OSEP is the exam where technical skill stops being enough. You get 48 hours, a corporate network with multiple machines, several attack paths, and a report that has to explain both the exploitation and the custom tooling you used to get there.
The candidates who fail usually do not fail because they cannot bypass defences. They fail because they spend thirty hours proving they can, and leave twelve for a document that carries as much weight as the shells.
What the exam is
- Duration: 48 hours, proctored over a private VPN.
- Environment: one large corporate network with multiple machines.
- Paths: some hosts are remotely exploitable; others require several steps and a foothold first.
- Deliverable: a professional report covering exploitation and custom exploit development, plus proof files.
- Course: PEN-300, more than twenty modules and seven challenge labs.
- Validity: does not expire. With OSWE and OSED, it forms the OSCE³.
The prerequisite is real: PEN-300 assumes OSCP-level fundamentals, including Active Directory basics, scripting in Bash, Python and PowerShell, and comfortable enumeration.
The difference from OSCP
| Dimension | OSCP | OSEP |
|---|---|---|
| Time | 24 hours | 48 hours |
| Defences | Standard lab | EDR/AV simulation, hardened hosts |
| Tooling | Mostly off-the-shelf | Custom payloads expected |
| Network | Standalones plus AD set | One large corporate network |
| Report | Per target | Per objective, including tool development |
The evaluation is not “did you get domain admin”. It is “can you operate against defences and explain how”.
Preparation that matches the syllabus
PEN-300 covers client-side attacks, application whitelisting bypass, EDR evasion, credential theft, lateral movement, persistence, and advanced AD attacks. Four weeks of focused work, assuming OSCP-level baseline:
| Week | Focus | Output |
|---|---|---|
| 1 | Client-side and payload delivery | Two working delivery chains, documented |
| 2 | Evasion and process injection | Payload that survives a current AV scan |
| 3 | AD attacks and lateral movement | Full chain from foothold to DA in a lab |
| 4 | Custom tooling and simulation | One custom tool, two 24-hour runs |
Custom tooling is the differentiator. Off-the-shelf frameworks get flagged in the exam environment, and the report rewards original code. Even a small PowerShell or C# utility that performs one step reliably is worth more than a Metasploit module that gets caught.
How to use 48 hours
| Block | Hours | Task |
|---|---|---|
| Recon | 6 | Network map, exposed services, initial access options |
| Foothold | 10 | Client-side or service exploitation, first credentials |
| Sleep | 6 | Before accuracy degrades |
| Lateral movement | 12 | AD enumeration, privilege escalation, persistence |
| Objectives | 6 | Remaining proofs and chains |
| Report | 8 | Draft, evidence check, submission |
Note the report block. OSEP reports are longer than OSCP reports because they document tool development and evasion decisions. Eight hours is the minimum if you have been writing as you go.
What the report has to contain
- Attack narrative — how the network was taken, in order, from initial access to the final objective.
- Per-objective findings — the vulnerability, the exploitation method, and the evidence.
- Custom tooling — what you built, why off-the-shelf did not work, and how it was used.
- Evasion decisions — which defences were present and how the payload avoided them.
- Remediation — what would have stopped each step.
The evasion section is where technical depth shows. “Used an obfuscated payload” is not an explanation. Which signature, which behaviour, which detection mechanism was bypassed — and how — is.
Common preparation errors
- Repeating OSCP preparation. More boxes does not build evasion skill. Deliberate work against defended hosts does.
- Ignoring client-side. Initial access in a hardened network often depends on it.
- Never writing tools. The exam expects custom code; first attempts should not happen on the clock.
- No report practice. A 48-hour exam with a long report needs rehearsed documentation habits.
Is OSEP worth it
For red team and advanced penetration testing roles, yes. It is one of the few certifications that requires operating against defences rather than assuming none. The 48-hour window and the report requirement make it a credible signal, not a badge collected after a course.
It is also demanding in a specific way: it rewards patience and documentation as much as exploitation. Candidates looking for a harder OSCP often underestimate that shift.
Where to go next
For the certification overview, pricing, and study material, see the OSEP certification hub. For pacing across the two days, read OSEP exam experience, and for the failure patterns, OSEP common mistakes. If you are building the OSCE³, the OSWE hub covers the web half.
Certification names belong to OffSec. This is independent study material, not official course content.
Red team operator working across Active Directory and hybrid estates. OSCP, OSWE, CPTS and CRTO certified. Covers adversary simulation, evasion and report writing for red-team certifications.