OSCP and CPTS both test practical penetration testing skills, but they do it in noticeably different ways. OSCP+ puts candidates into a tightly timed, proctored assessment built around standalone targets and an Active Directory environment. CPTS uses a longer assessment window and places strong emphasis on end-to-end penetration testing methodology and professional reporting.
That difference matters when deciding where to invest your preparation time.
OSCP vs CPTS: The Short Answer
OSCP and CPTS overlap heavily in core penetration testing skills, including enumeration, exploitation, privilege escalation, Active Directory and documentation. The biggest differences are the assessment format, training ecosystem, time pressure and the way candidates are expected to demonstrate their methodology.
OSCP+ uses a 23-hour-and-45-minute proctored exam followed by a separate reporting window. CPTS provides a 10-day exam period and expects candidates to submit detailed professional documentation.
Neither certification should be treated as a simple multiple-choice credential. Both require you to actually perform technical work.
OSCP and CPTS at a Glance
| Area | OSCP / OSCP+ | HTB CPTS |
|---|---|---|
| Provider | OffSec | Hack The Box |
| Training path | PEN-200 | Penetration Tester Job Role Path |
| Level | OffSec 200-level | HTB describes CPTS as intermediate |
| Assessment | Hands-on | Hands-on |
| Exam window | 23 hours 45 minutes | 10 days |
| Reporting | Required | Required |
| Active Directory | Major exam component | Covered as part of the pentesting skill set |
| Proctoring | Yes | Different HTB exam workflow |
| Main emphasis | Practical exploitation under a compressed time limit | Full penetration testing workflow and professional reporting |
The comparison becomes more useful once you look beyond the certification names and examine how each assessment actually works.
What Does the OSCP+ Exam Test?
The current OSCP+ exam is built around three standalone machines and one Active Directory set containing three machines.
The standalone targets are worth a combined 60 points. The Active Directory environment contributes another 40 points, and candidates need at least 70 out of 100 points to pass.
OffSec’s current authoritative domain weighting is also revealing:
| Domain | Weight |
|---|---|
| Identifying Vulnerabilities | 12% |
| Exploiting Systems | 11% |
| Escalating Privileges | 18% |
| Active Directory | 26% |
| Documenting Findings | 33% |
That last number deserves attention.
Documentation is not something to think about after learning exploitation. OffSec places substantial emphasis on documenting findings, and its exam guide requires candidates to produce a professional report detailed enough for a technically competent reader to reproduce the attacks.
The current exam also places clear restrictions on automation and assistance. Candidates should always review OffSec’s current exam guide before sitting the assessment because permitted and prohibited tooling can change.
What Does the CPTS Exam Test?
HTB Certified Penetration Testing Specialist is designed around comprehensive hands-on penetration testing rather than isolated theoretical questions.
Hack The Box describes CPTS as an intermediate certification testing technical competency in ethical hacking and penetration testing. Candidates are expected not only to identify and exploit weaknesses but also to assess infrastructure risk and produce an actionable, commercial-grade penetration testing report.
The associated Penetration Tester Job Role Path is substantial. HTB currently estimates it at 42 days and six hours based on eight-hour study days, equivalent to approximately 342 hours of material.
That gives CPTS a particularly structured training pipeline.
Instead of studying isolated techniques simply because they may appear on an exam, candidates work through a curriculum designed around the broader penetration testing process.
OSCP vs CPTS Exam Format
The most obvious difference between OSCP and CPTS is time.
OSCP+
OSCP+ gives candidates 23 hours and 45 minutes for the technical assessment.
After the technical exam ends, OffSec provides another 24 hours to upload the required documentation.
The environment consists of:
- Three standalone targets
- One three-machine Active Directory set
- 100 total available points
- 70 points required to pass
All OSCP+ exams are proctored.
That creates a compressed assessment where technical methodology and time management matter simultaneously.
You may know how to exploit a service, but spending several hours following the wrong attack path can still damage the rest of your attempt.
CPTS
CPTS takes a different approach.
Hack The Box currently provides a 10-day exam window. Candidates must complete the technical assessment and submit professional documentation through the HTB exam workflow.
The longer window should not automatically be interpreted as an easier exam.
It changes the type of pressure.
OSCP asks you to execute under a much shorter clock. CPTS gives you more elapsed time but expects you to work through a broader penetration testing process and produce a professional report.
Skills: Where the Two Certifications Differ
There is enough overlap that studying for one can improve skills relevant to the other, but the learning experiences are not identical.
Enumeration and Exploitation
Both certifications reward methodical enumeration.
Blindly launching exploits until something works is a poor strategy for either path. Candidates need to understand services, identify realistic attack surfaces and validate potential vulnerabilities before committing time to an avenue.
OSCP’s format makes efficient enumeration especially important because of the compressed exam window.
CPTS training, meanwhile, spends considerable time building the broader methodology surrounding enumeration and exploitation.
Active Directory
Active Directory is important to both paths.
In the current OSCP+ structure, the AD set accounts for 40 of the 100 available exam points. OffSec’s authoritative references assign Active Directory a 26% domain weighting.
Candidates preparing for OSCP therefore should not treat AD as an optional specialty.
CPTS also develops Active Directory penetration testing capabilities within the broader Penetration Tester path. The surrounding HTB curriculum places these techniques inside a wider methodology involving enumeration, credential access, pivoting and attack-path development.
Reporting
This is one of the strongest areas of overlap.
OffSec requires detailed documentation showing exploitation steps, commands, console output and appropriate proof. Inadequate documentation can reduce or eliminate credit for a target.
HTB similarly requires CPTS candidates to produce detailed, commercial-grade documentation in English.
That makes report writing a technical skill for both certifications rather than administrative work you can leave until the end of your preparation.
Practice reporting before exam day.
A technically successful lab session should leave you with enough evidence that another competent penetration tester could understand what happened and reproduce the process.
Attack Chaining and Methodology
CPTS training is particularly useful for candidates who want a structured end-to-end penetration testing curriculum.
HTB’s Penetration Tester path is designed specifically around the job role and currently contains a large amount of structured training material.
OSCP preparation through PEN-200 also covers a broad penetration testing foundation, but the exam’s shorter assessment window creates a different operational challenge: recognizing viable attack paths and executing them efficiently.
Is CPTS Harder Than OSCP?
There is no objective universal answer to whether CPTS is harder than OSCP.
The exams stress candidates differently.
OSCP+ compresses the technical assessment into less than 24 hours and combines exploitation, Active Directory, privilege escalation and evidence collection under strict time pressure.
CPTS gives candidates a much longer exam window but tests a broad penetration testing workflow and requires substantial technical documentation.
Community discussions from people comparing the certifications frequently describe CPTS as deeper in some technical areas while describing OSCP as more stressful because of its compressed timing. Those are candidate experiences, not an official difficulty scale.
Your background can reverse the perceived difficulty.
Someone comfortable with CTF-style time pressure but weak at long attack chains may experience CPTS differently from someone with professional pentesting experience who struggles with a 24-hour assessment.
A better question is:
Which type of assessment exposes more gaps in your current skill set?
OSCP vs CPTS Training and Preparation
The training ecosystems are another major difference.
PEN-200 for OSCP
OffSec’s PEN-200 is the training path associated with OSCP.
The current course covers areas including:
- Enumeration
- Vulnerability identification
- Exploitation
- Linux privilege escalation
- Windows privilege escalation
- Active Directory
- Web attacks
- Evidence collection
- Reporting
OffSec currently lists PEN-200 at approximately 321 hours of content.
HTB Penetration Tester Path for CPTS
CPTS is tied closely to the Hack The Box Academy Penetration Tester Job Role Path.
HTB currently estimates the path at approximately 342 hours.
The value of that number is not that 342 hours guarantees exam readiness. It gives you an idea of the size of the official curriculum.
Actual preparation time depends heavily on your existing experience.
A working penetration tester with strong Active Directory, web and privilege-escalation fundamentals will move differently from someone entering practical offensive security for the first time.
OSCP vs CPTS Cost
Cost is one of the clearest differences at the time of writing, although prices can change and should always be checked on the official provider sites before purchasing.
OffSec currently lists its Course + Cert Bundle for 200- and 300-level courses at $1,749, including 90 days of course and lab access and one exam attempt. Learn One is currently listed at $2,749 per year with one year of access and two attempts for the selected course.
A standalone OSCP+ exam option is also currently available.
Hack The Box currently lists CPTS certification access at $490 on its certification page, with its Academy subscription model affecting the overall training route you choose.
The headline price is only part of the calculation.
Consider:
- Required training access
- How long you need the labs
- Number of attempts
- Existing subscriptions
- Student eligibility
- Whether an employer is paying
- How much additional practice you need
Prices and package structures change, so verify them directly before making a purchase decision.
Career Differences: Where Each Certification Fits
Both credentials are relevant to practical penetration testing, but they signal somewhat different training experiences.
OSCP has been in the offensive-security certification market for much longer and is commonly discussed in hiring-oriented certification conversations. Current community discussions continue to cite recruiter and job-description recognition as a reason candidates pursue it.
That should not be interpreted as a guarantee of employment.
A certification cannot replace demonstrable technical skill, communication ability or professional experience.
CPTS is positioned by Hack The Box around hands-on intermediate penetration testing competency and commercial-grade reporting. Its curriculum is particularly attractive to candidates who want structured technical development rather than only an assessment target.
For a pentesting career, the useful question is therefore not simply which logo looks better on a résumé.
Ask what you need next:
Need a structured curriculum to develop broad practical pentesting methodology? CPTS training is designed specifically around that objective.
Want to demonstrate your skills through OffSec’s established practical certification track? OSCP follows that ecosystem and assessment model.
Already planning to complete both? Their overlapping technical foundations mean the work does not have to be duplicated from zero.
Should You Take CPTS Before OSCP?
Taking CPTS before OSCP can make sense if you want a structured technical foundation before moving into OSCP’s compressed exam environment.
The HTB Penetration Tester path covers a broad range of practical topics and forces candidates to think about professional reporting as part of the penetration testing workflow.
That experience can transfer to OSCP preparation.
The reverse path is also valid.
Someone who already has PEN-200 access, employer-funded OffSec training or substantial practical experience may reasonably start with OSCP and later use CPTS to deepen particular areas of methodology.
There is no mandatory certification order between the two.
Base the sequence on your existing skills, available training access and career objectives rather than treating one certification as a formal prerequisite for the other.
Preparing for Either Path
Whichever certification you pursue, build your preparation around repeatable methodology rather than memorized solutions.
Your workflow should eventually feel familiar:
- Define the attack surface.
- Enumerate systematically.
- Validate potential vulnerabilities.
- Establish initial access.
- Enumerate locally.
- Escalate privileges.
- Identify additional attack paths.
- Preserve evidence.
- Document the process while it is fresh.
- Review what you missed.
Do this repeatedly in realistic labs.
The important part is not knowing hundreds of commands. It is knowing what question you are trying to answer when you run each command.
Preparing for OSCP
If OSCP is your current target, CyberServices.Store provides OSCP preparation resources designed to complement hands-on practice and help candidates structure their preparation.
View OSCP Preparation Resources:
https://cyberservices.store/certifications/offsec/oscp/
Preparing for CPTS
If you’re working through the HTB penetration testing track, you can also explore CPTS preparation materials and supporting resources.
Explore CPTS Preparation Resources:
https://cyberservices.store/certifications/hack-the-box/cpts/
Use preparation material as a learning aid. It should strengthen your methodology, reporting and technical understanding rather than replace the hands-on work required to develop those skills.
OSCP vs CPTS FAQ
Is CPTS harder than OSCP?
There is no official cross-provider difficulty scale. CPTS and OSCP create different challenges. OSCP+ places candidates under a much shorter technical exam window, while CPTS provides a longer assessment period and emphasizes broad penetration testing methodology and professional reporting. Your existing skills strongly influence which feels harder.
Is CPTS a replacement for OSCP?
Not directly. They are independent certifications from different providers. Both validate hands-on penetration testing skills, but their training ecosystems, assessment structures and certification positioning differ.
Should I take CPTS or OSCP first?
CPTS first can make sense if you want a highly structured penetration testing curriculum before attempting OSCP. Starting with OSCP can also make sense if you already have the necessary foundations, OffSec training access or employer sponsorship. Neither certification is an official prerequisite for the other.
Does OSCP expire?
Passing the current OSCP+ exam awards both OSCP and OSCP+. OffSec states that the underlying OSCP certification remains valid indefinitely, while the OSCP+ designation is valid for three years and is subject to OffSec’s current renewal requirements.
How long is the CPTS exam?
Hack The Box currently provides a 10-day exam period for CPTS. Candidates must also satisfy HTB’s reporting and submission requirements.
How long is the OSCP exam?
The current OSCP+ technical exam lasts 23 hours and 45 minutes. Candidates then receive another 24 hours to upload their exam documentation.
Is reporting required for both OSCP and CPTS?
Yes. Both providers explicitly require technical documentation. OffSec requires detailed evidence and reproducible exploitation steps, while Hack The Box describes CPTS reporting as commercial-grade, actionable penetration testing documentation.
Does CPTS help with OSCP preparation?
There is substantial technical overlap in areas such as enumeration, exploitation, privilege escalation, Active Directory and reporting. Completing CPTS training can therefore develop skills relevant to OSCP, although the exams have different formats and candidates should still prepare specifically for the rules and objectives of the certification they intend to take.