OSEE Certification Guide: Exam, Prerequisites and Career Value

The OffSec Exploitation Expert (OSEE) is OffSec's most demanding exploit development credential, and it differs from almost every other security certification because the training behind it is delivered only in person. The exam gives candidates 71 hours and 45 minutes, under proctoring, to complete two advanced Windows exploitation assignments, followed by a fully replicable report. This guide explains who OSEE is for, what OffSec publishes about the exam and the EXP-401 Advanced Windows Exploitation course, the experience it assumes, how to prepare and budget, and how it fits careers in vulnerability research and product security. It stays at topic level and contains no exploit techniques. Facts were checked on OffSec's help centre on 26 October 2026; OffSec changes course schedules, prices and exam rules, so confirm details with OffSec before committing.

Key takeaways

• Training is in person only. OffSec says EXP-401 has no online content and runs as scheduled live courses at venues, or in-house for organisations.
• The exam is close to three days. The OSEE exam guide gives 71 hours and 45 minutes for two assignments, plus 24 hours to upload the report.
• The pass mark is high. Each assignment is worth 25 points for partial and 50 for full completion, and 75 of 100 points are needed to pass.
• It is not for beginners. OffSec expects prior Windows exploit development experience and debugger proficiency, with WinDBG, x86_64 assembly, IDA Pro and basic C/C++ recommended.
• OSEE does not expire. It is not on OffSec's list of expiring certifications, and OffSec lists it as an exam that keeps an OSCP+ active.

Who the certification is for

OSEE sits at the top of OffSec's exploit development track. The people who benefit most already write exploits for a living or need to judge the most complex vulnerabilities in Windows software.

• Strong fit: experienced vulnerability researchers, exploit developers in authorised offensive teams, and senior penetration testers who already hold the OSED or equivalent experience.
• Product security and vendors: engineers who triage kernel and heap bugs reported against their products, or who design exploit mitigations, gain insight into how mitigations are tested.
• Defensive research: senior malware analysts and endpoint security researchers who reverse complex Windows threats. See the Malware Analyst Career Guide.
• Weaker fit: anyone without hands-on Windows exploit development. OffSec states plainly that the course is not suitable for beginners. Defenders early in their careers may get more from the OSDA certification.

As with all exploit development, use is lawful only with authorisation: research on your own systems or under contract, coordinated vulnerability disclosure and defence. Unauthorised use is a criminal offence in most jurisdictions, for example under the UK Computer Misuse Act 1990 and the US Computer Fraud and Abuse Act.

Exam format and domains

What OffSec publishes about the exam

The pass mark means a candidate needs full completion of one assignment and at least partial completion of the other.

Report and submission rules

• Template: the PDF must use the OSEE report template and document every step, command and console output in enough detail to replicate the work.
• Reliability: graders repeat the steps, so exploit code must work reliably. Code and proof.txt contents go in the report, with scripts included as text inside the PDF.
• Packaging: an unencrypted .7z archive named with your OSID, containing only PDF files, no larger than 300 MB compressed and 400 MB extracted. Verify the MD5 hash on upload.
• Finality: submissions are final; missing screenshots or information cannot be added later.
• Help: Discord may be searched, but seeking or receiving help from others is prohibited, and OffSec support gives no hints.

Body of knowledge

OffSec's EXP-401 FAQ does not list weighted domains. It describes the course's case studies at a high level, and links a separate syllabus document:

Read the current EXP-401 syllabus from OffSec when you register, since case studies are revised as Windows changes.

Prerequisites and experience

The OffSec pages read for this guide do not state whether the course must be completed before sitting the exam. Ask OffSec how your first exam attempt is provided when you register; retakes are requested through the support portal.

Preparation plan

This plan is our guidance, not OffSec's. EXP-401 is intensive and live, so most of the value comes from preparation before the class and practice after it.

1. Three to six months before the course: close gaps in 64-bit assembly, C/C++ reading and WinDBG kernel debugging set-up. If you have not done user-mode exploit development, do that first; the OSED path is the natural route.
2. Four weeks before: build the required laptop and virtual machines, confirm VMware and debugger connectivity, and read OffSec's venue email carefully.
3. During the course: take structured notes on each case study and capture questions for instructors; there is no online content to revisit later.
4. Weeks after the course: rebuild each case study from your notes in your own lab, and write each up in report form to OffSec's replication standard.
5. Exam planning: test the proctoring tool, plan sleep across nearly three days, and aim to fully complete one assignment early, since the pass mark requires one full and one partial completion at minimum.
6. After a failed attempt: OffSec's cooling-off periods are 4, 8 and then 12 weeks for first, second and later failures. Use the gap to rebuild the weak area.

Common failure patterns

• Arriving under-prepared: treating the live course as an introduction. OffSec assumes prior exploit development, and the pace leaves little room to learn the basics.
• Unreliable exploits: code that works once but fails when the grader repeats it.
• Incomplete reports: missing console output or screenshots, which cannot be added after submission.
• Wrong packaging: including non-PDF files or exceeding the archive limits.
• Fatigue: no rest plan across a 71 hour 45 minute exam.

Measuring readiness

• Case study rebuilds: number of course case studies reproduced independently after the class.
• Replication rate: share of your write-ups a peer can repeat without asking questions.
• Reliability: success rate of your proof-of-concept code across ten consecutive runs in a lab.
• Debugger set-up time: how long you need to build a working kernel debugging environment from scratch.

Cost, renewal and continuing education

• Course fees: the help centre pages read for this guide do not state an EXP-401 price, and the Learn subscription page does not list EXP-401 among its options. Check offsec.com/training-and-events for current dates, locations and fees; prices change.
• Total cost to budget: course fee, travel and accommodation for the live class (unless delivered in-house), study time, and possible retakes.
• Organisations: OffSec offers in-house EXP-401 delivery through its training consultants, which may suit a team of researchers.
• Expiry: OffSec's CPE handbook lists OSCP+, OSTH, OSIR, OSCC-SEC and OSCC-SJD as expiring certifications. OSEE is not among them, so it has no maintenance fee or CPE requirement of its own.
• Effect on OSCP+: OffSec lists OSEE, with OSEP, OSWA and OSED, as an exam that keeps OSCP+ status when passed before the OSCP+ expires.
• CPE for other bodies: the EXP-401 FAQ points to a separate article on CPE credits and completion letters for ISC2; check how your certifying body treats the hours.

Where it fits on the career path

Deciding whether OSEE is worth it

• Choose OSEE when: your role already involves native-code vulnerability research on Windows, your employer will fund travel and study time, and you want structured exposure to kernel and heap topics from instructors.
• Choose OSED first when: you have not yet written user-mode exploits independently. It is self-paced, cheaper to attempt and builds the experience OffSec expects for EXP-401.
• Choose OSEP or OSWE instead when: your work is network red teaming or web application testing; OSEE adds little to those roles.
• Small versus large organisations: a single researcher usually attends a public class; a vendor or research team of several people may find in-house delivery more practical.

The credential's value lies in the small community that holds it and the depth of the exam, rather than in being a common job advert requirement. Employers can map the work to recognised controls; this mapping is our aid, not an OffSec statement:

See the Vulnerability Analyst Career Guide, the Zero-Day and Exploited Vulnerabilities Guide for the defensive context, and the Cybersecurity Careers Guide for the wider field.

Practitioner checklist

• Confirm you have real Windows exploit development experience before booking EXP-401.
• Close gaps in 64-bit assembly, C/C++ and WinDBG kernel debugging first.
• Check course dates, venue, fees and in-house options with OffSec.
• Build and test the required laptop and virtual machines weeks in advance.
• Ask OffSec how your exam attempt is provided and scheduled.
• Rebuild every case study after the class and write it up to replication standard.
• Prepare the OSEE report template and packaging (PDF only, size limits) before the exam.
• Plan rest across the 71 hour 45 minute window and target one full completion early.
• Apply the skills only with written authorisation and through coordinated disclosure.

Standards and references

• OffSec: OSEE Exam Guide
• OffSec: EXP-401 FAQ
• OffSec: Exam Retake Policy
• OffSec: Recertification
• OffSec: CPE Program and Annual Membership Handbook
• OffSec: Learn Subscriptions and Course Bundles
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: OSED Certification Guide · OSEP and OSWE Certification Guide · OSCP Certification Guide · Cybersecurity Certifications Guide · Red Teamer Career Guide