you which one fits your goal and budget. For the full details, see our guides to CEH, PenTest+ and OSCP.

CEH vs PenTest+ vs OSCP at a glance

CEH v13PenTest+ (PT0-003)OSCP / OSCP+
VendorEC-CouncilCompTIAOffSec
Exam format125 multiple-choice questionsUp to 90 multiple-choice and performance-based questionsHands-on: 3 standalone machines plus an Active Directory set
Time4 hours165 minutes23 hours 45 minutes, plus 24 hours to submit the report
Passing scoreCut score per exam form, 60% to 85%750 on a 100-900 scale70 of 100 points
EligibilityOfficial training, or 2 years of infosec experience; $100 application feeNone (3 to 4 years of pen testing experience recommended)None
Price (US)$950 remote-proctored voucher + $100 application fee (self-study)$439 voucher ($579 with Retake Assurance)$1,749 course + exam bundle; $1,699 standalone exam; $2,749/year Learn One
Renewal120 ECE credits every 3 years + $80 a year60 CEUs + $150 CE fee every 3 yearsOSCP never expires; OSCP+ lasts 3 years (120 CPE or a retake, plus $145/year maintenance coverage)
Hands-on proofOptional CEH Practical (6 hours, 20 challenges)Performance-based questionsThe whole exam is hands-on
DoD 8140 (Matrix V2.1)CEH listed for 7 work roles; CEH (Practical) for 3Listed for 9 work rolesNot listed

Sources: EC-Council’s CEH page, certification page, exam voucher and continuing education fees; CompTIA’s PenTest+ page, store, CEU and CE fee pages; OffSec’s OSCP+ exam guide, pricing, PEN-200 page, CPE handbook and AMF FAQ; and the DoD 8140 Qualification Matrix V2.1.

What each exam really tests

CEH: breadth of attacker knowledge

CEH covers a wide range: reconnaissance, scanning, enumeration, system hacking, malware, sniffing, social engineering, denial of service, web apps, wireless, mobile, IoT and OT, cloud and cryptography, and v13 adds AI-assisted techniques. The knowledge exam checks that you know what each tool and technique does. It does not ask you to hack anything live. EC-Council’s optional CEH Practical is a six-hour, 20-challenge hands-on exam; passing both earns the CEH Master title.

PenTest+: the whole engagement

PenTest+ follows a real engagement from start to finish. Its domains are engagement management (13%), reconnaissance and enumeration (21%), vulnerability discovery and analysis (17%), attacks and exploits (35%), and post-exploitation and lateral movement (14%). Performance-based questions put you in simulated environments, and scoping, rules of engagement and reporting get real weight.

OSCP: prove you can break in

OSCP is pure practice. You get three standalone machines worth 60 points and an Active Directory set worth 40, with 23 hours and 45 minutes to compromise enough of them to reach 70 points, then another 24 hours to submit a professional report. Weak documentation can cost you points. That is why OSCP carries so much weight with pen testing teams: you can’t pass it by memorizing.

Difficulty

For most people the order is PenTest+, then CEH, then OSCP, but the gap between the first two is small and depends on your background. CEH asks more questions about specific tools; PenTest+ has fewer questions but more scenario work. OSCP is in a different class. It takes most candidates months of lab practice, and plenty of people need a second attempt, which is one reason OffSec’s Learn One subscription includes two exam attempts.

Cost over three years

Here is what each costs if you pass on the first try and keep it current for three years, using prices checked October 8, 2026. Training and retakes are extra.

CertificationExam costUpkeep over 3 yearsTotal
PenTest+$439$150 CE fee (with 60 CEUs), or $0 if you renew another way$439 to $589
CEH (self-study)$950 voucher + $100 application$80 a year = $240 (with 120 ECE credits)$1,290
OSCP (bundle)$1,749 including 90 days of PEN-200$0 for OSCP (never expires); $145 a year = $435 to keep OSCP+$1,749 to $2,184

PenTest+ is clearly the cheapest. CEH costs more and adds a yearly fee. OSCP costs the most up front but includes the training labs, and the base OSCP title never expires. If you want to keep the OSCP+ designation, OffSec requires annual maintenance coverage every year of the three-year cycle, either the $145 AMF or the $299 Annual Membership Program, whether you renew with CPE credits or by retaking the exam. For other budget options, see the cheapest cybersecurity certifications.

Jobs, employers and DoD 8140

BLS doesn’t publish a separate penetration tester category; its closest profile, information security analysts, had a median salary of $129,180 in May 2025 (BLS). For vendor and survey pay figures, see our certification salary guide.

Which should you pick?

Building an offensive security path? The full certification roadmap shows where PenTest+, CEH and OSCP sit relative to Security+ and the defensive certs, so you can pick the order.

Today’s exploit is tomorrow’s lab machine. The CyberExperts Daily Brief covers what changed in security and why it matters, in five minutes, weekday mornings. Get tomorrow’s brief.

Frequently asked questions

Is OSCP harder than CEH and PenTest+?

Yes. OSCP is a nearly 24-hour hands-on exam where you must compromise machines and write a report, needing 70 of 100 points. CEH and PenTest+ are timed exams of 4 hours and 165 minutes.

Which is cheapest: CEH, PenTest+ or OSCP?

PenTest+ at $439 on the CompTIA US store (October 8, 2026). CEH self-study costs $950 plus a $100 application fee. OSCP’s course and exam bundle is $1,749.

Should I take PenTest+ before OSCP?

It’s a common path. PenTest+ teaches the engagement process at a lower cost; OSCP then proves you can actually break in. Neither is a prerequisite for the other.

Do I need experience to take CEH?

You need either official EC-Council training or at least two years of information security experience, and every candidate pays a $100 application fee (official training includes it). PenTest+ and OSCP have no eligibility requirements.

Does OSCP expire?

OSCP never expires. OSCP+, earned with it since November 1, 2024, lasts three years. To keep it, you need annual maintenance coverage ($145 a year AMF, or OffSec’s membership program) plus either 120 CPE credits or a passing retake or qualifying exam.

Which of these count for DoD 8140?

CEH, CEH (Practical) and PenTest+ are listed for several work roles in the DoD 8140 Qualification Matrix V2.1. OSCP is not listed.

Which do pen testing employers prefer?

Pen testing and red team employers usually value OSCP most because it’s hands-on. CEH often appears in HR requirements and government contracts. PenTest+ is a solid, cheaper structured option.

Sources

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.