OSCP Certification Guide: OSCP+ Exam, Rules and Renewal

Many people still talk about "the OSCP" as if it were one lifetime credential, but since November 2024 a pass earns two: the OSCP, which does not expire, and the OSCP+, which lasts three years and must be maintained. This guide explains what OffSec publishes about the OffSec Certified Professional: the PEN-200 course, the proctored 23 hour 45 minute exam, the points structure, the report you must submit, the ways to buy an attempt, retake rules, and how the OSCP+ is kept active through annual fees, CPE credits or a qualifying exam. It is written for practitioners deciding whether to attempt it and for managers who fund it. It describes the certification, not attack techniques. Facts were checked on help.offsec.com on 24 October 2026, the same week OffSec updated its exam guide ahead of a scoring change on 1 December 2026, so confirm details with OffSec before you book.

Key takeaways

One pass, two credentials. Passing the exam on or after 1 November 2024 earns both the OSCP, which OffSec says has no expiration date, and the OSCP+, which expires three years after issue.
The exam is long and practical. You have 23 hours and 45 minutes to work against six machines (three standalone and a three-machine Active Directory set) for a maximum of 100 points, then 24 more hours to upload a report.
The report is part of the exam. OffSec requires a PDF penetration test report with descriptions and screenshots; without it you are not awarded the OSCP+.
Scoring changes on 1 December 2026. Exams starting on or after 1 December 2026 at 08:00 GMT use scaled scoring to decide the final result, so check OffSec's scaled scoring FAQ rather than relying on older pass-mark advice.
Keeping the "+" costs time and money. Holders pay an annual maintenance fee (US$145) or membership (US$299), and renew through 120 CPE credits over three years, a recertification exam, or a qualifying higher-level exam such as OSEP.

Who the certification is for

The OSCP+ is a performance-based penetration testing certification. OffSec says it is awarded without prerequisites to anyone who passes the exam and submits the report, but the exam assumes you can work methodically and unaided for a full day against unfamiliar systems.

Good fit: junior and mid-level penetration testers, red team trainees, and security engineers moving into offensive roles who need to show hands-on ability rather than recall. See the Penetration Tester Career Guide for the wider route.
Good fit for defenders: detection engineers, SOC leads and identity teams who want to understand how attackers move from a foothold to a domain compromise. The exam's Active Directory set starts from a standard domain user account (OffSec calls it "assumed compromise"), which mirrors how stolen credentials and over-privileged service accounts get used. See the Penetration Testing Guide for how such tests fit a security programme.
Weaker fit: people with no networking, Linux, Windows or scripting background, who will spend most of their lab time on foundations. A knowledge-based exam such as the CompTIA PenTest+ Guide or the CEH Certification Guide may be an earlier step.
Age: OffSec's minimum age for courses and exams is 18; 16 and 17 year olds can apply with a form signed by a parent or guardian, and under-16s cannot register.

Exam format and domains

What OffSec publishes about the exam

Item	What OffSec states	Source page
Exam time	23 hours and 45 minutes	OSCP+ Exam Guide
Report deadline	Upload documentation within 24 hours after the exam ends	OSCP+ Exam Guide
Targets	Three standalone machines and one Active Directory set of three machines	OSCP+ Exam Guide
Standalone points	20 points each: 10 for initial access, 10 for privilege escalation (60 in total)	OSCP+ Exam Guide
Active Directory points	40 points: 10, 10 and 20 across the three machines	OSCP+ Exam Guide
Maximum raw score	100 points; bonus points are no longer available	Exam Guide, OSCP+ FAQ
Passing	The FAQ's passing scenarios each total 70 points; from 1 December 2026, 08:00 GMT, scaled scoring decides the result	OSCP+ FAQ, Exam Guide
Supervision	All OSCP+ exams are proctored	OSCP+ Exam Guide
Results	Sent in the results email; feedback only to candidates who submit a report and fall short	OSCP+ FAQ

OffSec's scaled scoring FAQ could not be read for this guide, so this page does not state the scaled pass mark. Read it on help.offsec.com before booking an exam that starts on or after 1 December 2026.

Restrictions

The exam guide lists categories that are restricted or banned: spoofing, commercial tools or services, automatic exploitation tools, mass vulnerability scanners and AI chatbots. Metasploit and Meterpreter may be used against one target machine only. Read the full restrictions page, because using a banned tool can cost the points for a target or the whole attempt.

Body of knowledge

OffSec publishes the OSCP+ body of knowledge as the 20 PEN-200 learning modules, without weightings:

Area	PEN-200 modules
Method and reporting	Report Writing for Penetration Testers; Information Gathering; Vulnerability Scanning; Assembling the Pieces
Web applications	Introduction to Web Applications; Common Web Application Attacks; SQL Injection Attacks
Initial access and exploits	Client-Side Attacks; Locating Public Exploits; Fixing Exploits; Antivirus Evasion; Password Attacks; The Metasploit Framework
Privilege escalation and pivoting	Windows Privilege Escalation; Linux Privilege Escalation; Port Redirection and SSH Tunneling; Advanced Tunneling
Active Directory	Active Directory Introduction and Enumeration; Attacking Active Directory Authentication; Lateral Movement in Active Directory

The grouping in the left column is ours, to help planning; the module names are OffSec's.

The report

OffSec requires a PDF penetration test report that clearly shows how you met the exam objectives, with screenshots and descriptions of your actions and results. It encourages its own report templates and advises taking notes throughout the exam. The report is a hard requirement: a strong technical performance without an acceptable report does not earn the OSCP+. For what a client-grade report contains, see the Penetration Testing Guide.

Prerequisites and experience

There is no formal experience requirement, no application and no endorsement. What OffSec does set is a purchase route that gives you an exam attempt, and rules on how long that attempt lasts.

Route	Access	Exam attempts	Best for
Course and Cert Exam Bundle	90 days of PEN-200, extendable in 30-day steps (extensions add no attempts)	One, valid until 120 days after the lab end date	Experienced candidates who can study intensively
Learn One	One year: one primary course (such as PEN-200), PG Practice, PEN-210 and PEN-103 content; auto-renews when bought online	Two at the primary course	Most self-funded candidates who need time to practise
Learn Unlimited	One year: all OffSec content at purchase except Cyber Range	Unlimited OSCP attempts while valid (also OSEP, OSWE and others)	Candidates planning several OffSec certifications, often employer-funded
Recertification exam	Exam only	One, valid 120 days from purchase	Existing OSCP or OSCP+ holders

OffSec's help pages do not state current prices for these products, and its main product pages could not be read for this guide. Check current pricing on offsec.com, including any regional pricing and employer licence options.

Retake rules: after a failed attempt you wait 4 weeks before a retake, 8 weeks after a second failure and 12 weeks after the third and later failures, counted from the previous exam date. Bought retakes are valid for 120 days. Cancelled exams do not trigger a cooling-off period.

Skills you should already have: OffSec does not publish a formal list for PEN-200 on the pages read for this guide. In practice candidates do best with comfort on the Linux and Windows command line, TCP/IP and common services, reading and adapting short scripts, and Active Directory concepts such as users, groups and Kerberos authentication.

Preparation plan

Weeks 1 to 2, check readiness and logistics: read the OSCP+ Exam Guide, reporting requirements, proctoring FAQ and restrictions in full. Confirm your hardware, webcam and connection meet the proctoring requirements, and decide which purchase route fits your time.
Weeks 3 to 10, work through PEN-200: complete each module's exercises in order, writing notes as reusable checklists in your own words. Do not skip Report Writing for Penetration Testers; it underpins the deliverable that decides your result.
Weeks 8 to 14, practise end to end: use the course challenge labs and, if you have Learn One, PG Practice. Treat each machine as a mini engagement: enumerate, gain access, escalate, document. Give the Active Directory material extra time, because the AD set is worth 40 points and is scored as a chain.
Weeks 12 to 14, rehearse the exam day: run at least one timed full-day practice with a written plan for breaks, sleep and when to move on from a stuck target. Write a full practice report from a template within 24 hours.
Book and sit: schedule early, since proctored slots fill up. Keep screenshots and proof as you go, and stop to write the report while details are fresh.
If you fail: use the feedback (sent only if you submitted a report), plan around the 4-week cooling-off, and target the weakest area rather than repeating everything.

The 14-week plan is NHI Mgmt Group guidance, not an OffSec requirement. Experienced testers often need less; newcomers to Active Directory often need more.

Where it maps in frameworks

The skills the OSCP+ tests support these controls. The mapping is our study and justification aid, not an OffSec or NIST statement.

Framework	ID	Why it is relevant
NIST SP 800-53 Rev 5	CA-8 Penetration Testing	The control an OSCP-qualified tester most directly helps deliver
NIST SP 800-53 Rev 5	CA-8(1) Independent Penetration Testing Agent or Team	Independent testers are often asked for practical certifications
NIST SP 800-53 Rev 5	RA-5 Vulnerability Monitoring and Scanning	Validating scanner findings by hand is a core exam skill
NIST CSF 2.0	ID.RA-01	Vulnerabilities in assets are identified, validated and recorded
NIST CSF 2.0	ID.IM-02	Improvements are identified from security tests and exercises
NIST CSF 2.0	PR.AT-02	Specialised roles are trained to perform their tasks; funding the OSCP+ is evidence of this

Cost, renewal and continuing education

The OSCP does not expire. The OSCP+ is valid for three years from the date of issue, and OffSec lists it among its expiring certifications alongside OSAI+, OSCC-SEC, OSCC-SJD, OSTH and OSIR. If you let the "+" lapse you keep the OSCP.

Renewal element	What OffSec states
Annual Maintenance Fee (AMF)	US$145 a year, does not auto-renew, covers certification maintenance only
Annual Membership Program (AMP)	US$299 a year, auto-renews, includes AMF coverage plus learning content
Coverage	One AMF or AMP payment a year covers all of a holder's expiring certifications
CPE route	120 CPE credits over the three-year cycle (about 40 a year), with annual coverage kept up
Recertification exam	Can be bought and taken up to six months before the OSCP+ expires; one attempt, valid 120 days
Qualifying exam route	Pass OSEP, OSWA, OSED or OSEE before the OSCP+ expires
Unpaid fees	Reminders in years 1 and 2; after three unpaid years the certification goes inactive, with a 90-day grace period before it is permanently expired

Eligible CPE activities include OffSec learning content and labs, conference presentations, published research or vulnerability discoveries, and relevant training on other platforms, under the rules in OffSec's CPE Handbook. Keep evidence for each activity. If you plan to take OSEP within three years anyway, that route renews the "+" and adds a credential; see the OSEP and OSWE Certification Guide.

Budgeting for an employer: plan for the purchase route, at least one retake, the annual fee for the life of the OSCP+, and study time. The study time usually costs more than the fees.

Where it fits on the career path

Before it: fundamentals in networking, operating systems and scripting, sometimes evidenced by an entry-level certification. The Cybersecurity Certifications Guide compares options by level.
Alongside it: knowledge-based penetration testing exams such as PenTest+ test breadth and process; the OSCP+ tests whether you can do the work under time pressure. Many hiring managers read them as complementary.
After it: OffSec positions PEN-300 (OSEP) for learners who have completed PEN-200 and the OSCP or have equivalent knowledge, and WEB-300 (OSWE) for white-box web application testing. Adversary emulation credentials are covered in the Practical Red Team Certifications Guide.
For buyers of testing: an OSCP or OSCP+ on a tester's CV shows they passed a practical exam once; the "+" shows it is current. Ask about both, and about relevant recent work, when you assess providers. See the Penetration Testing Provider Buyer's Guide.

Common failure patterns

Treating the report as an afterthought: candidates finish the technical work exhausted and submit a thin report, or miss screenshots needed to prove points. Document as you go.
Ignoring the restrictions: one prohibited tool or a second Metasploit target can cost points. Read the restrictions before the exam, not during it.
Underweighting Active Directory: the AD set is worth 40 points and is a chain, so weak AD skills can make a pass very hard.
Relying on outdated advice: forum posts written before November 2024 mention bonus points that no longer exist, and many posts will not reflect scaled scoring from December 2026.
Letting the "+" lapse unnoticed: holders who skip the annual fee and CPE tracking find their OSCP+ inactive at the end of year three.

Practitioner checklist

Read the current OSCP+ Exam Guide, reporting requirements and restrictions on help.offsec.com.
Check whether your exam will start before or after 1 December 2026, 08:00 GMT, and read the scaled scoring FAQ if after.
Choose a purchase route that gives you enough lab time and attempts for your experience.
Test your proctoring setup well before exam day.
Practise Active Directory chains and full reports under time pressure.
Plan for the cooling-off periods (4, 8 and 12 weeks) when setting deadlines.
After passing, set a renewal date three years from issue and choose AMF or AMP.
Log CPE activities with evidence, or plan a qualifying exam such as OSEP before expiry.

OSCP Certification Guide: Exam, Requirements and Preparation