The OSED certification is a highly specialized OffSec credential focused entirely on Windows exploit development, making it a fundamentally different challenge from the OSCP. Both sit under the OffSec umbrella, but they serve different stages of a security career and demand very different skill sets. If you are deciding which one to pursue next, understanding the gap between them can save you months of misdirected preparation.
- What Are OSCP and OSED, Exactly?
- Core Technical Differences at a Glance
- Prerequisites: What You Need Before Each Exam
- OSED Certification Difficulty vs OSCP
- Exam Format and Scoring Compared
- Career Impact and Job Market Value
- Which Certification Should You Pursue Next?
- Frequently Asked Questions
What Are OSCP and OSED, Exactly?
OSCP (Offensive Security Certified Professional) is OffSec’s flagship penetration testing certification, built around the PEN-200 course and covering a broad range of network, web, and Active Directory attack techniques. OSED (Offensive Security Exploit Developer) is a focused, advanced credential tied to the EXP-301 course, covering Windows user-mode exploit development, custom shellcode writing, and bypass techniques for modern mitigations like DEP and ASLR.
OSCP teaches how to exploit known vulnerabilities in a structured pentest scenario. OSED teaches how to build the exploit itself from scratch against hardened targets. That distinction defines every difference discussed below.
“OSCP proves you can conduct a penetration test. OSED proves you can engineer the weapon. Both credentials belong to the same arsenal, but they are loaded with entirely different ammunition.”
Core Technical Differences at a Glance
OSCP and OSED cover almost no overlapping technical content, which is why comparing them directly requires looking at their syllabi side by side rather than treating them as variations of the same exam.
| Feature | OSCP (PEN-200) | OSED (EXP-301) |
|---|---|---|
| Primary Focus | Network pentesting, AD, web basics | Windows exploit development |
| Programming Required | Basic scripting (Python/Bash) | x86 assembly, C, Python |
| Mitigation Bypasses | Minimal | DEP, ASLR, SafeSEH, Stack Cookies |
| Exploitation Style | Use existing tools and CVEs | Write custom exploits from scratch |
| Lab Environment | Large network of mixed targets | Targeted Windows debugging sessions |
| Debugger Usage | Rarely required | WinDbg / x64dbg central to every lab |
Prerequisites: What You Need Before Each Exam
OSCP is designed as an entry-level-to-intermediate offensive security certification and requires no formal prerequisites, though OffSec recommends solid networking fundamentals and basic Linux command-line skills. OSED formally lists OSCP (or equivalent experience) as a prerequisite because candidates must already understand how exploitation works before they can learn to build exploits.
Beyond OSCP, the OSED candidate needs working knowledge of x86 assembly language and comfort reading disassembled Windows binaries. Without that foundation, the EXP-301 course material becomes inaccessible within the first few modules. Below is a checklist to assess readiness for each path:
- Understand TCP/IP networking and common protocols (both).
- Comfortable with Linux command line and basic scripting (both).
- Completed OSCP or equivalent hands-on pentest experience (OSED only).
- Read and write basic x86 assembly (OSED only).
- Familiar with Windows memory structures: stack, heap, SEH chain (OSED only).
- Able to use a debugger to inspect register states and memory (OSED only).
- Practiced fuzzing and basic buffer overflow concepts beyond OSCP scope (OSED only).
OSED Certification Difficulty vs OSCP
The OSED certification is widely regarded as significantly harder than OSCP, primarily because it demands a deeper understanding of CPU architecture and Windows internals rather than breadth of exploitation techniques. OSCP challenges candidates to think laterally across many systems; OSED challenges them to think vertically inside a single binary.
Community pass rate data for OSED is not officially published by OffSec, but forum discussions and blog post analyses consistently place it among the most technically demanding of the OSCE3 trilogy, alongside OSWE and OSEP. Candidates who underestimate the assembly requirements routinely report needing a second or third attempt.
“Failing OSED on the first attempt is common even for experienced pentesters. The difficulty is not in finding the vulnerability; it is in crafting a reliable, position-independent shellcode that survives every modern Windows mitigation.”
Exam Format and Scoring Compared
Both exams are proctored, 48-hour practical assessments with an additional 24 hours for report submission, but their scoring structures reflect their different objectives.
| Aspect | OSCP | OSED |
|---|---|---|
| Exam Duration | 23 hours 45 minutes | 47 hours 45 minutes |
| Report Window | 24 hours after exam ends | 24 hours after exam ends |
| Passing Score | 70 / 100 points | OffSec holistic review (not point-based) |
| Bonus Points | Up to 10 pts for lab exercises | No announced bonus system |
| Number of Targets | Multiple machines (network) | 3 standalone exploit challenges |
| Report Focus | Steps to reproduce, remediation | Full exploit walkthrough with annotated code |
The OSED exam report is especially demanding. Candidates must document every step of the exploit development process, including failed attempts, debugger screenshots, and the reasoning behind each technique chosen. A technically correct exploit with a poor report can still result in a failing grade.
Career Impact and Job Market Value
OSCP remains the most recognized entry credential for penetration testing roles and is explicitly listed in job postings for junior to mid-level pentesters worldwide. OSED, by contrast, targets a narrower but higher-paying niche: exploit development, vulnerability research, and offensive tooling engineering roles.
Holding the full OSCE3 trilogy (OSEP + OSWE + OSED) signals elite offensive security capability and is highly sought after in roles at red team vendors, government contractors, and vulnerability research firms. OSED alone, without OSCP, is an unusual career path and not recommended. OSCP alone is sufficient to enter the industry; OSED is the accelerator for those targeting senior or specialized roles.
“OSCP opens the door to penetration testing. OSED signals that you build the tools other pentesters depend on, which is why the roles it unlocks come with a different compensation bracket entirely.”
Which Certification Should You Pursue Next?
The right choice between OSCP and OSED depends entirely on where you currently stand in your offensive security career and what role you are targeting. Use the comparison below as a decision framework.
| Your Situation | Recommended Next Step |
|---|---|
| No prior offensive security certification | Start with OSCP |
| Hold OSCP, want broader AD/red team skills | Consider OSEP or CRTO first |
| Hold OSCP, targeting exploit dev / vuln research | Pursue OSED next |
| Targeting OSCE3 in full | OSEP + OSWE + OSED (any order after OSCP) |
| Comfortable with x86 assembly already | OSED can be tackled earlier in your OSCE3 path |
If you want structured support for either path, explore the OSED exam resources and support services or the OSCP preparation service list available on this platform. Both include walkthrough reports, exam dumps, and mentoring options designed specifically for candidates who need more than a course syllabus to cross the finish line.
Frequently Asked Questions
Do I need OSCP before attempting OSED?
OffSec officially recommends OSCP or equivalent practical experience as a prerequisite for OSED. The EXP-301 course assumes you already understand exploitation fundamentals, so attempting OSED without OSCP is possible but significantly increases the risk of failure.
How long does it take to prepare for OSED certification?
Most candidates report spending 3 to 6 months preparing for OSED after completing OSCP, depending on their prior familiarity with x86 assembly and Windows internals. The EXP-301 course material itself is dense, and consistent daily lab practice is essential.
Is OSED worth it compared to OSCP for career growth?
OSED is worth pursuing if your target roles involve exploit development, vulnerability research, or building offensive tooling. For general penetration testing positions, OSCP combined with OSEP or CRTO is a more practical career investment than OSED alone.
Can I use exam dumps or walkthrough reports to prepare for OSED?
Walkthrough reports and exam dumps help candidates understand the expected depth of documentation, the structure of exploit write-ups, and the types of challenges that appear on the exam. They are most effective when combined with hands-on lab practice, not as a replacement for it.