Overview
The OSCP is OffSec's hands-on penetration testing certification, earned by passing a proctored exam in which candidates attack live machines over a private VPN and then write a professional report. OffSec places it at the 200 level and ties it to the PEN-200 course, although the exam can also be bought on its own. Since November 1, 2024, a pass awards both OSCP and OSCP+. The OSCP never expires. The OSCP+ lasts 3 years and is kept current through CPE credits, a recertification exam, or a higher-level OffSec exam.
OffSec names penetration testers, security analysts, and consultants as the roles it's built for. The exam covers enumeration, exploitation, privilege escalation, and Active Directory attacks, with strict limits on automated exploitation tools, vulnerability scanners, AI chatbots, and Metasploit. Reports are graded strictly. The format differs from the CREST Registered Penetration Tester (CRT), which is a shorter, auto-marked practical taken at Pearson VUE centres, and CREST runs an equivalency program that counts a recent OSCP or OSCP+, combined with a CPSA pass, toward CRT.
What the exam covers
The exam is a hands-on lab with 3 stand-alone machines and 1 Active Directory set, scored out of 100 points, followed by a written penetration test report.
| Part |
|---|
| 3 stand-alone machines, each scored on initial access and privilege escalation (60 points in total) |
| Active Directory set of 3 machines, starting from supplied credentials to simulate a breach (40 points in total) |
| Proof files (local.txt and proof.txt) read from an interactive shell and submitted in the exam control panel |
| Penetration test report documenting every step, command, and output, uploaded within 24 hours after the exam |
Requirements
No formal prerequisites. OffSec recommends a solid grasp of TCP/IP networking, reasonable Windows and Linux administration experience, and basic Bash or Python scripting.
- Format
- Hands-on practical exam in a private VPN lab, followed by a written report
- Questions
- 3 stand-alone machines and 1 Active Directory set of 3 machines
- Time
- 23 hours 45 minutes, plus 24 hours to upload the report
- Passing score
- 70 out of 100 points
- Delivery
- Online, proctored by OffSec
The exam is open book, but AI chatbots, spoofing, commercial tools, automatic exploitation tools, and mass vulnerability scanners are banned, and Metasploit may be used on only one target. No bonus points are awarded.
Cost
Exam fee: USD 1,699 for the OSCP+ standalone exam (2 attempts, no course materials). OffSec also sells a USD 1,749 Course + Cert Bundle (90 days of PEN-200 and 1 exam attempt) and Learn One at USD 2,749 per year. Prices change, so confirm on the issuer's site. Checked 2026-10-12.
Keeping it current
- Cycle
- 3 years for OSCP+ (OSCP does not expire)
- Continuing education
- 120 CPE credits per 3-year cycle, or pass the OSCP recertification exam (available from 6 months before expiry) or a qualifying OffSec exam such as OSEP, OSWA, OSWE, OSED, OSMR, OSEE, or OSAI+
- Fees
- Annual coverage through the USD 145 Annual Maintenance Fee or the USD 299 per year Annual Membership Program
How to verify that someone holds it
OffSec issues its credentials through Accredible, and certificates issued after April 5, 2022 carry a QR code that links to the holder's credential page. For older certificates, OffSec verifies on request using the holder's full name and OSID. Use the issuer’s verification page.
On InfoSecHub, a OSCP listed on a profile shows Verified by Credly only when a current Credly badge issued to that person confirms it.
Typical roles
- Penetration tester
- Security analyst
- Security consultant
- Security researcher
Related frameworks
Official resources
From OffSec. Links open the issuer’s site.
- OSCP official page, OffSec
- OSCP+ exam guide, OffSecexam-outline
- OSCP+ candidate handbook, OffSechandbook
- How do I verify someone's certification?, OffSecverification
References
- OSCP+ exam guide, OffSec
- OSCP+ standalone exam, OffSec
- OffSec CPE Program and Annual Maintenance Handbook, OffSec
- Everything you need to know about the OSCP+, OffSec
- Digital certification FAQ, OffSec
Reviewed 2026-10-12. Exam details, prices, and renewal rules change. Confirm them on the OffSec website before you register. InfoSecHub is not affiliated with OffSec.