OffSec CyberCore (OSCC): Exam, Costs and Study Plan

Most entry-level security certifications are multiple-choice tests of vocabulary, so a hiring manager learns little about whether a new starter can actually work in a terminal, a SIEM or a code review. OffSec CyberCore is OffSec's 100-level answer: a hands-on, six-hour proctored exam that asks a beginner to attack, defend and build. This guide explains what the credential is today (it launched as "OSCC" in June 2024 and now appears as OSCC-SEC, alongside a secure Java variant, OSCC-SJD), how the exam is structured and scored, what it costs, how renewal works and where it sits next to other entry routes. It is written for graduates, career changers from IT support, and managers planning team development. Facts come from offsec.com and OffSec's help centre, checked 8 November 2026; check current fees and rules on those pages before you buy, because OffSec changes its catalogue often.

Key takeaways

It is a practical exam for beginners. The OSCC-SEC exam is six hours, proctored, with three roughly two-hour sections: Attack, Defend and Build.
Scoring is points based with no report. Each section is worth 30 points (90 in total), you need 60 to pass, and results appear as soon as you submit.
There are now two CyberCore credentials. OSCC-SEC follows the broad SEC-100 Cybersecurity Essentials course; OSCC-SJD follows SJD-100 Secure Java Development Essentials and is aimed at developers.
The bundle is the purchase unit. OffSec lists CyberCore from $899, covering one year of access to one 100-level course, its labs and two exam attempts, with auto-renewal unless cancelled.
It expires after three years. Renew with a qualifying OffSec exam, a recertification exam in the six months before expiry, or OffSec's CPE programme.

Who the certification is for

OffSec describes SEC-100 as suited to "individuals new to cybersecurity", recent graduates and IT professionals moving into security, people who are familiar with computing but not yet experts. At launch OffSec also named career changers such as helpdesk staff, managers upskilling teams and recruiters looking for evidence of practical skill. The course FAQ lists target roles including SOC Analyst (Tier 1), junior incident responder, entry-level threat hunter, beginner network penetration tester, junior web application tester, entry-level cloud security engineer, support DevSecOps engineer and IT generalists with security duties.

Candidate	Fit	Why
Graduate with a computing degree, no security job yet	Strong	Turns theory into lab evidence across offence, defence and secure build in one credential
Helpdesk or system administrator moving into security	Strong	Builds on existing OS and network familiarity; the Defend section mirrors SOC work
Java developer wanting security skills	Choose OSCC-SJD	The SJD exam asks you to fix five vulnerabilities in code without breaking functionality
Manager building a junior pipeline	Useful as a team benchmark	Common baseline across SOC, testing and cloud hires; team pricing is via OffSec sales
Experienced penetration tester	Weak	Too basic; see the OSCP Certification Guide or the Practical Red Team Certifications Guide
Someone who wants a pure knowledge credential for HR filters	Mixed	Many job adverts still name multiple-choice certifications; see the CompTIA Security+ Guide

Exam format and domains

The OSCC-SEC Exam Guide on OffSec's help centre sets out three scenarios, each designed to take about two hours, though you may split the six hours as you like and take breaks.

Section	What you do	Points
Attack	Exploit an external vector to gain a foothold on the first of two lab machines, then escalate privileges on the second	30 (15 per machine, awarded for each proof.txt)
Defend	Use a Vulnerable Machine, an Event Manager (SIEM) and a Grader Machine to analyse logs from an attack and mitigate the vulnerability behind it	30 (15 per defence)
Build	Answer secure coding and cloud architecture challenges, for example choosing the best fix for vulnerable code	30 (six questions, 5 points each)
Total	Pass mark 60 of 90; no bonus points	90

Rules that matter on the day:

Proctoring: every attempt is proctored by an OffSec employee; you log in 15 minutes early, verify identity and keep the proctoring tool open throughout. All work happens on the monitored host.
Open book, no AI: notes, course material and online resources are allowed; LLMs and AI chatbots with direct prompt access are prohibited and treated as an Academic Policy violation. Built-in AI features in tools such as search overviews do not need to be disabled.
No outside help: you may search Discord but not ask for or receive help, and you may not download files or source code from the exam environment.
Environment: targets are reached through Kali in the browser or the exam VPN; report connectivity problems in the proctoring chat immediately.
Submission: use Submit Exam in the Next Steps section; answers cannot be edited afterwards, and results are immediate and final. There is no professional report, unlike OSCP and most higher OffSec exams.

Course domains behind the exam

SEC-100 is listed at 138 hours of content in 40 modules grouped into five sections: basic cyber security information, general skills, offensive skills, defensive skills and build skills. OffSec's launch post names networking basics and scripting, application and operating system security, secure software and web development, cloud security, cyber risk management, the NIST Cybersecurity Framework, AI in cyber security and job interview preparation. The course page adds the CIA triad, ISO 27001, cloud risks and CV writing.

The OSCC-SJD variant

SJD-100 Secure Java Development Essentials is a 41-hour, ten-module course on input validation, output encoding against XSS, cookie and session handling, logging and error handling, misconfiguration and secure database access. Its six-hour proctored exam asks you to identify and fix five vulnerabilities, about an hour each, without breaking core functionality. Pair it with the Oracle Java Secure Coding Guidelines Guide.

Prerequisites and experience

OSCC-SEC: no formal prerequisites. OffSec recommends basic computer literacy, familiarity with operating systems and a willingness to learn.
OSCC-SJD: basic HTML, JavaScript, CSS and SQL, knowledge of HTTP, web services and web application architecture, and working Java. No advanced security knowledge is expected.
Practical reality: the Attack section needs you to enumerate, exploit and escalate on Linux or Windows hosts, and the Defend section needs log reading in a SIEM. If you have never used a command line, budget time for the general skills modules before touching the offensive ones.

Preparation plan

The one-year access window is generous for a 138-hour course, but most candidates lose time by working through modules in order without lab practice. A 12 to 16 week plan for someone studying 8 to 10 hours a week:

Weeks 1 to 2, baseline: take the course's self-assessment, then work the basic and general skills sections (networking, Linux and Windows command line, scripting). Schedule a provisional exam date now so the plan has an end.
Weeks 3 to 6, offensive skills: do every lab, keep a personal methodology note for enumeration, initial access and privilege escalation, and practise until you can explain why each step works.
Weeks 7 to 9, defensive skills: practise reading authentication, web and process logs; for each attack lab, write down the log evidence it would leave and how you would close the hole. This is exactly the Defend section's shape.
Weeks 10 to 11, build skills: secure coding and cloud architecture modules; practise choosing between candidate fixes and saying why the others fail.
Week 12, rehearsal: a timed six-hour run across the three areas, with two hours per section and a hard stop, using only notes and documentation (no AI assistants, as in the real exam).
Exam: bank easy points first (Build questions are fixed value), keep a 30 minute buffer, and submit only when every section has been attempted.
If you fail: the bundle includes a second attempt. Rebook after targeted revision of the weakest section rather than repeating the whole course.

Cost, renewal and continuing education

Item	What OffSec publishes (checked 8 Nov 2026)
CyberCore bundle	From $899 one time: one year of access to one 100-level CyberCore course, its labs and two exam attempts; the subscription auto-renews unless cancelled
Retakes	Need a remaining attempt or a purchased one; the launch post priced retakes at $159 each, so confirm the current price
Other routes	Available through OffSec's Learn Unlimited subscription at launch; team pricing via sales
Validity	Three years from the exam pass date
Renewal	Pass a qualifying OffSec exam in the same category at the same or higher level before expiry; pass a recertification exam within six months before expiry; or use OffSec's CPE programme
Lapse	Retake and pass the same exam
CPE for other bodies	Fully released courses may earn up to 40 (ISC)2 CPE credits
Pass rates	OffSec does not publish holder numbers or pass rates

Watch the auto-renewal. If you only need the exam, set a reminder before the anniversary. Once you pass you cannot retake the same exam, so any unused attempt has no further value for that credential. For managing multiple renewal clocks, see the Certification Renewal and CPE Requirements Guide.

Where it fits on the career path

CyberCore sits at OffSec's 100 level, below the 200-level courses that lead to OSCP+ (offensive), OSDA (defensive analysis) and OSTH (threat hunting). Its breadth is the point: it lets a beginner sample offence, defence and secure build before choosing a specialism.

Goal after OSCC-SEC	Natural next step	Why
Penetration testing	OSCP+ (PEN-200), or eJPT as a smaller step	Deepens the Attack section into full network testing with a report; see the eJPT Certification Guide
SOC analyst	OSDA or CompTIA CySA+	Builds on the Defend section's SIEM work; see the SOC Analyst Career Guide
Threat hunting	OSTH (TH-200)	Eight-hour hunt with report; see the OffSec Threat Hunter Certification Guide
Application security	OSCC-SJD, then OSWA or OSWE	Moves from code fixes to web testing and white-box review
HR filters and government roles	CompTIA Security+ alongside	Widely named in job adverts; complements a practical credential

Decision guidance: choose OSCC-SEC if you want a hands-on proof of breadth and can afford the bundle; choose a multiple-choice entry certification if your target employer screens by name; choose OSCC-SJD if you write Java for a living. Career changers should read the Career Change into Cyber Security Guide first, because the credential helps most when paired with a portfolio of lab write-ups.

Where identity fits: many of the lab paths, from privilege escalation to log analysis, turn on credentials, service accounts and weak access control. Treat those modules as an introduction to identity attack paths, then deepen them with the Penetration Tester Career Guide.

Practitioner checklist

Confirm which CyberCore credential you need (OSCC-SEC broad, OSCC-SJD Java) and read the current course page and exam guide.
Check price, included attempts, retake cost and auto-renewal terms on the day you buy.
Book a provisional exam date in week one of study.
Complete every lab, not just the reading, and keep a personal methodology note.
For each attack lab, record the log evidence and the fix, to rehearse the Defend section.
Run at least one timed six-hour rehearsal without AI assistants.
Test your proctoring setup, webcam and network before exam day and log in 15 minutes early.
Record the pass date and set a renewal reminder well before the three-year expiry.
Plan your 200-level next step before the access year ends.

OffSec CyberCore (OSCC): Exam, Costs and a Beginner Study Plan