Ethical Hacking Certifications Ranked for Beginners (2026): eJPT, PenTest+, CEH, OSCP and GPEN

Updated October 28, 2026. Exam details come from INE, CompTIA, EC-Council, OffSec and GIAC’s own pages, checked on that date. Fees change often, so we link to each official price page instead of listing them.

Five certifications cover most ethical hacking job postings: INE’s eJPT, CompTIA PenTest+, EC-Council’s Certified Ethical Hacker (CEH), OffSec’s OSCP and GIAC’s GPEN. They are not equally friendly to beginners. One is built for people with little or no security experience. Others recommend years of work first, and one is a 24-hour hands-on exam.

Below we rank them in the order a beginner can realistically take them, using each issuer’s own recommended experience and exam format. The ranking is ours; the facts are theirs.

Ethical hacking certifications ranked for beginners

Sources: INE eJPT, CompTIA PenTest+, EC-Council CEH and its eligibility page, OffSec PEN-200 and OSCP, GIAC GPEN, ISC2 CC, CompTIA Security+ and the DoD 8140 Document Library (Qualification Matrix V2.1, work role 541, Vulnerability Assessment Analyst).

Before any hacking cert: get the basics on paper

Every exam below assumes you understand networking, operating systems and core security ideas. ISC2 says you do not need experience for its Certified in Cybersecurity (CC), which makes it a low-risk first credential. CompTIA Security+ is the broader baseline: DoD 8140 Matrix V2.1 lists it for 19 work roles. CompTIA recommends Network+ and two years in a security or systems administrator role for the current exam, SY0-701, and says the next version, SY0-801, launches on or around November 17, 2026. Our Security+ exam guide and ISC2 CC guide cover both, and our certifications with no experience list has other starting points.

1. eJPT: the beginner’s hands-on pentest exam

INE describes the eJPT as “a hands-on, entry-level Red Team certification” and says it is “designed for individuals with little to no cybersecurity experience” (INE). That makes it the only cert on this list whose issuer aims it squarely at beginners.

The exam is practical. In March 2026 INE updated it from 35 to 45 questions and kept the 48-hour hands-on format. INE weights the domains this way:

• Host and Network Penetration Testing (35%): modifying exploits, Metasploit, pivoting with routes and port forwarding, brute-force attacks and hash cracking.
• Assessment Methodologies (25%): finding hosts, open ports, services and operating systems, and gathering company information from public sources.
• Host and Network Auditing (25%): pulling user, system and network information from a target and moving files to and from it.
• Web Application Penetration Testing (15%): finding hidden files and directories, web recon and brute-forcing logins.

eJPT is not in the DoD 8140 matrix, so it will not satisfy a federal qualification requirement. Its value is practice: you finish it having actually exploited and pivoted through machines. INE points eJPT holders to its eCPPT as the next step (INE), and its March 2026 announcement covers the exam update.

2. CompTIA PenTest+: the vendor-neutral pentest exam employers recognize

PenTest+ V3 (exam PT0-003) launched December 17, 2024. CompTIA says it validates “your ability to identify, mitigate, and report system vulnerabilities” across cloud, web apps, APIs and IoT (CompTIA). The exam has a maximum of 90 multiple-choice and performance-based questions in 165 minutes, with a passing score of 750 on a 100 to 900 scale.

The five domains and their weights:

• Attacks and exploits (35%): network, authentication, host-based, web application and cloud attacks, plus prompt injection and model manipulation against AI systems.
• Reconnaissance and enumeration (21%): OSINT, DNS and directory enumeration, tools such as Nmap, Wireshark and Shodan, and modifying Python, PowerShell and Bash scripts.
• Vulnerability discovery and analysis (17%): authenticated and unauthenticated scans, SAST and DAST, and weeding out false positives.
• Post-exploitation and lateral movement (14%): persistence, lateral movement, cleanup and attack narratives.
• Engagement management (13%): scoping, rules of engagement, authorization letters and reports.

CompTIA recommends 3 to 4 years in a penetration tester role plus Network+ and Security+ knowledge. That is a recommendation, not a requirement, so a beginner can sit it, but the exam is written for working testers. PenTest+ has the widest DoD 8140 footprint of the five: Matrix V2.1 lists it at Intermediate for eight work roles, including 541 Vulnerability Assessment Analyst, and at Advanced for 212 Cyber Defense Forensics Analyst. Our PenTest+ exam guide has a study plan.

3. CEH: the credential behind the “certified ethical hacker” title

“Certified Ethical Hacker” is EC-Council’s credential, so when a posting asks for a certified ethical hacker, this is the cert it means. The current version is CEH v13. EC-Council says the program spans 20 modules with 221 hands-on labs (EC-Council).

• Knowledge exam: 125 multiple-choice questions in 4 hours, taken online through the ECC exam portal. EC-Council gives the passing score as a range, 60% to 85%.
• CEH Practical (optional): 20 challenges in 6 hours in EC-Council’s iLabs Cyber Range. Passing both the knowledge exam and the practical earns the CEH Master designation.
• Eligibility: take official EC-Council training (iClass, an Authorized Training Center or an Academia Partner), or apply to sit the exam without training. The second route requires verifiable proof of at least two years of information security work (EC-Council eligibility).

For beginners that eligibility rule matters. Without two years of security work, the official training route is the only way in. EC-Council itself recommends its Cybersecurity Essentials series for entry-level candidates first. In DoD 8140 Matrix V2.1, CEH is listed at Basic for role 541 and at Intermediate for roles including 531 Cyber Defense Incident Responder; CEH Practical is listed at Intermediate for 541. See our CEH exam guide and the CEH vs PenTest+ vs OSCP comparison.

4. OSCP: the hands-on exam that tests whether you can actually do it

OffSec’s OSCP comes with the PEN-200 course. OffSec says there are “no formal prerequisites” but strongly recommends a solid understanding of TCP/IP networking, reasonable Windows and Linux administration experience, and familiarity with basic Bash or Python scripting (OffSec).

The exam is a 24-hour proctored test in a private VPN, watched by an OffSec employee. It has three standalone machines, graded on initial access and privilege escalation, and one Active Directory set: a simulated breach across three machines.

Passing the exam earns both OSCP and OSCP+. OffSec says the OSCP never expires. The “+” lasts three years, and you keep it by passing a recertification exam, passing another qualifying OffSec exam (OSEP, OSWA, OSED or OSEE) or completing OffSec’s CPE program. OSCP is not in DoD 8140 Matrix V2.1. Most beginners take it after eJPT or PenTest+, once they can work through a box on their own. Our {I(“/oscp-exam/”,”OSCP exam guide”)} has more.

5. GPEN: the GIAC route, usually employer-funded

GIAC’s GPEN covers pen test planning, scoping and recon, scanning, exploitation, post-exploitation and pivoting, Azure attacks and password attacks (GIAC). The exam has 82 questions in 3 hours with a 73% passing score and includes CyberLive questions in live virtual machines. The affiliated course is SANS SEC560: Enterprise Penetration Testing, which SANS runs as six days instructor-led or 36 hours self-paced with 30 hands-on labs. You can also buy a GIAC attempt without the course.

GPEN sits last here because GIAC aims it at people who already assess networks and systems, not because it is the hardest exam. DoD 8140 Matrix V2.1 lists GPEN at the Advanced level for role 541, the highest of the five.

Which ethical hacking certification should you take first?

• No security background: ISC2 CC or Security+, then eJPT for your first hands-on hacking credential.
• A posting asks for a certified ethical hacker: CEH, through official training if you lack two years of security work.
• You want a DoD or defense contractor job: PenTest+ or CEH, both listed for role 541 in the DoD 8140 matrix. Our DoD 8140 guide lists every role.
• You can already root practice machines: OSCP.
• Your employer funds SANS: GPEN through SEC560.

Ethical hacking is one branch of a wider plan. Our cybersecurity certification path shows how offensive certs fit next to SOC, cloud and GRC routes, and the best cybersecurity certifications for 2026 compares the wider field. If you like the investigation side of security more than the attack side, see our incident response certifications guide.

Who pays for ethical hacking certifications

Ask your employer before you buy anything. Many security teams have a training budget, and some contracts require a DoD 8140 qualification, which makes the case for you. Each issuer publishes its own prices and payment options:

• CompTIA PenTest+: exam vouchers and bundles with a retake are on the PenTest+ buy page.
• EC-Council CEH: training packages include the exam voucher; contact EC-Council through the CEH page or apply for the exam-only route on the eligibility page.
• OffSec OSCP: OffSec sells PEN-200 as a yearly subscription, a 90-day course bundle or a standalone exam attempt on the PEN-200 page.
• GIAC GPEN: fees are on GIAC’s pricing page, and SANS publishes a SEC560 justification letter you can give your manager.
• INE eJPT: options are on the eJPT page.

Ethical hacking certification questions

Sources

• INE Security, eJPT Certification: ine.com
• INE, updated eJPT certification announcement (March 26, 2026): ine.com
• CompTIA, PenTest+ (V3, PT0-003): comptia.org
• CompTIA, Security+ V8 (SY0-801): comptia.org
• ISC2, Certified in Cybersecurity (CC): isc2.org
• EC-Council, Certified Ethical Hacker (CEH): eccouncil.org
• EC-Council, Application process and eligibility: cert.eccouncil.org
• OffSec, PEN-200 and OSCP: offsec.com
• GIAC, Penetration Tester (GPEN): giac.org
• SANS, SEC560: Enterprise Penetration Testing: sans.org
• GIAC, Pricing: giac.org
• DoD CIO, DoD 8140 Document Library (Qualification Matrix V2.1): cyberworkforce.mil

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.