Choosing a penetration testing certification in 2026 means choosing what you want an employer to believe about you.
Every credential on this list claims to prove offensive skill, but they prove very different things. Some put you in a live lab for 24 or 48 hours and make you write the report a client would actually receive. Others put you in front of 90 multiple choice questions and a handful of simulated tasks. Both have a place, and both get treated as interchangeable by job descriptions that were written by someone who has never run an engagement.
The practical exam has won the argument. Almost every serious offensive security certification released in the last five years is hands-on, timed, and report-based, because that is the only format that survives contact with an interview. What separates them now is scope. There is a real difference between a credential that proves you can chain an Active Directory compromise, one that proves you can write tooling that survives an EDR, and one that proves you can enumerate an Azure tenant. Picking the wrong one costs you a year.
This guide covers 12 pentest certification options across every level, from a first credential with no prerequisites to the advanced offensive security certification work that separates a red team operator from a vulnerability scanner operator. Every exam format, price and renewal term below was checked against the issuing body’s own published pages in September 2026. Where a provider does not publish a figure, we say so rather than repeat a number from a forum post.
White Knight Labs is a global offensive security consultancy that also runs one of the few certification catalogues built entirely around the work its own operators do on live engagements. There are seven certifications, and they share a single format: a 48-hour performance-based exam in a real lab, followed by 48 hours to submit a professional report. No multiple choice, and the exam voucher included with each course does not expire.
The catalogue is unusually well split by attack surface rather than by seniority tier. The Offensive Development Practitioner Certification (ODPC) has candidates build and deploy their own tooling, get execution against endpoint-protected systems and bypass live defensive controls, with the report documenting tooling design and evasion logic. The Advanced Red Team Operations Certification (ARTOC) covers C2 infrastructure deployment and full-chain compromise. The Offensive Azure Operations and Tactics Certification (OAOTC) and its GCP counterpart (OGOTC) run in real cloud tenants, and the Offensive Active Directory Operations Certification (OADOC), Attacking and Securing CI/CD Pipeline Certification (ASCPC) and Entry-Level Penetration Tester Certification (ELPT) fill in the rest.
Pricing is the other outlier. Each certification is $700, the entry-level ELPT is $150, and CertForge Pro bundles the entire catalogue plus every future release and all live training events for $1,000 a year with two exam attempts. Against a single $1,749 or $1,999 exam elsewhere, that is a different pricing model altogether. Co-founders John Stigerwalt and Greg Hatcher teach the material themselves, the ODPC has run as on-site training at DEF CON, and the firm holds CREST Pathway+ status and is a Service-Disabled Veteran-Owned Small Business.
The OffSec Certified Professional remains the default filter on penetration tester job postings, and it earned that position by being brutal about scope. The exam is 23 hours and 45 minutes of proctored lab time followed by 24 hours to write the report. There are 100 points available and you need 70. Three standalone machines carry 20 points each, split between initial access and privilege escalation, and a three-machine Active Directory set carries the remaining 40 as a chained domain compromise. The old lab bonus points are gone, so 100 is the ceiling.
Since November 2024 a pass awards two credentials at once. The OSCP never expires. The OSCP+ expires three years from issue and exists purely as a currency marker, so a lapsed OSCP+ costs you the plus sign and nothing else. Anyone starting PEN-200 in 2026 earns both.
PEN-200 starts at $1,749 for the course and exam bundle with 90 days of lab access and one attempt, with Learn One at $2,599 a year for two attempts and Learn Unlimited at $5,799 for unlimited ones. The criticism of OSCP is fair and worth knowing before you commit: the methodology skews toward getting a shell rather than toward the client-facing judgement that fills a real engagement. It is still the credential that gets a CV past the first filter, which is why it belongs near the top of any penetration testing certification path.
Hack The Box built CPTS as a direct answer to the complaint that most practical exams reward speed over documentation. The exam window is 10 days against a lab environment, and within that window you submit both your flags and a commercial-grade penetration test report written to a provided template. Two attempts come with the voucher and results arrive within 20 business days. There is no expiry on the certification.
The prerequisite is genuine: you need 100 percent completion of the 28-module Penetration Tester job-role path before you can sit it. That path is the actual product, and the $490 intermediate tier covers the modules and the exam voucher together, which makes CPTS the strongest value per hour of instruction on this list. Candidates who have done both routinely describe the CPTS content as broader than OSCP, with more web, more Active Directory and considerably more time spent on writing findings.
Hack The Box also launched the HTB Certified Offensive AI Expert (COAE) in April 2026, built on an AI Red Teamer path developed with Google and aligned to Google’s SAIF framework. It sits in the same $490 tier, runs a seven-day practical window, and covers adversarial machine learning, data poisoning and LLM exploitation. If your 2027 plan involves testing AI systems rather than reading about them, it is the first credential from a major provider that treats that as a distinct discipline.
TCM Security designed the PNPT around the shape of a real internal engagement, and the debrief is what makes it distinctive. You get five full days for the assessment and two more to write the report, then you present a 15-minute live debrief to a senior penetration tester who asks questions. There are no flags to capture and no multiple choice anywhere in it.
The technical path is OSINT reconnaissance into external access into Active Directory exploitation, with lateral and vertical movement ending in a domain controller compromise. That mirrors the majority of commercial internal tests, which is why hiring managers who have run PNPT holders through interviews tend to rate the credential above its price point.
At $499 for the voucher plus 12 months of training access, 45 or more hours of on-demand video, hands-on labs and a free retake, it is the cheapest serious pentest certification on this list by a wide margin. The Ethical Hacker Bootcamp at $2,999 bundles the PJPT, PORP and PNPT attempts with 28 or more hours of live instruction. The one caveat is recognition: PNPT is well regarded inside the community but still appears in fewer job descriptions than OSCP, so it works best as a second credential or as proof of reporting ability alongside a more widely filtered one.
GPEN is the credential you buy when someone else is paying and the contract language matters. It pairs with SANS SEC560: Enterprise Penetration Testing, and it is ANAB accredited, DoD 8140 approved, and aligned to both DORA and NIS2. That combination is why it clears procurement, federal contracting and regulated industries in a way community-favourite certifications do not.
The exam is 82 questions in three hours with a 73 percent cut score for versions released from July 2025, and it is not purely theoretical: GIAC’s CyberLive format drops candidates into real virtual machines for performance-based tasks alongside the written questions. That hybrid sits between the multiple-choice generation and the 48-hour lab generation. It tests breadth of methodology well and depth of exploitation less well than a full practical exam.
Cost is the real consideration. A certification attempt is $999, a retake is $899 and renewal is $499, and the attempt has to be completed within 120 days of activation. Renewal runs on a four-year cycle requiring 36 CPE credits plus the maintenance fee, so this is a credential with an ongoing cost attached rather than a one-time purchase. Bundled with SEC560 the total moves into five figures, which is why GPEN is overwhelmingly an employer-funded certification. If your employer has a SANS budget, take it. If you are self-funding, the money buys more skill elsewhere.
Zero-Point Security’s Red Team Ops course is where a lot of penetration testers make the jump from finding vulnerabilities to simulating an adversary. The material covers the attack lifecycle from initial compromise through persistence, privilege escalation and lateral movement, but the framing is what matters: every technique is taught alongside the OPSEC failure that gets it caught and the detection it generates.
The course runs 180 lessons with around two hours of video and costs £365, which includes one exam voucher with no expiry date. Lab access is deliberately sold separately in 40, 80 or 120-hour blocks over 30, 60 or 90 days, so you pay for the time you actually use rather than a fixed window that expires while you are at work. Prerequisites are informal but real: you want working knowledge of Windows and Active Directory, and familiarity with C, C# or PowerShell helps.
CRTO has become the community’s default red team certification in the way OSCP became the default pentest one, largely because the tradecraft transfers directly into commercial adversary simulation work. If your target role is red team rather than assessment, this is the most efficient single credential to hold, and it pairs naturally with the offensive development work covered by ODPC.
OSEP is what OSCP holders take when the problem stops being “can I get a shell” and starts being “can I get a shell on a network that is watching”. The course behind it, PEN-300: Evasion Techniques and Breaching Defenses, is built around antivirus and EDR evasion, application whitelisting bypass, phishing with working payloads, and lateral movement across segmented and monitored environments.
It is a hands-on exam in the OffSec house style, and the difficulty step up from PEN-200 is real. Candidates consistently report that the bottleneck is custom tooling rather than methodology, because the prebuilt payloads that carry you through OSCP get caught immediately here. Some comfort with C# and PowerShell is close to mandatory in practice even though OffSec does not list it as a formal prerequisite.
PEN-300 starts at $1,749 for the course and exam bundle with 90 days of access and one attempt, and carries 671 hours of content. OSEP earns its place because so few credentials assess evasion at all, and evasion is the difference between a report that says the control failed and a report that says the control worked. If you want the same skill set at a fraction of the price, the White Knight Labs ODPC covers similar ground for $700.
8. CREST CPSA and CRT — The Regulated Route Into UK Government And Critical Infrastructure Work
If you want to test UK public sector or critical national infrastructure systems, this is not a preference, it is the gate. The CRT exam is approved by the NCSC for CHECK Team Member status, and CHECK status is what UK government and CNI procurement asks for. No amount of community respect for another credential substitutes for it in those tenders.
The route runs in two steps. The CREST Practitioner Security Analyst (CPSA) is a written multiple-choice exam, 120 questions in two hours with a 60 percent pass mark, at £275. Holding a valid CPSA is required to book the CREST Registered Penetration Tester (CRT), which is practical: 2.5 hours plus 15 minutes reading time at a Pearson VUE centre on a CREST-provided Kali environment, scored across an Infrastructure section worth 100 marks and a Web Application section worth 60. You need 60 percent in both, and failing either section fails the whole exam. CRT costs £600 and is valid for three years.
Outside the UK the commercial value drops sharply, and the time-boxed test centre format rewards a narrower kind of speed than a 48-hour lab does. Inside the UK consulting market it is the single most employable credential on this list, and firms will usually fund it.
Altered Security’s Attacking and Defending Active Directory lab produces the CRTP, and it is the most focused credential here. The whole thing is about abusing the features and misconfigurations that ship with Active Directory rather than exploiting patchable CVEs, which is an accurate reflection of how domains actually fall in commercial engagements.
The lab is a fully patched Windows environment spanning multiple domains and forests, so the trust relationships are the target. The exam is 24 hours in an individual environment, followed by a report that has to document the solutions and the practical mitigations, which is a nice touch given how often AD findings get handed to a client with no remediation path attached.
Pricing runs $249 for 30 days of lab access, $379 for 60 and $499 for 90, with lab extensions at $199 per 30 days and exam retakes at $99. You get three attempts before a six-month cooldown. The certification is valid for three years and renews free by passing the renewal exam or by clearing a higher Altered Security credential such as CRTE. For anyone whose day job involves internal network testing, CRTP is the highest return on a few hundred dollars available in this market, and it stacks well under CRTO.
EC-Council rebuilt CPENT as CPENT AI, weaving AI-assisted techniques through every phase of the methodology, and the result is the broadest single range exam available. Candidates choose between two 12-hour sessions or one continuous 24-hour attempt, then submit a penetration test report within seven days. The curriculum runs to more than 110 labs and 50 tools across five practice ranges: Active Directory, binary exploitation, IoT, web and a capture the flag range.
The scoring structure is unusual and worth understanding. Seventy percent earns CPENT. Ninety percent on the same exam earns the Licensed Penetration Tester (LPT) Master credential, so there is no separate LPT exam to sit, only a higher bar on this one.
Pricing starts at $1,999 on demand, $2,799 live online and $3,999 for unlimited on-demand access, and the certification is valid for one year with annual extension through EC-Council’s continuing education fees. That recurring cost and EC-Council’s mixed reputation among practitioners are the two honest objections. The counterargument is coverage: no other credential on this list assesses binary exploitation, IoT and operational technology in one sitting, and for testers moving into industrial or embedded work that breadth is hard to assemble elsewhere.
11. CompTIA PenTest+ (PT0-003) — The Vendor-Neutral Credential HR Filters And Compliance Frameworks Understand
PenTest+ is the credential that opens doors rather than the one that proves depth, and it is worth being clear about which job it is doing. The third version, exam code PT0-003, launched in December 2024 and runs a maximum of 90 questions in 165 minutes, mixing multiple choice with performance-based questions, with a pass mark of 750 on a 100 to 900 scale.
Its value is institutional. CompTIA credentials are written into government and enterprise hiring frameworks, appear in compliance documentation, and get recognised by recruiters and HR systems that have never heard of CRTO. PT0-003 also modernised the content meaningfully, with more cloud, more attack automation and scripting, and more emphasis on the engagement management and scoping side that practical exams tend to skip entirely.
The limitation is that a 165-minute exam cannot demonstrate what a 48-hour lab demonstrates, and experienced testers will treat it accordingly. It renews on a three-year cycle through CompTIA’s continuing education programme, which carries a $150 fee for the period. Check the current voucher price directly in CompTIA’s store, since it varies by region and bundle. Treat PenTest+ as a compliance and hiring-filter credential to pair with a practical one, not as a substitute for it.
12. eJPT (INE Security) — The First Practical Exam To Sit When You Have No Experience At All
The eJPT exists to answer one question honestly: can you find your way around a network you have never seen before. It is a browser-based practical lab exam with a 48-hour window and 35 questions that are answered from evidence you gather inside the lab rather than from memory. Grading is automatic and there is no report to write, which makes it the gentlest possible introduction to the practical exam format.
Passing requires 70 percent overall plus minimum scores in each domain, weighted toward host and network penetration testing at 35 percent, assessment methodologies and host and network auditing at 25 percent each, and web application testing at 15 percent. Question instances are dynamically flagged so no two candidates get the same answer key. There are no formal prerequisites and the certification is valid for three years.
INE sells the exam on its own with no subscription required, listed at $250 to $450 depending on the package, and bundles it with cert prep for more. Nobody is hiring a senior tester on an eJPT, and it should not be oversold. What it does well is prove to a career changer, a SOC analyst or a student that the practical format is survivable, and it builds the enumeration discipline that everything above it assumes you already have. As a starting point on a penetration testing certification path it is well judged, and the White Knight Labs ELPT at $150 covers similar ground with a report requirement attached.
How To Choose A Penetration Testing Certification
What Level Are You Actually Starting From?
The most expensive mistake in this market is buying a credential two tiers above your current ability and burning both the money and the attempt. If you have never sat a practical exam, start with eJPT or the White Knight Labs ELPT and prove to yourself that the format is manageable. If you can already own a small network end to end and document it, go straight to OSCP, CPTS or PNPT. Save OSEP, ARTOC and CPENT for the point where the challenge is evasion and tooling rather than enumeration. A useful test: if you cannot explain how Kerberoasting works without looking it up, you are not ready for an advanced red team certification yet.
Does The Exam Make You Write The Report?
Reporting is the deliverable clients pay for, and it is the skill that separates a junior tester from a billable one. Certifications that require a written report, which covers the whole White Knight Labs catalogue, OSCP, CPTS, PNPT, CRTP and CPENT, are training something the job needs every week. Auto-graded exams such as eJPT and question-based exams such as GPEN and PenTest+ do not. PNPT goes furthest by adding a live 15-minute debrief in front of a senior tester, which is the closest any exam gets to the client call at the end of an engagement. If you have never written a findings document, prioritise a certification that forces you to.
Which Attack Surface Does Your Target Role Test?
Generalist credentials are a reasonable first purchase and a poor third one. Once you know the work you want, buy for the surface. Internal network and Active Directory points to CRTP and PNPT. Adversary simulation points to CRTO and ARTOC. Cloud points to OAOTC for Azure or OGOTC for GCP, an area where credential supply is still well behind demand. Malware development and EDR evasion points to ODPC or OSEP. Build pipelines point to ASCPC. AI systems point to the new HTB COAE. Employers hiring for a specialism read a matching certification as evidence that you chose the discipline deliberately, which is a stronger signal than another broad credential. It also tracks how the market has specialised, something visible across the leading penetration testing companies and the firms running red team engagements.
Who Is Paying, And What Does Renewal Cost?
Sticker price is only half the number. GPEN runs a four-year renewal cycle with 36 CPE credits and a $499 fee. CPENT is valid for one year and extends through EC-Council’s continuing education charges. PenTest+ renews every three years with a $150 continuing education fee. CRT, CRTP and eJPT all run three-year terms, though CRTP renews free by exam. OSCP never expires, and the OSCP+ marker that does expire costs you nothing to let lapse. The White Knight Labs certifications include a voucher that does not expire and portal access that stays open, and CertForge Pro at $1,000 a year covers the whole catalogue. If you are self-funding, work out the five-year cost before you choose. If your employer is funding it, the expensive recurring credentials become far more attractive.
Will It Get You Past The Hiring Filter?
Two filters exist and they want different things. Recruiters and applicant tracking systems search for OSCP, CEH and PenTest+ because those are the names written into job templates. Hiring managers who have run engagements care about CPTS, PNPT, CRTO and practical lab exams because they know what those cost in effort. The efficient play is one credential for each filter, which is why so many working testers hold OSCP plus something sharper. Geography matters too: CREST CRT is close to mandatory for UK government and critical infrastructure work and much less useful elsewhere, while GPEN carries the most weight in federal and heavily regulated environments. For a wider view of who delivers this training, see our roundup of cybersecurity training and certification providers.
Conclusion
There is no single best penetration testing certification, only the one that matches your level, your target surface and whoever is paying. For most people building a career the sequence that works is a practical entry credential to prove the format is survivable, then OSCP or CPTS to clear the hiring filter, then a specialist credential in the discipline you actually want to be known for.
What has changed in 2026 is that the specialist tier finally has depth and sane pricing. Cloud, offensive development, CI/CD and AI red teaming all have dedicated practical exams now, several of them at a fraction of what the incumbent providers charge for a single attempt. White Knight Labs is the clearest example, with seven certifications at $700 each, a whole-catalogue subscription at $1,000 a year, and an exam format that makes every candidate produce the report a client would receive. You can read more about the firm on its ReVerb company profile.
Whichever you choose, verify the current exam format and price on the issuing body’s own page before you buy. This market changes its terms more often than its marketing pages suggest.
If you want to feature your company on this list, email us or submit a form in the Top Choices section. After a thorough assessment, we’ll decide whether it’s a valuable addition.
