Choosing a DevSecOps certification is unusually difficult, and the reason is that the category barely holds together. Some of the credentials below are hands-on exams where you break and then secure a real pipeline. Others are 40-question open-book tests you can pass in an hour. A few are cloud or Kubernetes credentials that the market has quietly reclassified as DevSecOps because that is where the budget is. They are all sold under the same banner, and the price range runs from $200 to $1,199 before you add training.
The second problem is decay. Microsoft retired AZ-500 on 31 August 2026. PeopleCert retired DevOps Engineering Foundation in February 2026. HashiCorp’s “Vault Operations Professional” no longer exists under that name. Several widely circulated DevSecOps certification acronyms are not offered by anyone and never were, which is what happens when roundups get generated from other roundups. Every entry on this list was checked against the issuing body’s own page in September 2026, and where an issuer does not publish a figure, this article says so instead of inventing one.
Twelve certifications follow, ordered from hands-on pipeline security through the platform and cloud specialisms to the foundation-level credentials, with a section at the end on which programs have been retired or renamed. For the broader field, the roundup of the best cybersecurity certifications covers the governance and SOC tracks that sit alongside this one.
DevSecOps Certifications At A Glance
Certification
Issuer
Exam format
Price
Validity
ASCPC (Attacking and Securing CI/CD Pipeline)
White Knight Labs
48-hour live lab plus 48 hours to report
$700
Does not expire
Certified DevSecOps Professional (CDP)
Practical DevSecOps
5 hands-on challenges, 6 hours, plus 24-hour report
$899 including course
Lifetime
GCSA (Cloud Security Automation)
GIAC
75 questions, 2 hours, 66% to pass
$999 exam attempt
4 years
CKS (Certified Kubernetes Security Specialist)
Linux Foundation and CNCF
Performance-based command line, 2 hours
$445 exam only
2 years
CSSLP
ISC2
125 questions, 3 hours, 700 to pass
$599
3-year cycle, 60 CPE
Certified DevSecOps Expert (CDE)
Practical DevSecOps
5 hands-on challenges, 24 hours, plus 24-hour report
$1,199
Lifetime
E|CDE (Certified DevSecOps Engineer)
EC-Council
100 questions, 4 hours, 70% to pass
Quote only from EC-Council
3 years plus annual fee
CCSK v5
Cloud Security Alliance
Open book online, 60 questions, 120 minutes, 80% to pass
$445 for two attempts
Does not expire
GitHub Advanced Security (GH-500)
GitHub and Microsoft
Proctored, 100 minutes, 700 to pass
Not published, priced regionally
Annual free renewal
DevSecOps Foundation
DevOps Institute, examined by PeopleCert
40 questions, open book, 60 minutes, 65% to pass
$503 including learning kit
3 years, 30 CPD
KCSA (Kubernetes and Cloud Native Security Associate)
Linux Foundation and CNCF
Online proctored multiple choice, 90 minutes
$250 exam only
2 years
Associate JFrog Security Certification
JFrog
50 questions, 65 minutes, plus 60-minute hands-on lab
$200
2 years
Best DevSecOps Certifications In 2026
1. White Knight Labs ASCPC — The Only Certification That Makes You Attack A Pipeline Before You Secure It
ASCPC, the Attacking and Securing CI/CD Pipeline Certification, is the entry on this list that comes closest to what DevSecOps work actually involves. It is run by White Knight Labs, an offensive security consultancy, and it is the only certification in that firm’s seven-course catalogue with an explicit defensive half. The offensive side covers enumerating CI/CD platforms and pipelines, exploiting pipeline misconfigurations, stealing and abusing pipeline secrets, poisoning build artifacts and containers, abusing OIDC and cloud identity trust relationships, and pivoting out of a pipeline into the cloud environment behind it. The platforms named are the ones teams actually run: GitHub Actions, CircleCI, Azure DevOps, AWS CodeBuild, Docker, container registries and Kubernetes deployment pipelines.
The defensive half then asks you to close those specific paths: permission boundaries, secret management controls, artifact integrity protections and identity trust policies. That ordering is the point. Most DevSecOps training teaches controls first and leaves you to infer the attack they prevent, which is how organizations end up with a pipeline that passes a checklist and still hands an attacker a cloud administrator token through a misconfigured OIDC trust.
The exam is $700 and runs like the rest of the catalogue: 48 hours inside a live CI/CD lab environment, then a further 48 hours to submit a professional certification report. Graduates are expected to be able to lead a pipeline security assessment and write it up for a client, which is a meaningfully different bar from answering 100 multiple-choice questions about supply chain concepts. One exam voucher is included and it does not expire, course access is for the life of the course, and the certification itself does not expire, so there is no CPE requirement and no annual maintenance fee. Retakes are purchased separately.
Two practical notes. ASCPC is on-demand only, so it is not among the three courses (ARTOC, OAOTC and ODPC) that White Knight Labs also delivers as live four-day Zoom training at $1,200. And if you want more than one certification, the bundles price at $1,250 for any two, $1,800 for any three and $3,000 for the full on-demand catalogue, while CertForge Pro is $1,000 a year for every current and future course plus two exam attempts. The courses were built and are taught by co-founders John Stigerwalt and Greg Hatcher, who hold OSCP, OSCE and CRTE, and GPEN, GXPN, GWAPT and CRTP respectively, and have taught at BlackHat, the NSA, WildWest Hacking Fest and Antisyphon. The firm’s consulting side also runs DevSecOps assessment and engineering engagements, covered on its White Knight Labs company profile.
2. Practical DevSecOps CDP — Five Hands-On Challenges In Six Hours, No Multiple Choice Anywhere
The Certified DevSecOps Professional is the most widely recognised DevSecOps-specific credential that is not a cloud or Kubernetes certification wearing a DevSecOps label. The exam gives you five hands-on challenges in six hours, followed by a 24-hour window to submit a report, and the vendor is explicit that there is no multiple choice at any point. Passing needs 80 out of 100, with partial credit awarded on tasks.
At $899 the price includes the course, more than 100 lab exercises, 60 days of lab access, three years of video access and 36 CPE credits, and the certification is lifetime with no renewal. Prerequisites are light: basic Linux command line and familiarity with the OWASP Top 10. Retakes are a flat $100, which is the most forgiving retake policy in this comparison by a wide margin.
The honest caveat is that this is a single-vendor ecosystem with a large ladder of adjacent products, currently eleven of them, priced from $599 to $1,199. That is a strength if you want a structured path and a weakness if you are looking for a credential with cross-industry brand weight of the kind CISSP or CKS carries. CDP is the one to start with, and it is the only place on that ladder most engineers need to stop.
3. GIAC GCSA — SANS Rigor And The Highest Total Cost On This List
GCSA, Cloud Security Automation, is GIAC’s only explicitly DevSecOps credential, and it carries the recognition that comes with the SANS name. The exam is one proctored sitting of 75 questions in two hours with a 66% passing score for exam versions from 29 June 2024 onward, delivered remotely through ProctorU or onsite at Pearson VUE, with 120 days from activation to sit it. Worth knowing: this is a standard proctored exam, not one of GIAC’s CyberLive hands-on formats.
The certification attempt is $999, with a retake at $899, a practice exam at $399 and a $175 seating fee for a missed appointment. The real number is the course. SEC540, Cloud Native Security and DevSecOps Automation, is five days and 38 hours with 19 hands-on labs, priced at $8,780 for OnDemand access. SANS lets you add a certification attempt to a course purchase but does not publish the bundled price, so treat the course and the exam as two separate published figures rather than assuming a discount.
Validity is four years with a $499 maintenance fee, falling to $249 for subsequent renewals registered within a two-year period. You get up to three failed attempts per certification attempt, and extensions of 45 days each up to a maximum of ten, capped at 570 days of total access. GCSA is the right choice when an employer is funding SANS training anyway. It is a hard purchase to justify personally.
CKS, the Certified Kubernetes Security Specialist, is the strongest Kubernetes security certification available and one of the few credentials anywhere that cannot be passed by reading. The exam is entirely performance-based: you solve multiple tasks from a command line against a running Kubernetes cluster, in two hours, with no multiple choice. It is currently tested against Kubernetes v1.35 and updated within roughly four to eight weeks of each Kubernetes release, which keeps it unusually current.
There is a hard prerequisite: you must have passed the Certified Kubernetes Administrator exam before attempting CKS. That is not a recommendation, it is enforced, and it roughly doubles the real cost and study time for anyone who does not already hold CKA. The exam alone is $445, or $645 bundled with the course, and it includes two attempts within a 12-month eligibility window.
Validity is two years, which is the shortest on this list and a deliberate reflection of how fast the platform moves. For teams running production Kubernetes, CKS is the certification that most reliably predicts whether someone can actually harden a cluster rather than describe hardening. If you are earlier in that journey, KCSA further down this list is the same issuer’s entry point.
5. ISC2 CSSLP — The Secure Software Lifecycle Credential, Now With A Supply Chain Domain
CSSLP is the application security certification for people who own security across the software development lifecycle rather than in one tool. The exam is 125 multiple-choice questions in three hours with a passing grade of 700 out of 1,000, at a Pearson VUE test centre, under the outline effective 15 September 2023. Eight domains carry it: secure software architecture and design at 15%, implementation at 14%, testing at 14%, requirements at 13%, concepts at 12%, lifecycle management and deployment, operations and maintenance at 11% each, and secure software supply chain at 10%.
That last domain is why CSSLP still belongs on a 2026 list. Supply chain security stopped being a subsection of appsec and became its own budget line, and CSSLP is one of the few vendor-neutral credentials that examines it as a named domain rather than a bullet point.
The exam is $599, and the gate is experience: four years of cumulative paid SDLC work in one or more domains, or three years plus a four-year degree in computer science, IT or a related field. The Associate of ISC2 route lets you pass first and take five years to earn the experience. Maintenance is 60 CPE credits per three-year cycle with at least 20 in Group A, plus the $135 ISC2 annual fee, which you pay once no matter how many ISC2 certifications you hold. CSSLP is ANAB accredited and approved under US DoDM 8140.03, which matters for federal work.
The Certified DevSecOps Expert is the advanced tier above CDP and the only credential in this field that runs a 24-hour hands-on exam. Five challenges across a full day, then a further 24 hours to submit the report, with a 70% pass mark rather than the vendor’s usual 80%. It is $1,199, lifetime, and CDP is a stated prerequisite, so the realistic total is $2,098 across both exams.
A 24-hour window is a genuinely different test. It stops being about whether you know the technique and starts being about whether you can sustain judgment, triage and documentation across a long engagement, which is exactly what a real pipeline assessment demands. Very few certifications in any security discipline test that.
Who it suits: senior engineers who already hold CDP and want a credential that distinguishes them in a market where most DevSecOps certifications can be passed in an afternoon. Retakes are $100, the same as every other certification from this vendor. If you only want one credential from Practical DevSecOps, take CDP. CDE earns its price when the audience for it is a hiring panel that already knows the difference.
7. EC-Council E|CDE — More Than 100 Labs Across On-Premises, AWS And Azure
The Certified DevSecOps Engineer is EC-Council’s entry in this category, and the lab library is its strongest feature: more than 100 online and offline labs, split as 32 on-premises, 32 on AWS and 29 on Azure. For an engineer who needs exposure to secure pipeline practice across three environments rather than one, that breadth is hard to match at this level.
The exam itself is conventional: 100 multiple-choice questions in four hours with a 70% passing score, delivered through EC-Council’s exam portal under exam code 312-97. Prerequisites are awareness of application security concepts plus enrolment in EC-Council’s own DevSecOps course, which is a commercial gate rather than a knowledge one. Certification sits inside EC-Council’s continuing education scheme: valid three years, 120 credits per certification per cycle, plus an $80 annual continuing education fee.
Pricing needs care. EC-Council does not publish a price for E|CDE on its own certification page, only an enquiry form. Its iClass storefront lists $999 for a single on-demand certification course and $3,999 for unlimited on-demand courses, which is EC-Council’s own property but is a course price rather than a published exam price. Get a written quote before you commit, and note that the certification’s validity period is not stated on the E|CDE page at all, only in the separate continuing education policy.
CCSK, the Certificate of Cloud Security Knowledge, is the cheapest way onto a DevSecOps resume that a cloud architect will recognise, and the terms are the friendliest here. Version 5 has been live since 16 July 2024, consolidated from 14 domains to 12, with added coverage of AI and generative AI, zero trust and cloud workload security. The exam is open book and online: 60 multiple-choice questions drawn at random from a larger pool, 120 minutes, 80% to pass. The $445 token includes two attempts usable within two years.
The detail that makes CCSK unusual is that it does not expire. There is no renewal cycle, no CPE requirement and no annual fee, which over six years makes it dramatically cheaper than any ISC2 or CompTIA credential. It also has a specific side benefit: holding CCSK waives up to one year of the experience requirement for ISC2’s CCSP, capped at one year total.
Open book and 80% are the right way to read the difficulty. This is a knowledge credential, not a capability one, and nobody should present it as evidence of hands-on skill. CSA also offers CCZT, the Certificate of Competence in Zero Trust, on identical terms at $175, and it likewise does not expire. Taken together they are a cheap, durable pair of credentials to hold alongside a hands-on certification from higher up this list.
If your pipeline is GitHub, GH-500 is the most directly applicable credential on this list. It is a proctored 100-minute exam through Pearson VUE with a passing score of 700, and it still exists under the GitHub Advanced Security name despite GitHub renaming the underlying products. Microsoft does not publish the question count.
The exam changed significantly in July 2026 to adopt the new product naming, and the study guide states the mapping plainly: Secret Protection was formerly Secret Scanning, Supply Chain Security was formerly Dependabot and dependency review, and Code Security was formerly Code Scanning with CodeQL. Domain weightings run 15 to 20% each for describing the security suites, secret protection, supply chain security and security operations, with 10 to 15% each for code security and administration. Any course written before July 2026 uses the old terminology throughout.
Price is not published by either GitHub or Microsoft, both of which state it varies by the region in which the exam is proctored, so ignore any figure you see quoted elsewhere. Renewal is annual through a free online assessment on Microsoft Learn, the same mechanism as Microsoft’s other associate credentials. Certifications earned through Pearson VUE from 1 July 2025 onward appear in the Microsoft Learn profile, while earlier ones remain in the GitHub Learn profile.
DevSecOps Foundation is the DevOps Institute credential now examined by PeopleCert, which acquired the institute. It is a 40-question open-book exam in 60 minutes with a 65% passing score and no prerequisites, priced at $503 including the learning resource kit and the exam voucher, and renewed every three years with 30 CPD points through PeopleCert Plus membership. It is available in English, Chinese, Japanese and Brazilian Portuguese.
Judged as an engineering credential this is the weakest entry here, and it should not be sold as one. Judged for what it is, it does a job nothing else on this list does: it gives a mixed group of developers, operations staff, product owners and managers a shared vocabulary and a common model for how security fits into delivery. Organizations rolling out a DevSecOps program across teams get more out of putting twenty people through this than out of putting one engineer through a hands-on exam.
One reassurance, because PeopleCert has been pruning the DevOps Institute catalogue: DevSecOps Foundation is not on the retirement list. DevOps Engineering Foundation, Certified Agile Service Manager, AIOps Foundation v1.0 and Observability Foundation v1.0 all were, with final exam dates through 2026. DevSecOps Foundation remains purchasable.
11. Linux Foundation KCSA — The Kubernetes Security Entry Point, Without The CKA Requirement
KCSA, the Kubernetes and Cloud Native Security Associate, exists because CKS gates behind CKA and a lot of people need a Kubernetes security credential before they are ready for either. It is explicitly pre-professional, described by the Linux Foundation as designed for candidates interested in advancing to the professional level, with no prerequisites and a beginner difficulty rating.
The exam is online proctored multiple choice over 90 minutes. The Linux Foundation does not publish the question count. It is $250 for the exam alone or $495 bundled with the THRIVE-ONE annual subscription, includes two attempts within a 12-month eligibility window, and is valid for two years.
Read it as what it is. Multiple choice at associate level does not demonstrate that you can harden a cluster, and anyone hiring for that should be asking for CKS. KCSA earns its place as a stepping stone and as a reasonable way to validate a wider team’s baseline understanding of cloud native security without putting everyone through a performance-based exam.
Most security tool vendors offer completion certificates, learning badges or partner sales tracks and call them certifications. JFrog’s is the exception, and it is the reason this slot goes to an artifact management vendor rather than a scanner. The Associate JFrog Security Certification is 50 multiple-choice questions in 65 minutes plus a separate 60-minute hands-on lab, and passing requires both 80% on the exam and successful task verification in the lab environment. It is $200, allows up to two attempts at the theory exam, and is valid for two years.
It fits this list because artifact repositories and binary provenance are where software supply chain security is actually enforced, and because the graded practical component means it proves something. At $200 it is also the cheapest credential here with any hands-on element at all.
The obvious limitation is that it is product specific. It demonstrates that you can configure JFrog’s tooling correctly, not that you can reason about supply chain risk in general, which is what CSSLP’s supply chain domain or ASCPC’s artifact poisoning work covers. Take it if your organization runs JFrog. Skip it if it does not.
Retired And Renamed DevSecOps Certifications
Roundups in this niche recycle each other, and the result is that several certifications still being recommended in 2026 either no longer exist or never did. Checked against the issuing bodies in September 2026, these are the ones to ignore.
Microsoft AZ-500 is retired. The Azure Security Engineer Associate certification, its exam and its renewal assessments were all retired on 31 August 2026, and it can no longer be earned or renewed. Microsoft’s current cloud security engineer associate credential is SC-500, Cloud and AI Security Engineer Associate, a 120-minute proctored exam with interactive components. Microsoft does not publish its price, which varies by region, and does not state in so many words that SC-500 replaces AZ-500, so describe it as the current equivalent rather than a direct successor.
“Vault Operations Professional” no longer exists under that name. HashiCorp’s certification program survived the IBM acquisition intact, with no retirement or suspension notice on any of its pages, but the advanced Vault credential is now HashiCorp Certified: Vault Operations Advanced. It is a lab-based and multiple-choice exam over four hours including a 15-minute break, at $295 with one complimentary retake, valid two years. Vault Associate, at $70.50 for a one-hour multiple-choice exam, also valid two years, is the entry point. Both are reasonable secrets management credentials; only the old name is dead.
Several circulating acronyms are not real. CAST, CTIP and CTPP appear in DevSecOps certification lists attributed to Practical DevSecOps and are not in that vendor’s catalogue, on its exam pages or on its retake policy. CTPP appears to be a stale name for what is now CTMP, the Certified Threat Modeling Professional. If a roundup lists them, it was not checked.
Snyk and Aqua Security do not issue security certifications. Snyk Learn offers learning paths, quizzes and progress certificates with no proctored exam, no credential and no validity period. Aqua’s Aquademy certifications are partner and sales oriented, including a sales certification and a certified sales engineer track. Neither belongs on a certification list. Datadog’s Cloud SIEM for AWS Fundamentals is a genuine exam at $100 with a three-year validity, but it is a SIEM and detection credential rather than a pipeline security one. GitLab does list a Certified Security Specialist, but its certification pages publish no format, price or validity that can be verified, so it cannot be recommended on the record.
Two new GIAC certifications are worth watching. GIAC AI Platform Security (GAIPS) is 54 questions in two hours at 65% to pass, uses CyberLive hands-on virtual machine testing, and includes an objective on development pipelines and MLOps security covering data workflows, training pipelines and model lifecycle operations. GIAC AI Security Automation Engineer (GASAE) is 82 questions in three hours at 70%, covers security automation, infrastructure as code and Azure and AWS security automation, and names DevSecOps engineers in its own target audience. Both are new enough that neither has hiring recognition yet, which is why they are here rather than in the numbered list.
How To Choose A DevSecOps Certification
Is The Exam Hands-On Or Multiple Choice?
This divides the list more sharply than price does. Genuinely hands-on: ASCPC’s 48-hour live lab with a report, CDP’s five challenges in six hours, CDE’s 24-hour version of the same, CKS’s performance-based terminal exam, and the JFrog certification’s graded lab component. Multiple choice: GCSA, CSSLP, E|CDE, CCSK, GH-500, DevSecOps Foundation and KCSA. Both formats are legitimate, but they answer different questions. A hiring panel that wants evidence you can secure a pipeline should be looking at the first group. A compliance requirement that wants a recognised credential on file is often better served by the second.
What Is The Cost Over Six Years, Not Six Weeks?
Non-expiring credentials look expensive up front and cheap in the long run. ASCPC at $700, CDP at $899 and CCSK at $445 have no renewal cost at all. CSSLP adds six years of $135 ISC2 annual fees, which is $810 on top of the $599 exam, plus 120 CPE credits of your time. GCSA adds $499 at year four. CKS and KCSA expire in two years, so a six-year horizon means paying three times. E|CDE adds $80 a year plus 120 credits per cycle. GH-500 renews free but annually. None of this is hidden, and almost nobody adds it up before buying.
Are You Certifying A Person Or A Team?
The right answer changes completely depending on which. For one senior engineer who needs to demonstrate capability, a hands-on credential at the top of this list is worth more than three knowledge credentials. For a twenty-person delivery organization that needs a shared model of how security fits into the pipeline, DevSecOps Foundation at $503 or KCSA at $250 across the group will change more behaviour than a single expert certification ever does. Several vendors price for the team case directly, including White Knight Labs’ CertForge Teams All-Access at $1,250 per seat per year, dropping to $1,000 at ten or more seats.
Does It Match Your Actual Stack?
Vendor-neutral credentials travel between jobs; platform credentials pay off faster in the job you have. If your pipeline runs on GitHub Actions, GH-500 will change how you configure it next week. If you run production Kubernetes, CKS is the certification that predicts competence. If you run JFrog, its certification is directly applicable. The pattern that works for most people is one vendor-neutral credential for portability and one platform credential for the work in front of them, rather than collecting platform certifications for tools they do not use.
Is Training Included Or Sold Separately?
Three different models are on this list and mixing them up is how budgets get blown. Practical DevSecOps bundles course, labs and exam into one price. GIAC sells the exam attempt at $999 and SANS sells SEC540 at $8,780 as two separate transactions. EC-Council effectively requires you to buy its course to be eligible and does not publish either price. The Linux Foundation sells exam-only or course-bundled at a $200 difference. Before comparing headline prices, work out whether the figure includes the teaching.
Was The Roundup You Are Reading Actually Checked?
This niche has a specific quality problem: the volume of search traffic is low enough that most content is generated rather than researched, and vendors publish their own competitor comparisons. Practical DevSecOps, for instance, runs its own best DevSecOps certifications roundup, which ranks its own products first. Three tests for any list including this one: does it name exam formats and passing scores, does it state whether the certification expires, and does it flag the retired ones. A list that recommends AZ-500 in 2026 has not been near a Microsoft page.
Conclusion
For most engineers the decision comes down to three options. If you want a credential that proves you can find and fix the way a pipeline actually gets broken, ASCPC’s 48-hour lab and report at $700, with no expiry, is the closest fit on this list. If you want the recognised DevSecOps-specific certification with a hands-on exam and a bundled course, CDP at $899 is the default and CDE the senior step above it. If you run Kubernetes in production, CKS is not optional, and budget for CKA first because the prerequisite is enforced.
Around those, CCSK at $445 is the cheapest durable knowledge credential in cloud security and never expires, CSSLP is the credential to hold if secure software lifecycle ownership is your job title, and GH-500 or the JFrog certification pay off quickly if your stack matches them. Whatever you choose, check the exam code, the price and the validity period on the issuing body’s own page first. Four of the credentials discussed here changed version, name or ownership in the last eighteen months, and one widely recommended alternative was retired outright. For adjacent tracks, the penetration testing certifications comparison covers offensive credentials, and the roundup of top application security companies covers the firms that do this work rather than teach it.
If you want to feature your company on this list, email us or submit a form in the Top Choices section. After a thorough assessment, we’ll decide whether it’s a valuable addition.
