Short answer. If you want a penetration testing job and can afford one serious exam, take the OSCP. If you want the deepest practical training for the money, take HTB CPTS. If you have never worked through a full engagement, start with PNPT or eJPT. If you already hold one of those and want red team work, go to CRTO and then OSEP. If web applications are your lane, the right first exam is OSWA or eWPT, and we compare those separately in the web security certifications guide.
Everything below explains those recommendations: how the exams actually differ, what each one proves to an employer, and which order makes sense for the four common tracks. Vendor prices are left out on purpose. They change several times a year, and the vendor page is the only reliable source.
- Which certification first: the short answer
- How the exams actually differ
- OSCP vs CPTS
- Starting from zero: eJPT, PJPT and PNPT
- The red team track: CRTO, CRTP, CRTE and OSEP
- Web application certifications
- Exploit development: OSED and OSEE
- An OffSec-only roadmap
- Other tracks in one paragraph each
- A decision checklist
- What we hold for each certification
- Frequently asked questions
Which certification first: the short answer
The wrong question is “which certification is best”. The useful question is “which exam tests the skill I am missing right now”. Match your situation to the table, then read the section for that track.
| Your situation | Take this first | Then |
|---|---|---|
| No hands-on experience yet | eJPT | PJPT or PNPT, then OSCP or CPTS |
| Some lab time on Hack The Box or TryHackMe, want a first job | PNPT or CPTS | OSCP |
| You need the credential recruiters search for by name | OSCP | CPTS or CRTO |
| Working pentester moving into red team | CRTO | OSEP, then CRTE |
| Active Directory is your weak spot | CRTP | CRTE, OSEP |
| Web applications are your specialism | OSWA or eWPT | BSCP, then OSWE |
| You want exploit development | OSED (after OSCP) | OSEE |
| Budget is the constraint | CPTS or CRTO | OSCP when an employer will fund it |
The rule behind every row: pick the exam that attacks your weakest operational skill, not the one with the most impressive logo. An advanced exam attempted too early turns into months of unproductive lab hopping.
How the exams actually differ
Every certification on this page is a hands-on exam. The differences that matter are the length of the window, whether a written report is graded, and how much of the scope is Active Directory, web, or evasion. Formats do change, so confirm the current rules on the vendor’s page before you book.
| Certification | Vendor | Exam | Report graded | Best for |
|---|---|---|---|---|
| OSCP (issued as OSCP+) | OffSec | 24-hour proctored practical | Yes | Recognition, generalist pentesting |
| HTB CPTS | Hack The Box | 10-day practical | Yes | Depth, Active Directory, engagement-style scope |
| PNPT | TCM Security | 5-day practical, then a report and a live debrief | Yes | A realistic first engagement |
| PJPT | TCM Security | Internal network to domain admin, with a report | Yes | Junior Active Directory attack path |
| eJPT | INE Security | 48-hour lab, question-driven | No | Complete beginners |
| CRTO | Zero-Point Security | 48 hours of lab time spread over four days, flag-based | No | Red team operations and C2 |
| CRTP | Altered Security | 24-hour practical | Yes | Active Directory attacks |
| CRTE | Altered Security | 48-hour practical | Yes | Multi-forest Active Directory |
| OSEP | OffSec | Roughly 48-hour practical | Yes | Evasion and post-exploitation |
| OSWE | OffSec | Roughly 48-hour practical, white-box | Yes | Web source review and exploit chains |
| OSED | OffSec | Roughly 48-hour practical | Yes | Windows user-mode exploit development |
| CPENT | EC-Council | 24-hour practical | Yes | Broad enterprise scope, IoT and OT modules |
Two consequences follow from that table. First, a 24-hour exam rewards speed and a rehearsed methodology, while a 5- or 10-day exam rewards thoroughness and stamina, so the same candidate can find OSCP harder than CPTS or the reverse. Second, where a report is graded, the report is part of the exam. Candidates lose passes with a working attack path and a thin write-up. Our pentest report guide covers the structure examiners expect.
OSCP vs CPTS
These are the two certifications most candidates end up choosing between, and they answer different questions.
OSCP is the credential hiring managers recognise by name. It appears in job descriptions as a requirement, not a nice-to-have, and that alone is worth a great deal early in a career. The exam is a single 24-hour proctored window with a set of standalone machines and an Active Directory set, followed by a report. What it tests is a disciplined, repeatable methodology under time pressure: enumerate, find the foothold, escalate, prove it, and document it while the chain is still fresh.
HTB CPTS is the more demanding technical assessment. The 10-day window is not generosity; it reflects the scope, which is closer to a real internal engagement than to a set of lab boxes. Active Directory is central, pivoting and web exploitation are in scope, and the report carries real weight in the grade. Candidates who hold both usually describe CPTS as the harder exam and OSCP as the more valuable line on a CV.
If you can only sit one this year and your goal is employment, take OSCP. If your goal is to become a better tester and your employer is not paying, CPTS gives you more per dollar. Ambitious candidates do both, OSCP first.
Both certifications are covered on this site: the OSCP page has the standalone machine and AD set walkthroughs, and the CPTS page has the full walkthrough and the finished report.
Starting from zero: eJPT, PJPT and PNPT
eJPT is the honest first step for someone with a networking or sysadmin background and no offensive experience. The exam is lab-based and question-driven, there is no report, and the difficulty is deliberately approachable. It teaches you what an assessment looks like without the pressure of a proctored clock.
PJPT is TCM Security’s junior exam, and it is a single job: get into an internal network, work your way to domain administrator, and write it up. It is the smallest exam that makes you produce a real report, which is exactly why it is a good bridge to PNPT and OSCP.
PNPT is the most realistic entry-level option on the market. You get an external and internal engagement, five days to work it, time to write the report, and then a live debrief where you present your findings. Nothing prepares you better for how OffSec grades a report than having to defend one out loud. If you intend to sit OSCP within a year, PNPT first is the recommended route.
Material for all three is here: eJPT, PJPT and PNPT.
The red team track: CRTO, CRTP, CRTE and OSEP
Red team certifications test tradecraft rather than raw exploitation: command and control, evasion, lateral movement inside monitored networks, and Active Directory abuse at scale. None of them replaces a generalist certification. They are the second step, taken after OSCP, CPTS or PNPT has proven you can get a foothold and escalate.
CRTO (Zero-Point Security) is the standard first red team exam. The course is built around Cobalt Strike, and the exam gives you 48 hours of lab time across four days to capture flags in a monitored environment. There is no report to write, which makes it a clean test of operational skill, and it is one of the best-value advanced exams available. Its successor, CRTL, covers the lead-operator skills that come after it.
CRTP (Altered Security) is the exam to take when Active Directory is your gap. It is a 24-hour practical followed by a graded report, fully hands-on with no theory questions, and you are marked on how clearly you explain each step as well as on what you exploit. CRTE extends the same idea across a multi-forest environment in a 48-hour window. Together they are the fastest way to become fluent in the AD attack paths every other exam on this page assumes you know.
OSEP (OffSec) is where the track gets hard. The exam is roughly 48 hours and expects you to bypass defences, move laterally, and chain post-exploitation in an environment that fights back, then report all of it. Take it after CRTO, not instead of it: CRTO teaches the operator workflow, OSEP tests whether you can execute it under OffSec’s grading.
On whether you need OSCP for a red team role: most teams will accept CRTO plus demonstrable experience, but OSCP is still the credential that gets a CV past the first filter. If you have neither, take OSCP first.
Our red team material: CRTO, CRTP, CRTE and OSEP.
Web application certifications
Web testing has its own ladder, and it is a mistake to climb it by taking OSWE first. The usual order is a foundation exam (OSWA from OffSec, or eWPT from INE) to build a repeatable black-box methodology, then BSCP if Burp Suite is central to your work, then OSWE or CWEE when you are ready for source review and custom exploit chains. If web is only part of your job, CPTS and PNPT both include enough web exploitation to cover you.
We compare all six web certifications, exam by exam, in the web security certifications guide.
Exploit development: OSED and OSEE
OSED is OffSec’s Windows user-mode exploit development certification: reverse engineering, writing shellcode, and bypassing mitigations such as DEP and ASLR, in a roughly 48-hour exam with a report. It is a narrow, difficult specialism, and it is only worth pursuing after OSCP has confirmed you enjoy the low-level work. OSEE, the kernel-level expert exam, sits above it and is genuinely rare.
Holding OSEP, OSWE and OSED together earns OffSec’s OSCE³ designation, which is the practical definition of a senior offensive generalist in that ecosystem. Material: OSED and OSEE.
An OffSec-only roadmap
If you have decided to stay inside one vendor, the OffSec ladder is well defined and worth laying out on its own.
- OSCP first, for everyone. It is the anchor the rest of the catalogue assumes.
- OSWA or OSWP as optional side steps. OSWA is the entry web exam; OSWP is a short wireless exam that is useful if your work includes Wi-Fi assessments and irrelevant otherwise.
- One of the three 300-level exams, chosen by track: OSEP for red team and evasion, OSWE for web source review, OSED for exploit development.
- The remaining two 300-level exams if you want OSCE³, then OSEE if you want the summit.
The mistake candidates make with this roadmap is treating it as a checklist to complete rather than a set of options to choose from. Two 300-level exams in different tracks prove more than three in a row taken without a reason. The OffSec certification hub lists what we hold for every exam on the ladder.
Other tracks in one paragraph each
Blue team. HTB CDSA and OffSec’s OSDA are the practical defensive equivalents of CPTS and OSCP: log analysis, detection and incident write-ups rather than exploitation. Take CDSA if you want the more affordable, longer-window exam, OSDA if you want the OffSec name.
Wireless. OSWP is the only widely recognised practical wireless exam. It is short and focused on WPA attacks and rogue access points, and it is a sensible add-on for consultants who are asked to test Wi-Fi.
Enterprise and broad-scope. EC-Council’s CPENT covers a wide enterprise scope in a 24-hour practical with a graded report, and its CEH remains the certification HR departments ask for, although its core exam is multiple choice and so does not prove hands-on skill the way the rest of this page does.
A decision checklist
Work through these before you register for anything.
- Measure your level honestly. If you cannot root a handful of easy-to-medium Hack The Box machines without a walkthrough, start with eJPT or PNPT, not OSCP.
- Name the role. Generalist pentester: OSCP or CPTS. Red team operator: CRTO, then OSEP. Web specialist: OSWA, then OSWE. Exploit developer: OSED.
- Read ten job postings in the market you actually want to work in and count which certifications appear. Prioritise those over any list on the internet, including this one.
- Match the exam format to your temperament. If you go to pieces on a clock, a 10-day exam like CPTS will show your real ability better than a 24-hour one.
- Budget for the report. Where a report is graded, plan the template and evidence workflow before the exam, not during it.
- Prepare with material for that specific exam. Generic courses do not reflect the grading mindset of a particular vendor. Walkthroughs of the actual exam targets and a finished report in the expected format do.
The best certification is the one you will finish. Choose by the skill gap you have today, book the date, and work backwards from it.
What we hold for each certification
For most of the certifications above we sell the full walkthrough of the exam targets, a ready-to-submit report in the format that vendor expects, and, for candidates who want to sit the exam themselves, remote support during the exam window. Delivery is by email within about thirty seconds of payment, there is no account to create, and every purchase includes free support afterwards if you get stuck adapting the material.
- OffSec: OSCP, OSEP, OSWE, OSWA, OSED, OSWP, OSDA
- Hack The Box: CPTS, CWEE, CWES, CDSA
- TCM Security: PNPT, PJPT
- Zero-Point Security: CRTO, CRTL
- Altered Security: CRTP, CRTE, CRTM
- INE Security: eJPT, eCPPT, eWPT
- EC-Council: CPENT
- PortSwigger: BSCP
The full list, with prices, is on the certifications index. If you want to see what you are buying first, the proofs page shows real orders and the reviews those buyers left.
Frequently asked questions
Which penetration testing certification is best for beginners?
PNPT, because it makes you run a realistic engagement and write a report, both of which transfer directly to OSCP. If you have no hands-on experience at all, eJPT first is a gentler start and there is no shame in it.
Is OSCP still worth it in 2026?
Yes, for the reason it has always been worth it: it is the certification employers name. CPTS is the better technical exam and the better value, but it does not yet open as many doors. If your goal is employment, OSCP; if your goal is skill on a budget, CPTS.
Is CPTS harder than OSCP?
Most candidates who hold both say yes. CPTS has a wider scope, leans heavily on Active Directory and reporting, and the 10-day window reflects that. OSCP is harder in a different way: the 24-hour clock punishes an unrehearsed methodology.
Do I need OSCP for a red team job?
Not strictly. CRTO plus experience will get you interviews with red teams that understand the field. OSCP is still the credential that gets a CV past a recruiter’s first filter, so if you hold nothing yet, take it first.
Should I take CRTO before OSEP?
Yes. CRTO teaches the operator workflow, C2 and evasion basics in a lab where there is no report to write. OSEP then tests that workflow under OffSec’s grading, report included. Doing them in the other order makes OSEP much harder than it needs to be.
How long does preparation take?
It depends entirely on where you start. Candidates with steady lab practice typically plan months, not weeks, for OSCP or CPTS, and a shorter focused block for CRTO, CRTP or PNPT. What shortens every timeline is preparing against the actual exam scope: walkthroughs of the real targets, and a report template in the format the vendor grades.