eCPPT Certification Guide: Exam, Prerequisites and Career Value

Penetration testers moving beyond entry level need to show they can take an engagement from reconnaissance through to Active Directory compromise, and much older advice about the eCPPT describes an exam that no longer exists. The eLearnSecurity Certified Professional Penetration Tester (eCPPT) from INE Security was rebuilt alongside INE's Penetration Testing Professional (NEW-2024) learning path, and the current exam is an auto-graded practical in which Active Directory carries the largest weight. This guide sets out what INE publishes about the current eCPPT: who it is for, its six weighted domains, vouchers and retakes, three-year validity and renewal, and how it compares with other professional penetration testing certifications. It is written for junior testers planning their next step and for managers who fund them. It covers the syllabus at topic level only, not techniques. Facts are as checked on INE's pages on 26 October 2026; prices and exam details change, so confirm with INE before you buy.

Key takeaways

• Aimed at practitioners with experience. INE designs the eCPPT for professionals with two or more years of experience in offensive security, although there is no formal gate.
• Active Directory dominates. Active Directory Penetration Testing carries 30% and Exploitation and Post-Exploitation 25%, so more than half the marks sit in those two domains.
• Practical and auto-graded. The exam is hands-on, results typically arrive within a few hours, and the score report breaks performance down by section.
• Vouchers include a retake. Vouchers expire 180 days after purchase; the included free retake must be completed within 14 days and before the voucher expires.
• Valid for three years. Renewal is through 36 CPE credits, an advanced certification in the same path such as eWPTX, or passing the latest exam, with a US$99 plus tax fee for the first two routes.

Who the certification is for

The eCPPT sits in the middle of INE's Traditional Penetration Tester path, between the entry-level eJPT and the advanced eWPTX. It tests whether a candidate can carry an internal-style assessment across several hosts and into a Windows domain.

• Good fit: junior penetration testers with one to three years of work or serious lab practice, eJPT holders ready for the next step, and internal red team members who want a structured credential. See the Penetration Tester Career Guide and the Red Teamer Career Guide.
• Good fit for identity and defensive teams: the Active Directory domain shows how a single compromised user, a service account with a weak password or excessive delegation becomes domain-wide access. IAM and PAM engineers who understand that path design better controls. See the Practical Red Team Certifications Guide for adjacent options.
• Weaker fit: complete beginners, who should start with the eJPT Certification Guide or foundations first.

Ethics and legal limits: the skills tested are lawful only in the exam lab, on systems you own, or within a written, scoped authorisation from the system owner. Unauthorised access is a criminal offence in most jurisdictions, for example under the UK Computer Misuse Act 1990. Professional testers also follow rules of engagement covering scope, timing, data handling and stop conditions: see the Red Team Rules of Engagement Template and Penetration Test Scoping Checklist.

A note on versions: INE's current page does not print a version number, but the recommended training is labelled NEW-2024, and community material often calls the current exam eCPPTv3. Reviews, course notes and practice material written for eCPPTv2 describe a different exam with different expectations, so check the date of anything you study from. When an employer asks for "the eCPPT", it is worth confirming whether they mean a specific version and whether an older certificate is still in date under INE's three-year validity rules.

Exam format and domains

What INE publishes about the exam

INE's certification page did not state the exam duration, number of questions or pass mark when checked, and the INE pages that might have done so could not be read for this guide. This page therefore does not state them. Read the exam instructions in your INE account before booking time off.

Domains and weightings

Weights are INE's. The scope column is our topic-level summary of each domain name; INE does not publish sub-objectives on the certification page. For the defensive view of the AD domain, see the Penetration Testing Guide.

Planning by weight

• 55% in two domains: Active Directory plus Exploitation and Post-Exploitation decide most results. A candidate who is strong on web but weak on Windows domains will struggle.
• Exploit development is small: at 5% it is worth understanding, but not worth weeks of study at the expense of AD.
• Reconnaissance underpins everything: it carries 10% directly, but poor enumeration costs marks in every other domain.

Prerequisites and experience

INE sets no formal prerequisite, but states the exam is designed for professionals with two or more years of experience in offensive security. You need an INE subscription and an exam voucher.

INE's certification page lists purchase options without prices. Check ine.com at the time of purchase; prices and bundles change.

Skills to have before you start: comfort with the eJPT domains (networking, Linux and Windows command line, enumeration, basic web testing), plus Active Directory concepts such as users, groups, Group Policy, Kerberos and NTLM authentication, and reading and adapting short scripts.

Preparation plan

1. Weeks 1 to 2, baseline and logistics: read the current eCPPT page and exam instructions, note the 180-day voucher expiry, and self-assess against the six domains.
2. Weeks 3 to 8, foundations of the path: work through reconnaissance, initial access and web application modules of the Penetration Testing Professional (NEW-2024) path, keeping checklists in your own words.
3. Weeks 7 to 14, Windows, Linux and Active Directory: spend the largest block on post-exploitation and AD, reflecting their 55% combined weight. Build or use a legal AD lab so you understand how domain permissions and service accounts connect.
4. Weeks 12 to 15, exploit development basics: cover the introductory material proportionately; do not let it crowd out AD.
5. Weeks 14 to 16, full rehearsals: run end-to-end assessments in INE labs or other authorised platforms, timing yourself and recording evidence for each finding.
6. Exam and retake: plan the attempt around the allotted time shown in your dashboard. If you fail, use the section breakdown to target weak domains and take the free retake within 14 days.

Cost, renewal and continuing education

• Timing: renewal opens 18 months before expiry; each renewal adds three years to the current expiry date.
• Lower certifications: holding the eCPPT keeps your eJPT eligible for renewal, but each certification still needs its own fee.
• Credits: only content completed after December 2024 counts, earned while the certification is active or in its grace period.
• Legacy holders: INE's renewal page does not explain how older eLearnSecurity-era eCPPT certificates are treated; ask INE support.

Where it fits on the career path

• Versus OSCP: the OSCP+ is proctored and needs a report; the current eCPPT is auto-graded. Employers and procurement frameworks often name the OSCP explicitly, so check job adverts in your market. See the OSCP Certification Guide.
• Versus HTB CPTS: both weight internal and AD testing heavily; CPTS emphasises reporting. See the HTB CPTS Certification Guide.
• After the eCPPT: INE's path continues to eWPTX for web specialists; others move to exploit development or red team certifications such as those in the OSED Certification Guide.
• Career value: the credential is strongest with evidence of real work: authorised engagement experience, sanitised reports and contributions to remediation. INE does not publish pass rates or salary data on the pages read, and this guide makes no claims about either.

Practitioner checklist

• Confirm the current exam duration, question count and pass rules in your INE dashboard before booking time.
• Check you meet INE's guide of two or more years in offensive security, or plan extra lab time.
• Allocate study time by weight, with most effort on Active Directory and post-exploitation.
• Build or use an authorised AD lab and learn how service accounts and delegation create attack paths.
• Practise only within written scope and rules of engagement; never test systems you do not own or have permission to test.
• Record the 180-day voucher expiry and keep the 14-day retake window free.
• Track CPE credits from day one and set a renewal reminder 18 months before expiry.
• Read the Cybersecurity Certifications Guide to check the eCPPT fits your target role.

Standards and references

• INE Security: eCPPT Certification
• INE Security: Certification Renewal
• INE Security: eJPT Certification
• INE Security: Updated eJPT Certification announcement
• OWASP: Top 10 Web Application Security Risks
• UK legislation: Computer Misuse Act 1990

Related NHI Mgmt Group resources: eJPT Certification Guide · Penetration Tester Career Guide · OSCP Certification Guide · Cybersecurity Learning Roadmap Guide