Incident responders are judged on whether they can trace an intrusion through logs, pull apart the attacker's tooling and write it up clearly under time pressure, and the OffSec Incident Responder (OSIR) exam tests those three things in eight hours. OSIR is the certification for OffSec's IR-200 Foundational Incident Response course. This guide sets out what OffSec publishes about it: the two-phase exam, scoring and pass mark, report rules, purchase options and the three-year renewal cycle. It adds a preparation plan and shows where OSIR sits on a defensive career path. It is written for SOC analysts, aspiring incident responders, IT security specialists moving into incident management, and the managers who build response teams. Facts are from offsec.com and OffSec's help centre, checked 8 November 2026; confirm fees and exam rules there before you buy.
This is an independent guide from NHI Mgmt Group, based on OffSec's public documentation as of November 2026. It is not sponsored or reviewed by OffSec. Product features change, so confirm settings against OffSec's current documentation.
Key takeaways
- Two phases, one day. Phase 1 tracks an attacker through Splunk across a simulated enterprise; phase 2 is forensic analysis of a disk image to identify, extract and analyse a post-exploitation framework binary.
- Scoring is points based. Four phase 1 questions at up to 10 points and two phase 2 questions at up to 15 points, 70 in total, with partial credit; the pass mark is 50.
- The report is part of the score. SIEM screenshots and queries, a findings timeline, and screenshots of every forensic step, submitted within 24 hours; late is an automatic fail.
- Open book, no AI. Notes and online resources are allowed; LLMs and AI chatbots, uploading artefacts to online services such as VirusTotal, and help from others are not.
- Renew every three years. By a qualifying OffSec exam, a recertification exam in the six months before expiry, or OffSec's CPE programme.
Who the certification is for
OffSec describes IR-200 as a 200-level course of 34 hours in 13 modules for:
- Aspiring incident responders who need a structured route into the role.
- SOC analysts who escalate incidents and want to handle them end to end.
- IT security specialists who are pulled into incidents as part of a wider job.
- Professionals moving into incident management, including the communication and coordination side.
Less suited (our judgement): experienced responders looking for advanced forensics depth, and penetration testers looking for an offensive credential. For the role itself, see the DFIR Analyst Career Guide and the SOC Analyst Career Guide.
Exam format and domains
Format
| Item | OSIR (OffSec, checked 8 November 2026) |
|---|---|
| Duration | 8 hours, proctored; breaks, food and drink allowed (the timer keeps running) |
| Phase 1 | Detection and identification in Splunk: track an attacker in a simulated enterprise (Megacorp One), identify compromised systems, assess impact such as exfiltration or encryption; 4 questions, up to 10 points each |
| Phase 2 | Forensic analysis of a disk image containing a post-exploitation framework binary: identify, extract and analyse it; 2 questions, up to 15 points each |
| Scoring | 70 maximum; partial credit for correct answers and completeness, including documentation |
| Pass mark | 50 points |
| Connection | Local Kali with the Universal VPN file, or Kali in Browser or Windows in Browser; not both at once |
| Resources | Open book: notes, online resources, OffSec Learning Platform; no LLMs or AI chatbots, including OffSec's own assistant |
| Other restrictions | No downloading files from the exam environment; no uploading forensic artefacts to online platforms such as VirusTotal; no help from others |
| Report deadline | 24 hours after the exam; late is an automatic fail; submission is final |
| Results | Pass or fail within 10 business days; credential on the Achievements page, claimed through Accredible |
What the course covers
OffSec does not publish weighted exam domains. The IR-200 course page lists these topics (grouping ours), plus hands-on labs and a Challenge Lab that mirrors the exam structure:
| Area (ours) | IR-200 topics | Where it shows up in the exam |
|---|---|---|
| Process | Incident response lifecycle; ITIL-based approach to enterprise incident response | Structuring the investigation and the report |
| Detection | Detection and identification strategies; attack techniques and mitigations | Phase 1 SIEM hunt |
| Forensics | Digital forensics for incident handling; technical analysis and handling of digital evidence | Phase 2 disk image analysis |
| Response | Eradication techniques; communications planning before, during and after a crisis | Impact assessment and recommendations in the report |
For the underlying disciplines, see the Incident Response Guide, the Digital Forensics (DFIR) Guide and the Splunk SPL for Threat Hunting Guide.
Where identity fits: tracking an attacker through an enterprise usually means following accounts: which credentials were used, where they logged on, and which service accounts carried lateral movement. Practise pivoting on user and service account names as well as hosts and hashes, and include credential reset and token revocation in your eradication notes. See the Identity Threat Hunting Guide.
Prerequisites and experience
OffSec states no formal prerequisites and recommends:
- TCP/IP networking.
- Familiarity with Linux and Windows.
- Basic cybersecurity concepts.
It points learners who need these to its Incident Responder Foundations learning path. Realistic readiness (our judgement): you can write Splunk searches with filters, statistics and time ranges, read Windows event logs, know the common attacker techniques for persistence and lateral movement, and have used at least one disk forensics tool to browse a file system image.
Preparation plan
- Choose the purchase option: the 90-day bundle gives one attempt; Learn One gives a year and two attempts.
- Work through IR-200 (weeks 1 to 5): complete the 13 modules and labs, building a personal query library and a forensic step checklist as you go, since the exam is open book.
- Splunk fluency (alongside): for each technique you meet, save a working search with a one-line explanation of what it finds.
- Forensic workflow (weeks 4 to 6): practise mounting or opening an image, locating a suspicious executable, extracting it safely and analysing it offline, with a screenshot at every step. Never upload samples to online services, which the exam forbids.
- Challenge Lab (week 6): treat it as a mock exam, then write a full report in your template.
- Timed rehearsal (week 7): run both phases in eight hours, then write the report in the following session.
- Environment check (week before): test proctoring, your connection method, and building the .7z archive and its MD5 hash.
Small vs large organisations: in a small team one person often owns incident handling, so the bundle gives a fast, structured route. Larger teams can use OffSec's team pricing and adopt the OSIR report structure (narrative, queries, timeline, forensic steps) as their internal incident report standard. See the Incident Response Plan Template.
Report requirements
| Element | OffSec requirement | Practical implication |
|---|---|---|
| Phase 1 evidence | All relevant SIEM screenshots and the queries used, so a technically competent reader can reproduce them; every detected attacker activity in a Findings timeline | Paste query text and screenshot results the moment they return evidence |
| Phase 2 evidence | Screenshots of each investigation step with the tools and commands used | Screenshot tools as you run them, not afterwards |
| Strictness | Missing screenshots or information can reduce points or score zero; OffSec will not ask for missing items | A correct answer without evidence may score nothing |
| Format | PDF named OSIR-OS-XXXXX-Exam-Report.pdf in an unencrypted .7z of the same name, under 100MB, PDFs only; all queries as text; verify MD5 after upload | Rehearse the archive and upload steps |
| Clarifications | Reply within 24 hours if OffSec asks | Watch your email after submitting |
Splitting the time (our recommendation): phase 2 carries 30 of the 70 points, so set a hard checkpoint, for example at the four and a half hour mark, to move to the disk image even if a phase 1 question is unfinished. Partial credit on every question usually beats a perfect answer to some and nothing on others, and you can return to phase 1 later if time allows.
Measuring readiness and value
- Coverage: every module lab completed with a saved query or forensic step.
- Rehearsal score: in a timed mock, at least 50 of 70 points answered with evidence.
- Report time: a complete report produced well inside 24 hours.
- Team value after passing: time to scope an incident, share of incidents with a written timeline, and detections created from investigation findings.
Cost, renewal and continuing education
| Option (OffSec, USD, checked 8 November 2026) | Price | Includes |
|---|---|---|
| Course and Cert Bundle | $1,749 one-time | 90 days of access to one 200 or 300-level course, labs, one exam attempt |
| Learn One | $2,749 list, shown at $2,199 a year under an anniversary offer; auto-renews unless cancelled | One year of access to one 200 or 300-level course, labs, two exam attempts |
| Teams | Custom pricing | Through OffSec sales; free trial on request |
OffSec states the course may qualify for up to 40 (ISC)2 CPE credits, subject to eligibility. Pricing changes, so check the course page before buying.
Expiry and renewal
- Validity: OSIR expires three years after the exam pass date.
- Renew by exam: pass a qualifying OffSec exam in the same category at the same or a higher level before expiry.
- Renew by recertification exam: taken within the six months before expiry.
- Renew by CPE: earn credits through OffSec's Continuing Professional Education programme.
- If it lapses: retake and pass the OSIR exam.
If you fail: schedule another attempt if you have one left, otherwise buy a new attempt. If your report scored insufficient points, you can request feedback by email; OffSec responds within 10 business days.
Common failure patterns
- Evidence not captured: missing screenshots or query text can cost the points for a correct answer.
- Spending the day in phase 1: phase 2 carries 30 of the 70 points; plan time for both.
- Stopping at indicators: phase 1 asks for compromised systems and impact, including exfiltration or encryption.
- Uploading a sample online: submitting exam artefacts to services such as VirusTotal is prohibited.
- Using an AI chatbot: treated as third-party help under OffSec's academic policy.
- Late or malformed submission: late is an automatic fail; naming, size and archive rules are strict.
Where it fits on the career path
| Stage | OffSec credential | Relationship to OSIR |
|---|---|---|
| Foundations | OffSec CyberCore (OSCC) | General security grounding |
| SOC analyst and defender | OSDA | Detection and alert analysis that feed incident handling |
| Incident responder | OSIR | End-to-end investigation, forensics and reporting |
| Threat hunter | OSTH | Proactive hunting using the same SIEM and reporting skills |
- See OffSec CyberCore (OSCC), the OSDA Certification Guide and the OffSec Threat Hunter Certification Guide.
- For wellbeing in a demanding role, see Incident Responder Wellbeing.
Practitioner checklist
- Check networking, Linux, Windows and security basics before buying.
- Pick the bundle or Learn One based on study time and attempts needed.
- Build a Splunk query library and a forensic step checklist while working through IR-200.
- Complete the Challenge Lab as a mock exam with a full report.
- Rehearse both phases in eight hours, leaving time for phase 2.
- Screenshot every query and forensic step the moment it produces evidence.
- Test proctoring, connection method, archive naming and MD5 checks beforehand.
- Diarise the three-year expiry and choose a renewal route early.
Standards and references
- OffSec: IR-200 Foundational Incident Response (OSIR)
- OffSec Support: OSIR Exam Guide
- OffSec Support: OSIR Exam FAQ
Related NHI Mgmt Group resources: Incident Response Guide · Digital Forensics (DFIR) Guide · DFIR Analyst Career Guide · OffSec Threat Hunter Certification Guide · Cybersecurity Certifications Guide