IT, Cloud & Cybersecurity • Certification
OffSec Certified Professional
The industry-standard penetration testing cert.
Researched and maintained by TestPrepPilot Editorial BoardCybersecurity & offensive-security desk · Figures last verified August 2026
The short version
What is the OffSec Certified Professional and is it worth it?
OSCP is a 24-hour, live-proctored hands-on exam plus a 24-hour report window. You need 70 of 100 points to pass. The PEN-200 Course + Exam Bundle is $1,749 (one attempt); a standalone exam is $1,699; Learn One is $2,749/year for two attempts. OSCP is a lifetime credential; the maintained OSCP+ version is valid three years.
- Gold-standard hands-on pentest cert
- Real exploitation, not multiple choice
- 24-hour exam + report
- Lifetime validity (OSCP+)
What is it?
What exactly is the OffSec Certified Professional?
The industry-standard penetration testing cert.
The OffSec Certified Professional (OSCP) is the most recognised hands-on penetration testing certification. Candidates compromise a set of live machines in a private lab — three standalone machines worth 60 points plus an Active Directory set worth 40 — and submit a professional report. It maps to the PEN-200 (PWK) course and is widely required or preferred for pentester and red-team roles.
The path in brief
- Complete PEN-200
- Schedule the 24-hour proctored exam
- Compromise the targets
- Submit report in 24h
- Pass at 70/100
Before you book
Who is eligible to sit the OffSec Certified Professional?
PEN-200 course (or equivalent background)
Who it is for: Aspiring and working penetration testers.
The test itself
What is the format of the OffSec Certified Professional?
The OffSec Certified Professional is administered by OffSec proctored exam VPN and runs ~24 hr 45 min and requires 70 / 100 points to pass.
| Administered by | OffSec proctored exam VPN |
|---|---|
| Questions | Hands-on exam (110 points, 70 to pass) |
| Time limit | ~24 hr 45 min |
| Pass mark | 70 / 100 points |
| Exam fee | ~$1,700-$2,500 |
| Format | Hands-on practical, live-proctored (private VPN) |
Content outline
What topics are on the OffSec Certified Professional?
The OffSec Certified Professional covers 4 content domains.
Weightings come from the official exam outline. Study time is best allocated in roughly these proportions rather than evenly across domains.
- Reconnaissance
Enumeration
- Exploitation
Initial access
- Active Directory
AD set (40 pts)
- Reporting
Professional write-up
Money & time
How much does the OffSec Certified Professional cost?
For the OffSec Certified Professional, the exam fee is ~$1,700-$2,500; the all-in cost is typically $1,749 bundle; most candidates spend 2-4 months preparing.
Cost breakdown
| PEN-200 Course + Exam Bundle | $1,749 |
|---|---|
| Standalone exam | $1,699 |
| Learn One (optional) | $2,749/yr (2 attempts) |
| Typical total | $1,749 (bundle) |
PEN-200 labs run 90 days on the standard bundle; Learn One and Learn Unlimited extend lab time and attempts.
Timeline
- Learn PEN-200 2-4 months
- Schedule exam set start time
- Exam 24 hours
- Report + result 24h report
Typical prep: 2-4 months
The path
How do you register for the OffSec Certified Professional?
- 1
Choose a learning pathper subscription
Pick a course (PEN-200, WEB-200, etc.) via a Course + Exam Bundle, Learn One (one year, two attempts) or Learn Unlimited.
- 2
Complete the labsweeks to months
Work through the course content and hands-on challenge labs; depth ranges from fundamentals to expert exploit development.
- 3
Schedule the proctored examset start time
Book a start time in the OffSec portal and connect to the exam VPN under live webcam proctoring.
- 4
Compromise the targets4 to 72 hours
Complete the practical exam — anywhere from 4 to 72 hours depending on the certification — and capture proof files from each target.
- 5
Submit the report24-hour report window
Upload your written exploitation report within 24 hours of the exam window ending; grading follows review.
The fine print
What are the retake and renewal rules for the OffSec Certified Professional?
- Proctoring & delivery
- All certification exams are live-proctored by an OffSec proctor over a private VPN; a webcam and a clear workspace are required. After the exam window you have a further 24 hours to upload your report.
- Retake policy
- Attempts depend on the subscription: a Course + Exam Bundle includes one exam attempt; Learn One and Learn Unlimited include two attempts; CyberCore includes two. Additional attempts are purchased separately, and some certifications offer a discounted retake.
- Score reporting
- Exams are graded pass/fail against a points threshold. OSCP requires 70 of 100 points (three standalone machines worth 60 points plus an Active Directory set worth 40). Candidates learn the result after their report is reviewed.
- Recertification
- Most OffSec certifications are lifetime credentials and do not expire. Newer role-based certs — OSCP+ (the maintained version of OSCP), OffSec Incident Responder (OSIR) and OffSec Threat Hunter (OSTH) — are valid for three years and require 120 CPE credits plus an annual maintenance fee to stay active.
Context
OffSec certification ladder compared
| Certification | Focus | Exam length | |
|---|---|---|---|
| OSCP | Penetration testing | 24 hours | |
| OSEP | Experienced pentest / evasion | 48 hours | |
| OSWA | Web application assessment | 24 hours | |
| OSWE | Web exploitation (white-box) | 48 hours | |
| OSED | Windows exploit dev | 48 hours | |
| OSEE | Exploitation expert | 72 hours |
What it pays
How much does this credential pay?
OSCP evidences hands-on penetration-testing skill: information security analysts earned a $124,910 median in May 2024 (BLS)
The Offensive Security Certified Professional (OSCP) is the flagship certification for penetration testing, evidencing hands-on ability to exploit vulnerable systems within a time-limited, proctored exam. It is a technical certification rather than a job license, so no single BLS SOC code attaches to it; the salary story belongs to the security occupations it serves. BLS reported that information security analysts (SOC 15-1212) earned a median of $124,910 in May 2024, projected to grow 30 percent from 2024 to 2034 - one of the fastest-growing occupations BLS tracks; penetration-testing roles (offensive security, red team, security assessment) sit within and above this range, with specialized offensive roles paying premiums in consulting and product-security teams. The structural point is that the OSCP is the most widely recognized entry credential in offensive security: job postings for penetration testers and security consultants frequently list it, and its hands-on exam format is the credential’s core value - it proves the candidate can actually perform the work, which is rare among certifications. BLS classifies workers by occupation, not certifications, so no certificate maps to a specific wage; the value is the demonstrable skill signal in a market where practical ability is the differentiator. The certification requires the PEN-200 training course (or equivalent preparation), a 24-hour (roughly 23 hours 45 minutes) hands-on exam, and a written report graded alongside the technical exploits; the honest framing is that OSCP is earned, not studied for - the exam is the test.
| Measure | Figure | Source / note |
|---|---|---|
| Information security analysts median, May 2024 | $124,910 | BLS OEWS, SOC 15-1212 |
| Computer and mathematical occupations median, May 2024 | $105,850 | BLS OEWS occupational group |
| All-occupation median, May 2024 | $49,500 | BLS OEWS |
| OSCP exam length | ~23 hr 45 min hands-on + report | OffSec |
Job growth.Information-security-analyst employment is projected to grow 30 percent from 2024 to 2034, much faster than the average.
Source: BLS Occupational Outlook Handbook - Information Security Analysts
Your odds
What are the pass rates?
OSCP requires 70 of 110 points across the hands-on exam and the report; OffSec publishes no pass rates
OffSec does not publish official pass-rate statistics for the OSCP, but the exam mechanics are public. The current OSCP exam is a hands-on, proctored test of roughly 23 hours 45 minutes in which the candidate attacks a network of target machines and earns points for successful exploits (obtaining local proof, local.txt, and root or system access, proof.txt); the total is 110 points, and the passing score is 70 points (approximately 63 percent). The exam includes bonus points (up to 10) awarded for a clean penetration-testing report and documentation submitted within the report window. In the current format, the exam is delivered remotely with proctoring, and the candidate has about 24 hours for the technical portion plus a report submission window (the report is graded as part of the passing criteria). The exam requires the PEN-200 course material as preparation - OffSec requires the course or an acceptable equivalent background, and the exam voucher is bundled with the course - and the practical reality is that the OSCP has a reputation as a demanding exam that many candidates sit more than once; community-sourced pass estimates vary, but OffSec itself does not publish a rate. The honest summary is that the passing bar is 70 of 110 points including report bonuses, the exam is a real hands-on attack with proctoring, and candidates should budget for the possibility of multiple attempts (each attempt requires an exam voucher).
Read this before quoting the number.OffSec publishes no pass rates; the exam requires 70/110 points including up to 10 report bonus points, with ~24 hours of hands-on time plus a report.
Source: OffSec OSCP exam information
Your schedule
How long should I study for it?
300-600 hours over 3-6 months of focused study
The OSCP preparation plan is the PEN-200 course plus extensive lab practice, typically 300-600 hours over 3-6 months for a candidate with security or systems fundamentals; OffSec positions the course at a fixed pace but the lab work is where the skill develops. The PEN-200 course (roughly 90 days of lab access with the standard bundle, extendable) covers: information gathering and enumeration, vulnerability identification, exploitation of Windows and Linux targets, buffer overflows (historically a module; the current syllabus emphasizes modern exploitation), privilege escalation, pivoting and lateral movement, and web application attacks. A realistic plan: months 1-2, complete the course modules and the accompanying exercises (the "lab exercises" that earn the bonus points are part of the course), working through each module with the lab machines; months 3-4, grind the lab network - the course lab contains many machines, and the standard advice is to attack machines in order of difficulty, documenting every method; months 5-6, take practice exams (the "Try Harder" exam simulations and the retired-exam machines in the lab), write full reports, and take the real exam. The dominant resources are the PEN-200 course and lab (the required purchase, roughly $1,700-$2,500 depending on the bundle and extensions), the exam voucher, and the reporting templates; free supplementary resources (Hack The Box, TryHackMe) build speed but the official lab is the closest match. The honest framing is that the OSCP is earned through hours of hands-on practice, and candidates who skip the lab and attempt the exam unprepared are the ones who retake.
- Months 1-2200
PEN-200 modules and exercises
- Complete the course modules
- Lab exercises for bonus points
- Months 3-4250
Lab network grind
- Attack lab machines in difficulty order
- Document every method
- Months 5-6120
Practice exams and report
- Exam-simulation practice
- Write full reports; take the real exam
Adjusting the pace
Exam retake.Each attempt requires an exam voucher; many candidates plan for multiple attempts.
Equivalent background.OffSec requires the course or acceptable equivalent knowledge; the exam voucher is bundled with PEN-200.
How to study
How do I prepare most effectively?
The most effective OSCP strategies are about method, documentation and endurance. Strategy one: build a personal methodology - a systematic enumeration checklist (port scanning, service identification, web directories, version exploitation) that you execute identically on every machine, because the exam rewards methodical coverage over cleverness, and a written methodology checklist is the difference between finding the entry point and missing it. Strategy two: document everything as you go - screenshots, commands, flags and the reasoning - because the report is worth up to 10 bonus points and is graded; candidates who exploit machines but cannot document them lose points. Strategy three: practice the enumeration depth that the exam demands: full TCP and UDP scans, service and version enumeration, web application fuzzing, and the "Try Harder" mindset of escalating effort on stuck machines. Strategy four: learn the common privilege-escalation paths cold (kernel exploits, misconfigured services, credential reuse, scheduled tasks) because post-exploitation is where many candidates stall. Strategy five: train the 24-hour endurance - take full-length practice exams that simulate the pacing, including sleep management, because the exam window is a marathon and exhaustion is a real failure mode. Strategy six: use the official lab and practice machines over free platforms for the final weeks, because the scoring and the environment are OffSec-specific.
Build a personal methodology
A written enumeration checklist executed on every machine.
Document while you work
The report is worth bonus points and is graded.
Go deep on enumeration
Full TCP/UDP scans, version and web fuzzing.
Master privilege escalation
The most common stall point after initial access.
Train the 24-hour endurance
Full practice exams build the marathon pacing.
What to buy
Which study resources are worth paying for?
The OSCP resource market is anchored by OffSec’s official course, which is the required purchase. The PEN-200 course bundle (roughly $1,700-$2,500 depending on the plan, including the course content, lab access and the exam voucher; extensions and retake vouchers add cost) is the core investment; it includes the course modules, the lab network, the exercises and the exam. The official exam guide and reporting template are included. Free and low-cost supplements - Hack The Box, TryHackMe, and community write-ups - build speed and breadth, and are commonly used alongside the official lab; the honest caveat is that only the official lab matches the exam environment, so free platforms should supplement rather than replace it. Private courses and bootcamps ($1,000-$4,000) add structure and are popular with career changers, but the certification itself is earned in the exam, and the value of any paid supplement is practice and accountability. The honest ranking: the PEN-200 course and lab (required), the official exam and report materials (included), free practice platforms for volume, and a bootcamp only for structured learners. Prices here are current as of 2025-26 and change annually.
| Resource | Price | Format | Best for |
|---|---|---|---|
| PEN-200 course + lab + exam voucher | $1,700-$2,500 | Online course + lab | The required core investment |
| Hack The Box / TryHackMe | Free-$30/mo | Online platforms | Practice volume and speed |
| Bootcamp / private course | $1,000-$4,000 | Live/online | Structure and accountability |
| Community write-ups | Free | Web | Methodology and techniques |
Prices dated 2025-26 and vary by bundle; retake vouchers and lab extensions add cost. No commission-based ranking.
Avoid these
What mistakes do candidates most often make?
The most common OSCP mistakes come from underestimating the hands-on nature and skipping the lab. Mistake one: treating the course as reading material; the OSCP is earned by attacking machines, and candidates who complete the modules without grinding the lab arrive at the exam unpracticed. Mistake two: skipping documentation; the report is worth up to 10 bonus points and is graded, and candidates who exploit machines without screenshots and notes lose points they earned. Mistake three: shallow enumeration; the exam rewards exhaustive scanning and version identification, and candidates who rush past enumeration miss entry points. Mistake four: stalling on privilege escalation; post-exploitation is where many candidates fail, and the common paths must be drilled until they are automatic. Mistake five: ignoring the 24-hour endurance; candidates who never simulate the full window exhaust themselves mid-exam. Mistake six: using free platforms exclusively; the official lab matches the exam environment, and candidates who train only on easier platforms misjudge the difficulty. Finally, candidates should plan the retake reality - the OSCP is commonly passed on a second or third attempt - and budget time and voucher cost accordingly, because the honest expectation is that this exam is hard.
✕Reading without attacking
✓Grind the lab; the skill is hands-on.
✕Skipping documentation
✓Screenshots and notes earn the report bonus.
✕Shallow enumeration
✓Exhaustive scanning finds the entry points.
✕Stalling after initial access
✓Drill the privilege-escalation paths.
✕Under-budgeting retakes
✓Plan for the real possibility of multiple attempts.
What you'll face
What question types will I see?
The OSCP exam is not a multiple-choice test; it is a hands-on, proctored exam of roughly 23 hours 45 minutes in which the candidate attacks a network of target machines. Scoring: 110 total points, passing at 70, with up to 10 bonus points for the penetration-testing report; points are earned by obtaining the required proof files (local and proof/root flags) on each machine. The exam requires the PEN-200 course background, is delivered remotely with proctoring, and the report is submitted within the report window after the technical portion. The task is to compromise multiple Windows and Linux targets using enumeration, exploitation, privilege escalation, and lateral movement. Samples below are editor-written illustrations of the published exam format, not live exam items.
Enumeration and exploitation to obtain local proof.
Local to root/system and the proof flag.
Moving through the network to further targets.
Clean documentation of methodology and findings.
Try these
Q1An Nmap scan on a target shows ports 22, 80 and 8080 open. The web application on 8080 has a file upload form. Which is the most appropriate next step in a methodical approach?
Answer:B
A methodical approach enumerates each service; a file upload with filter bypass is a common entry path, and exhausting the web surface before brute force follows the methodology.
Q2After obtaining a low-privilege shell on a Linux target, which local check is most likely to reveal an escalation path?
Answer:A
Sudo rules and SUID binaries are classic Linux privilege-escalation vectors; checking them is a standard post-exploitation step.
Q3A candidate finds proof.txt in the root directory but the flag file is unreadable. What is the most appropriate action?
Answer:A
The proof flag requires root or system access; escalating privileges to read it is the correct completion of the task, not moving on or reporting partial completion.
Samples are editor-written illustrations of the published exam format, not live exam items.
The big day
What should I expect on exam day?
The OSCP exam is delivered remotely with proctoring on a scheduled date; candidates must complete the environment and proctor check ahead of time, use a stable connection and a compliant testing setup (the proctoring rules are strict - no assistance, no unauthorized tools beyond the exam environment, camera on). The exam runs roughly 23 hours 45 minutes for the hands-on portion, and the candidate attacks the target network to earn 70 of 110 points; screenshots and notes taken during the exam are used for the report. After the technical window, the candidate submits the penetration-testing report within the report submission window, and the report is graded as part of the passing criteria. Results are typically released within about 7-10 days. Candidates should plan sleep strategically during the long window, keep the methodology checklist visible, and document every machine as they go. Afterwards, if passed, add the certification to your resume with the OffSec credential; if not, use the experience to target the retake (each attempt requires a voucher) with a focused lab plan.
Bring
- Compliant exam setup (per the proctoring rules)
- Stable internet connection
- Methodology checklist and note template
- Sleep and fuel plan for the long window
Leave at home
- Prohibited assistance or tools
- Unstable connections - test ahead
- The assumption that the report can be written from memory
How the day runs
Rules in the room
- The exam is remotely proctored with strict environment rules.
- Passing is 70/110 points including up to 10 report bonus points.
- The report is required and graded.
- Each attempt requires an exam voucher.
Afterwards.If passed, add the OSCP credential to your resume; if not, target the retake with a focused lab plan, documenting the weak areas from the attempt.
Reference
What are the key facts about the OffSec Certified Professional?
OffSec Certified Professional is a certification credential; awarded by OffSec; the exam fee is ~$1,700-$2,500; typical preparation is 2-4 months; holders typically earn $95,000-$150,000.
| Credential | OffSec Certified Professional |
|---|---|
| Abbreviation | OSCP |
| Type | Certification |
| Profession | IT, Cloud & Cybersecurity |
| Specialty | Cybersecurity (Vendor-Neutral) |
| Awarded by | OffSec |
| Difficulty | Hard |
| Typical prep time | 2-4 months |
| All-in cost | $1,749 bundle |
| Typical salary range | $95,000-$150,000 |
| Delivery | Live-proctored private VPN |
| Exam length | 24 hours + 24h report |
| Attempts | 1 (bundle) / 2 (Learn One) |
| Validity | Lifetime; OSCP+ 3-year |
| Scope | National / Multi-state |
| Also known as | OSCP, OSCP+, PEN-200 |
Real questions
Frequently asked questions about the OffSec Certified Professional
What does the OSCP exam involve?
A 24-hour proctored practical where you compromise live machines (three standalone, 60 points, plus an AD set, 40 points) and then submit a report within 24 hours.
What score do I need?
70 of 100 points. The three standalone machines are worth 60 and the Active Directory set 40.
How much does OSCP cost?
OSCP requires 70 of 110 points including up to 10 report bonus points on a proctored hands-on exam; OffSec publishes no pass rates and many candidates sit twice.
Does OSCP expire?
The base OSCP is a lifetime credential. OffSec also offers OSCP+, a maintained version valid three years with 120 CPE credits and an annual fee.
Do OffSec exams expire?
Most are lifetime credentials. OSCP+ (the maintained OSCP), OSIR and OSTH are valid for three years with CPE maintenance.
Are the exams multiple choice?
No. Every OffSec exam is a hands-on practical: you compromise live targets in a private lab and submit a report while a proctor watches via webcam.
How many attempts do I get?
A Course + Exam Bundle gives one attempt; Learn One and Learn Unlimited give two; CyberCore gives two for its 100-level exams.
In short
Is the OffSec Certified Professional worth it?
- OSCP is the industry-standard hands-on pentest cert
- 24-hour exam + 24-hour report; 70/100 to pass
- Bundle $1,749; standalone $1,699
- Lifetime validity (OSCP+)
Trust
Where does this information come from?
Everything above is taken from the awarding body's own published material. Fees, question counts and domain weights are revised regularly — check the official page before you pay.
- OffSec Awarding body
- Official OffSec Certified Professional exam page Exam page
- OffSec certification programme Programme rules
Research confidence: high · Last reviewed 2026-08