OSCP Certification Guide 2026: Cost, Exam Format, Prep And Is It Worth It
Daria Pohrebniak
Marketing Director - ReVerb
10.23.2026
The OSCP (Offensive Security Certified Professional) is OffSec’s hands-on penetration testing certification, earned by passing a proctored exam of 23 hours and 45 minutes against live machines, then submitting a professional report within 24 hours. In 2026 the PEN-200 course and exam bundle costs $1,749 for 90 days of access and one exam attempt, and new passes since 1 November 2024 receive OSCP+, which expires after three years, alongside a lifetime OSCP. It is still one of the most recognized practical credentials for penetration testers, but it is a large commitment of time and money, so it is worth knowing exactly what you are signing up for.
This guide covers what the OSCP is, current pricing, the exam format and scoring, the OSCP+ change, how it compares to alternatives, who should take it, a prep plan and what it does for your career. All OffSec details were checked against offsec.com and OffSec’s help center in October 2026. Prices and rules change, so confirm them on OffSec’s site before you buy.
What Is The OSCP?
The OSCP is the certification attached to PEN-200, OffSec’s Penetration Testing with Kali Linux course. Unlike multiple-choice certifications, it requires you to compromise machines in a lab you have never seen and document how you did it. OffSec lists 284 hours of content for PEN-200, covering information gathering, web and client-side attacks, public exploits, privilege escalation on Windows and Linux, tunneling, Active Directory attacks and report writing.
Because the exam is practical, employers and clients tend to treat the OSCP as evidence that someone can actually perform a penetration test, which is why it shows up so often in pentest job ads and vendor bios. Our guide to the best penetration testing certifications covers where it sits among other credentials.
How Much Does The OSCP Cost In 2026?
OffSec sells PEN-200 and the OSCP exam in several packages. These are the individual prices listed on offsec.com in October 2026:
Option
Price
What You Get
Course and Cert Exam Bundle
$1,749 one time
90 days of PEN-200 course and lab access, one exam attempt
Learn One
$2,749 per year (OffSec runs periodic discounts)
One year of access to one 200- or 300-level course and labs, two exam attempts; renews automatically
Standalone exam
$1,699 one time
One exam attempt, no course access
Learn Unlimited
$6,099 per year
Full OffSec library and unlimited exam attempts for one year
For most first-time candidates, Learn One is the better value despite the higher price, because the extra nine months of lab time and the second exam attempt cost less than buying a second attempt on its own. The 90-day bundle suits people who already have strong practical experience and expect to pass on the first try. Employers often pay through OffSec’s enterprise plans, so ask before buying.
OSCP Exam Format And Scoring
According to OffSec’s exam guide, the OSCP+ exam works like this:
Time: 23 hours and 45 minutes of hands-on testing in a private VPN lab, followed by 24 hours to upload your report.
Three standalone machines, 60 points: each worth 20 points, split into 10 for initial access and 10 for privilege escalation.
One Active Directory set, 40 points: three machines in an assumed breach scenario. You start with a standard domain user’s username and password, and the goal is full domain compromise. Partial points are available on the AD set.
Passing score: 70 of 100 points. Bonus points for course exercises and lab reports were removed from 1 November 2024, so the full 70 must come from the exam itself.
Proctoring: all exams are proctored by OffSec staff, and you must follow the proctoring tool’s requirements.
Tool restrictions: Metasploit modules and Meterpreter can be used against only one target machine of your choice. Using LLMs and AI chatbots, including OffSec’s own KAI, ChatGPT and similar tools, is strictly prohibited.
The Report Requirement
The report is not a formality. OffSec requires a professional report describing the exploitation of each target, with every step, command and output needed for a technically competent reader to reproduce the attack. Unmodified public exploits need only a source URL, while modified exploits must include the code, the original source, any shellcode generation command and an explanation of each change. The report goes in as a PDF inside a .7z archive with a specific file name. Candidates do fail because of incomplete reports, so practice writing them during prep. Our guide to penetration testing reports shows what good client-facing reports include.
OSCP vs OSCP+: What Changed In November 2024
OffSec announced in September 2024 that anyone passing the exam from 1 November 2024 receives the OSCP+ designation in addition to the OSCP. The key differences:
OSCP+ expires three years after it is issued. The underlying OSCP stays valid for life.
People certified before 1 November 2024 keep a lifetime OSCP and can earn the “+” by passing the current exam. OffSec’s help center lists the price of that exam for existing holders as $799 after the introductory period ended on 31 March 2025.
To keep OSCP+, OffSec lists three routes: pass a recertification exam within six months of the expiry date, pass another qualifying OffSec exam such as OSEP, OSWA, OSED or OSEE before it expires, or complete OffSec’s continuing professional education (CPE) program.
In practice, OSCP+ exists for employers and government contracts that want proof of current skills. If you let the “+” lapse, your OSCP remains, but some job postings may ask for the active version.
OSCP vs Other Penetration Testing Certifications
The OSCP is not the only practical option. Here is how it compares with three common alternatives, based on each provider’s own published details. For a deeper head-to-head, read our OSCP vs PNPT vs CEH comparison.
Factor
OSCP+ (OffSec)
PNPT (TCM Security)
CPTS (Hack The Box)
CEH (EC-Council)
Exam type
Practical, live machines
Practical, simulated external and internal engagement
Practical, simulated engagement
Multiple choice, with an optional separate practical exam
Exam voucher includes two attempts; check HTB for current pricing
Courses from $1,699
Expiry
OSCP+ three years; OSCP lifetime
Does not expire
Does not expire
Subject to EC-Council’s continuing education policy
The short version: PNPT and CPTS are cheaper and arguably closer to a real engagement, with longer exam windows and heavier reporting. CEH is a knowledge exam that some government and corporate roles still require. The OSCP’s advantage is recognition. It has been a hiring filter for years, and many buyers of penetration testing services look for it in tester bios.
Who Should Take The OSCP?
Good fit:
Network, system and SOC staff who want to move into penetration testing or red teaming.
Junior pentesters whose employer or clients expect the credential.
Consultants bidding on work where tester certifications are listed in proposals or contracts.
Developers and security engineers who want a deep, practical understanding of how attacks work.
Probably not yet:
Complete beginners without basic Linux, Windows, networking and scripting skills. Start with lower-cost foundational material first.
People who mainly need a compliance or management credential, where a non-practical certification may be what the role actually requires.
Anyone who cannot set aside regular study time for several months. The lab access clock runs whether you use it or not.
A Practical OSCP Prep Plan
Timelines vary widely with experience, but this structure works for most candidates with some IT background.
Phase 1: Foundations (Before You Buy)
Get comfortable with the Linux and Windows command line, TCP/IP and common services, basic Bash and Python, and how web applications work. Practice on free or low-cost beginner machines on platforms such as Hack The Box or TryHackMe. Starting PEN-200 with these skills means your paid lab time goes on new material rather than basics.
Phase 2: Work Through PEN-200
Do the course modules in order and complete the exercises, even though they no longer earn bonus points. They build the habits the exam tests. Keep structured notes with commands, enumeration checklists and privilege escalation techniques you can search quickly.
Phase 3: Labs And Active Directory
Work through the PEN-200 challenge labs, treating each as a mini engagement. Spend extra time on Active Directory, since the AD set is 40 points and starts from an assumed breach with domain credentials. Practice enumeration, Kerberos attacks, credential reuse and lateral movement until they feel routine.
Phase 4: Exam Simulation
Run at least one full mock exam: three standalone machines and an AD set in one sitting, with a timer, breaks and a written report afterward. Practice without Metasploit on most machines so the one-machine limit does not catch you out, and prepare your report template in advance.
Phase 5: Exam Day
Read the current exam guide and proctoring FAQ again. Plan sleep and meals, enumerate everything before going deep, move on when stuck and take screenshots as you go. Leave enough time in the 24-hour reporting window to write clearly and check every required proof.
[EXPERT QUOTE: White Knight Labs, John Stigerwalt, on what hiring managers at an offensive security firm look for in candidates beyond the OSCP]
Is The OSCP Worth It In 2026?
For people aiming for hands-on offensive roles, usually yes. The OSCP remains one of the credentials most often named in penetration testing job ads and vendor proposals, and the exam proves you can work under time pressure and document your findings. It also builds a base for harder certifications such as OSEP and OSWE, and for red team training.
It is less clear-cut on cost. At $1,749 to $2,749 for a typical first attempt, plus the possible need for a retake, the OSCP is several times the price of the PNPT. The OSCP+ expiry adds a renewal cost every three years if you want to keep the active designation. And the certification alone will not get you hired: employers also look for practical experience, writing ability, home labs, write-ups and community work.
We have not included salary figures because published numbers vary widely by region, role and source, and few are tied specifically to the OSCP. A better way to judge value is to look at the job ads you want and see which certifications they name.
Frequently Asked Questions
How Hard Is The OSCP Exam?
It is demanding but achievable with preparation. The difficulty comes from the time pressure, the need to find attack paths without hints, the AD set and the report requirement rather than from obscure techniques. Most candidates who fail cite poor enumeration or time management.
Does The OSCP Expire?
The OSCP itself does not. The OSCP+ designation, given to anyone passing from 1 November 2024, expires after three years unless renewed through a recertification exam, another qualifying OffSec exam or OffSec’s CPE program.
Can I Use AI Tools During The OSCP Exam?
No. OffSec’s exam guide prohibits LLMs and AI chatbots, including its own KAI assistant, during the exam.
How Many Attempts Do I Get?
The 90-day bundle includes one attempt, Learn One includes two and Learn Unlimited includes unlimited attempts for the subscription year. Extra attempts can be bought separately.
Is The OSCP Better Than The PNPT?
Neither is strictly better. The OSCP is more widely recognized by employers, while the PNPT is cheaper, does not expire and simulates a longer engagement with a live debrief. Many testers hold both.
Conclusion
The OSCP is still a strong investment for anyone heading into penetration testing or red teaming, as long as you go in prepared. Expect to pay $1,749 to $2,749 for a typical first attempt, spend several months on PEN-200 and the labs, and budget for OSCP+ renewal every three years if your employer or clients require the active version.
