Newcomers to penetration testing need a first credential that proves they can do practical work, not just recall definitions, and the eJPT from INE Security is one of the most common answers. The eLearnSecurity Junior Penetration Tester (eJPT) is an entry-level, hands-on exam taken in a browser-based lab over 48 hours. This guide explains what INE publishes about the exam, its four domains and weightings, the March 2026 revision, vouchers and retakes, the three-year validity and renewal, and where the eJPT sits on a penetration testing career path. It is written for students, career changers, junior analysts and the managers who fund their training. It describes the certification at topic level only, not attack techniques. Facts are as checked on INE's own pages on 26 October 2026; INE changes bundles, prices and exam details, so confirm with INE before you buy.
Key takeaways
- It is a practical exam for beginners. INE positions the eJPT for people with little to no cybersecurity experience and a basic understanding of networks and systems, with no formal prerequisites.
- The format was revised in March 2026. INE announced on 26 March 2026 that the exam grew from 35 to 45 questions while keeping the 48-hour hands-on practical format.
- Four weighted domains. Host and Network Penetration Testing (35%), Assessment Methodologies (25%), Host and Network Auditing (25%) and Web Application Penetration Testing (15%).
- Every voucher includes a retake. Vouchers expire 180 days after purchase and include one free retake, which must be completed within 14 days of a failed attempt and before the voucher expires.
- It now expires. The eJPT is valid for three years; INE renews it through 36 CPE credits, a higher certification in the same path such as the eCPPT, or passing the latest exam version.
Who the certification is for
The eJPT tests whether a candidate can follow a methodical assessment of a small network: find hosts and services, identify weaknesses, gain limited access and answer questions about what they found. It is a junior credential and says so in its name.
- Good fit: students and career changers aiming at junior penetration tester, vulnerability analyst or SOC roles who want a practical first exam. See the Penetration Tester Career Guide for the wider route into offensive work.
- Good fit for defenders: SOC analysts, system administrators and IAM engineers who want to see how exposed services, weak passwords and over-privileged accounts look from the attacker's side. Much of the auditing domain is about the same weaknesses defenders fix every day, including default credentials and poorly protected service accounts.
- Weaker fit: experienced testers, who will gain more from the eCPPT Certification Guide, the OSCP Certification Guide or the HTB CPTS Certification Guide.
- Employers: the eJPT is a useful screening signal for graduate and apprentice hiring because it shows the candidate has spent time in a lab, but it is not evidence that someone can run a client engagement unsupervised.
Ethics and legal limits: everything the eJPT teaches is lawful only inside the exam lab, your own systems or an engagement with written authorisation and agreed scope. Testing systems you do not own or have permission to test can be a criminal offence, for example under the UK Computer Misuse Act 1990. Learn the scoping and authorisation side alongside the technical side: see the Penetration Test Scoping Checklist.
Exam format and domains
What INE publishes about the exam
| Item | What INE states | INE source |
|---|---|---|
| Format | Hands-on practical exam simulating real-world scenarios, browser-based lab | eJPT certification page; eJPTv2 announcement |
| Duration | 48 hours (unchanged in the March 2026 revision) | March 2026 newsroom release |
| Questions | 45 since the March 2026 revision (previously 35 in eJPTv2, 20 in eJPTv1) | March 2026 newsroom release; eJPTv2 announcement |
| Environment | A small-business style network with modern operating systems; dynamic and static flags so each candidate's exam differs | eJPTv2 announcement |
| Passing | For eJPTv2, INE stated a 70% overall minimum plus individual domain minimums; the current certification page does not restate the pass mark | eJPTv2 announcement |
| Grading | Auto-graded, with a score report broken down by section | eJPT certification page |
| Validity | Three years from the award date | eJPT certification page |
The pass rule above was published for eJPTv2 in 2023 and INE has not, on the pages read for this guide, said whether the March 2026 revision changed it. Check the exam instructions in your INE dashboard before you start.
Domains and weightings
| Domain | Weight | Topic-level scope |
|---|---|---|
| Host and Network Penetration Testing | 35% | Gaining and using access on Windows and Linux hosts in an authorised lab, password and credential weaknesses, basic post-access enumeration and pivoting concepts |
| Assessment Methodologies | 25% | Information gathering, passive and active reconnaissance, target scoping, host discovery, port and service enumeration, vulnerability assessment |
| Host and Network Auditing | 25% | Reviewing systems and networks for misconfigurations, exposed services and weak credentials, and recording evidence |
| Web Application Penetration Testing | 15% | HTTP and web application fundamentals, web server and content discovery, CMS security testing including WordPress |
Weights are INE's. The scope column is our summary, based on the domain names and the topics INE named in its March 2026 announcement; INE does not publish sub-objectives on the certification page.
What changed in March 2026
- More questions: 45 instead of 35, with the exam revised to align more closely with the training.
- Reconnaissance: new material on target scoping and passive versus active reconnaissance, with 12 new assessment questions in the learning path.
- Web application testing: five new videos, three new labs and 21 new assessment questions covering web server scanning, file and directory discovery, and CMS and WordPress security testing.
- AI: a new course, Offensive AI: Generative AI for Pentesters, covering machine learning fundamentals, large language models, prompt engineering and responsible AI use. For the defensive side, see the AI Red Teaming Guide.
Prerequisites and experience
INE sets no formal prerequisites, application or experience requirement. What you do need, according to the certification page, is an INE subscription and an exam voucher.
| Route | What INE describes | Best for |
|---|---|---|
| eJPT + Prep bundle | Three months of novice-level training with an eJPT voucher included | Candidates who can study intensively in a fixed window |
| Fundamentals Annual | One year of novice-level training with an eJPT voucher included | Beginners who need time to build foundations first |
| Premium subscription plus voucher | Access to INE's wider catalogue, which INE describes as 3,500+ hours from novice to expert | Candidates planning the eCPPT or other INE certifications next |
| Voucher only | Exam attempt plus included retake; still requires an INE subscription | Candidates who have prepared elsewhere |
INE's certification page does not show prices. Check current pricing, regional offers and employer licences on ine.com, and expect them to change.
Knowledge you should already have: for eJPTv2 INE listed networking, Linux and Windows fundamentals. In practice that means TCP/IP, common ports and services, the Linux and Windows command line, and basic web concepts such as HTTP requests and responses. A foundation course such as the CompTIA Network+ Certification Guide or CompTIA Linux+ Certification Guide covers this ground, though neither is required.
Preparation plan
- Weeks 1 to 2, check foundations and logistics: confirm you are comfortable with networking and the Linux and Windows command line. Choose a purchase route, note your voucher's 180-day expiry, and read the exam instructions in the INE dashboard.
- Weeks 3 to 8, work through the INE learning path: complete the courses and labs in order, keeping notes as your own checklists for each domain. Give Host and Network Penetration Testing the most time, as it carries 35% of the marks.
- Weeks 6 to 10, practise methodology end to end: run full assessments in INE labs or other legal practice platforms: scope, discover, enumerate, assess, gain access, record evidence. The exam asks questions about what you found, so accurate notes matter as much as access.
- Weeks 9 to 11, close the gaps: revisit the web application material and the March 2026 additions on reconnaissance and CMS testing, because domain minimums mean a weak domain can fail an otherwise good attempt.
- Exam window: plan the 48 hours with sleep and breaks. Map the environment first, answer questions as evidence comes in, and keep a record of which host and service each answer came from.
- If you fail: use the section breakdown in the score report to target the weak domain, then take the free retake within 14 days and before the voucher expires.
Cost, renewal and continuing education
INE does not publish eJPT prices on the certification page, so budget from ine.com at the time of purchase. Renewal is a published, separate process.
| Renewal option | What INE requires | Fee |
|---|---|---|
| CPE credits | 36 CPE credits from training; INE courses earn 1 credit per 45 minutes, with caps per category; non-INE training capped at 18 credits per category | US$99 plus tax for three years |
| Advanced certification | Earn a more advanced certification in the same career path; for the Traditional Penetration Tester path that means eCPPT or eWPTX | US$99 plus tax for three years |
| Latest exam | Pass the latest version of the eJPT exam | No renewal fee |
| Late renewal | Within the 90-day grace period after expiry | US$199 plus tax |
- Timing: renewal opens 18 months before expiry and each renewal adds three years to the current expiry date. After the 90-day grace period you must recertify.
- Credits: only content completed after the renewal programme launched in December 2024 counts, and credits must be earned while the certification is active or in grace.
- Paths: holding a more advanced certification keeps lower ones in the same path eligible for renewal, but each certification still needs its own renewal fee.
- Older versions: INE stated that eJPTv1 credentials remain valid after eJPTv2 launched. If you hold an older eLearnSecurity-era certificate, ask INE support how renewal applies to it.
Where it fits on the career path
| Stage | Typical credential | What it signals |
|---|---|---|
| Foundations | CompTIA Network+, Linux+ or Security+ | Networking, systems and security concepts |
| Entry practical | eJPT | Can follow an assessment methodology in a lab and record findings |
| Professional practical | eCPPT, OSCP, HTB CPTS | Can carry out a full test including Active Directory and post-exploitation |
| Specialist | Web, exploit development or red team certifications | Depth in one discipline |
- Versus CompTIA PenTest+: PenTest+ is mainly knowledge-based with performance items and stronger on planning, scoping and reporting; the eJPT is fully practical. Many candidates do one then the other. See the CompTIA PenTest+ Guide.
- Versus CEH: CEH appears more often in some government and procurement requirements; the eJPT is fully hands-on at entry level. Check which one your target employers name. See the CEH Certification Guide.
- Next step: INE names the eCPPT as the next certification after the eJPT, and the two sit together in INE's Traditional Penetration Tester path.
- Career value: treat the eJPT as proof of effort and basic practical skill. Pair it with a portfolio of write-ups from legal labs and, where possible, supervised work on real engagements. For the wider picture see the Cybersecurity Certifications Guide and the Cybersecurity Learning Roadmap Guide.
INE does not publish pass rates or salary data for the eJPT on the pages read for this guide, and this guide makes no claims about either.
Practitioner checklist
- Read the current eJPT page and dashboard instructions; confirm question count, duration and pass rules for your attempt.
- Choose a bundle that gives enough study time, and record the voucher's 180-day expiry date.
- Close gaps in networking, Linux and Windows basics before starting the learning path.
- Weight study time to the domain weights, with most effort on Host and Network Penetration Testing.
- Practise only on systems you own, INE labs or platforms that authorise testing, and learn scoping and authorisation rules.
- Keep structured notes linking each finding to a host, service and piece of evidence.
- Plan the 48-hour window, including rest, and book time for the free retake in case it is needed.
- After passing, set a renewal reminder 18 months before expiry and track CPE credits from day one.
Standards and references
- INE Security: eJPT Certification
- INE Security: Updated eJPT Certification with Expanded Web App Testing, Recon Training and Offensive AI
- INE: eJPTv2 Certification is Here
- INE Security: Certification Renewal
- INE Security: eCPPT Certification
- UK legislation: Computer Misuse Act 1990
Related NHI Mgmt Group resources: eCPPT Certification Guide · Penetration Tester Career Guide · Cybersecurity Certifications Guide · Penetration Testing Guide