OSEP does not feel like a bigger OSCP. It feels like an engagement that happens to have a deadline. One corporate network, defences that are actually trying, and a clock long enough that pacing becomes a skill in itself.
This is how the 48 hours tend to unfold, and the moments where attempts are won or lost.
Hour zero to six: the network is the puzzle
The first surprise is the shape of the environment. It is not a list of independent machines; it is a network with trust relationships, and the route in is rarely the route to the objective.
The opening block should produce a map, not a shell:
- Externally reachable services and what they suggest about the perimeter.
- Internal ranges visible after the first foothold.
- Authentication boundaries: which hosts trust which accounts.
- Where the objectives sit relative to those boundaries.
Candidates who start by firing exploits at the first host often obtain a low-value shell and then discover they have no path inward. The map tells you which foothold is worth the time.
The first foothold is the hardest
In a hardened network, initial access is usually client-side or a service with a narrow window. This is where preparation shows: candidates who practised payload delivery and social engineering move; candidates who practised only remote exploitation stall.
The practical lessons:
- Test the payload before delivering it. A payload blocked by the endpoint is not a foothold.
- Keep the delivery simple. Complex chains fail in ways that are hard to diagnose under time pressure.
- Document the chain immediately. The report will need it, and the details fade after the next success.
Hours ten to thirty: lateral movement and the quiet middle
Once inside, the exam becomes an Active Directory engagement with defensive controls. Enumeration, credential access, privilege escalation, and persistence — the familiar sequence, but with the added constraint that loud techniques get noticed.
This middle block is where the attempt is usually decided. Two behaviours separate candidates:
| Behaviour | Effect |
|---|---|
| Tracking every credential and where it works | Fast movement, no re-enumeration |
| Testing payloads before deploying them | Fewer burned hosts |
| Writing findings as they happen | Report assembled in hours, not a day |
| Chasing one stubborn host | Objectives missed elsewhere |
The last row is the classic failure. A host that resists for three hours is usually not the intended next step; the path is elsewhere and the resistance is a signal.
The evasion layer
PEN-300’s defining content is operating against EDR and AV. In the exam, this shows up as payloads that must run without being quarantined, and techniques that must avoid obvious behavioural signatures.
What candidates underestimate: evasion is not a single trick applied at the end. It is a property of the whole chain — how the payload is delivered, how it executes, what it writes to disk, and what network traffic it generates. A perfectly obfuscated payload that drops a recognisable file has not evaded anything.
Practise the full chain against a current defender, not a lab machine with protection disabled.
Hour thirty-six: the decision point
By the second night, most candidates have either reached the objectives or know which ones are out of reach. This is where judgement matters more than skill.
Three options:
- Push for the remaining objective if the path is visible and the steps are known.
- Consolidate if the remaining objective is uncertain — verify proofs, clean the report, test the exploits.
- Sleep if accuracy is degrading. This is usually the correct answer and the hardest to choose.
The report is graded per objective, and a missing proof can zero work already done. Consolidation is not giving up; it is protecting the points you have.
The report block
OSEP reports are longer than OSCP reports because they document tool development and evasion. A candidate who wrote as they went spends four to six hours assembling. A candidate who did not spends twelve and still misses evidence.
The sections that carry the most weight:
- The attack narrative — the network taken in order, with the reasoning at each pivot.
- Tool development — what was built, why, and how it performed.
- Defence evasion — which control was bypassed and by what mechanism.
- Remediation — the fix that would have stopped each step.
Remediation is often thin in failing reports. “Patch the vulnerability” is not remediation. “Restrict the service account’s delegation rights and alert on new SPN registrations” is.
What the exam actually feels like
Long stretches of quiet work punctuated by short, decisive moments. The technical peaks are brief — a payload lands, a credential works, a host falls — and the rest is enumeration, documentation, and judgement about where to spend the next hour.
The candidates who describe it as “brutal” usually mean the report, not the hacking. The candidates who describe it as “fair” usually wrote as they went.
Three habits that decide the attempt
- Map before you move. The network rewards the candidate who knows where the objectives are.
- Write every finding immediately. The report is half the certification.
- Sleep before the mistakes start. Accuracy is the real constraint, not hours.
Where to go next
For the certification overview and study material, see the OSEP certification hub. For exam structure and a four-week plan, read OSEP exam: 48 hours, evasion and the report that decides it. For the failure patterns, see OSEP common mistakes.
Certification names belong to OffSec. This is independent study material, not official course content.
Red team operator working across Active Directory and hybrid estates. OSCP, OSWE, CPTS and CRTO certified. Covers adversary simulation, evasion and report writing for red-team certifications.