OSED Certification Guide: Exam, Prerequisites and Career Value

The OffSec Exploit Developer (OSED) is one of the few certifications that tests whether you can find and weaponise flaws in compiled Windows software, and candidates routinely underestimate how different it is from a penetration testing exam. OSED is earned by passing a proctored exam of 47 hours and 45 minutes built around three independent exploit development tasks, following OffSec's EXP-301 Windows User Mode Exploit Development course. This guide covers who the certification suits, what OffSec publishes about the exam and its rules, the skills it assumes, a realistic preparation plan, the purchase and retake routes, and where OSED sits among vulnerability research, red team and product security careers. It describes the certification at topic level only and contains no exploit techniques. Facts were checked on OffSec's help centre on 26 October 2026; OffSec changes prices, bundles and exam rules, so confirm the current position before you buy or book.

Key takeaways

• It is an exploit development exam, not a network test. The exam consists of three independent tasks, scored only on full completion, with 60 of 100 points needed to pass.
• The clock is long and the report is mandatory. You get 47 hours and 45 minutes of proctored exam time, then 24 hours to upload a PDF report and one Python 3 script per task.
• Tool rules are specific. OffSec permits IDA Freeware, WinDbg and Metasploit Community, and bans Ghidra, commercial IDA Pro, other commercial frameworks and AI chatbots or LLMs.
• OSED does not expire. It is not on OffSec's list of expiring certifications, and it is one of the exams OffSec accepts for keeping an OSCP+ active.
• It completes a trio. Holding OSED, OSEP and OSWE together automatically earns the OSCE3 designation, with no further exam.

Who the certification is for

OffSec positions EXP-301 as an intermediate, self-paced course whose completion leads to the OSED. The audience is narrower than for OffSec's penetration testing credentials, because the work is reading assembly, using a debugger and reasoning about how a binary handles input, not moving through a network.

• Strong fit: penetration testers who want to understand and adapt exploits rather than run public ones, vulnerability researchers early in their career, and application security engineers who test native code. See the Vulnerability Analyst Career Guide for the wider role.
• Strong fit for defenders: malware analysts, detection engineers and endpoint security engineers who need to judge whether a crash report or proof of concept is exploitable, and how operating system mitigations change the risk. The Malware Analyst Career Guide covers overlapping reverse engineering skills.
• Product and vendor teams: engineers who triage externally reported memory corruption bugs or build exploit mitigations gain a shared vocabulary with researchers.
• Weaker fit: people without programming, debugger or networking basics, and people who mainly want a first offensive security credential. The OSCP Certification Guide covers OffSec's own suggested earlier step.

The skills are dual use. Everything an OSED holder learns belongs in authorised work: testing software you own or have written permission to test, coordinated vulnerability disclosure, and defence. Writing or using exploits against systems without authorisation is a criminal offence in most jurisdictions, for example under the UK Computer Misuse Act 1990 and the US Computer Fraud and Abuse Act.

Exam format and domains

What OffSec publishes about the exam

Report and submission rules

• Report: a PDF with a write-up for each task, explaining discovery and exploitation in enough detail for a technically competent reader to replicate it. Thin documentation can reduce or remove the points for a task.
• Evidence: screenshots showing each proof.txt with its contents and the target's IP address.
• Code: one Python 3 script per task (assignment1.py to assignment3.py), packaged with the report in an unencrypted .7z archive under 200 MB, named with your OSID. Compare the MD5 hash after upload.

Tool restrictions

The Ghidra ban surprises people who learnt reverse engineering on it. Practise in the permitted tools from the start of your preparation, not in the final weeks.

Body of knowledge

OffSec's EXP-301 FAQ lists the course topics rather than weighted domains. At topic level they are:

• Memory corruption fundamentals: classic buffer overflow vulnerabilities in 32-bit Windows user-mode applications.
• Exploit construction: building custom exploits and writing Windows user-mode shellcode.
• Mitigations: working against Data Execution Prevention (DEP) and Address Space Layout Randomisation (ASLR).
• Other bug classes: format string vulnerabilities.
• Reverse engineering: analysing binaries with WinDbg and IDA to find bugs.

OffSec does not publish weightings, and the exam tasks are independent, so treat every topic as examinable.

Prerequisites and experience

OffSec sets no formal certification prerequisite, but the EXP-301 FAQ is clear about assumed skills.

Useful background beyond OffSec's list (our guidance): Windows process and memory concepts, how calling conventions work, and why secure coding and memory-safe languages remove whole bug classes. The Memory-Safe Languages Guide explains the defensive side of the same problem.

Preparation plan

This plan is our guidance, not OffSec's. It assumes the required skills above and roughly 10 to 15 hours a week.

1. Weeks 1 to 2, foundations: refresh x86 assembly reading, Python 3 scripting and debugger navigation. Install WinDbg and IDA Freeware and use only them from now on.
2. Weeks 3 to 8, course modules: work through EXP-301 in order, completing every exercise yourself. Keep structured notes per topic: symptoms, analysis steps, what went wrong and how you confirmed the fix.
3. Weeks 9 to 12, lab repetition: redo the course's extra lab targets without notes. Time each one and record where you lost time.
4. Week 13, report rehearsal: write a full mock report for one target to OffSec's standard: replicable steps, screenshots with proof and IP address, and a clean script. Ask a colleague to follow it.
5. Week 14, exam logistics: test the proctoring software, webcam and connection, plan sleep in blocks across the 47 hours 45 minutes, and decide the order in which you will document tasks, since grading follows report order.
6. If you fail: OffSec's cooling-off periods are 4 weeks after a first failed attempt, 8 weeks after a second and 12 weeks after the third and later. Use the gap to repeat the weakest topic, not to rebook immediately.

Common failure patterns

• Practising in the wrong tools: relying on Ghidra or a commercial disassembler, then losing hours adapting on exam day.
• Partial solutions: there is no partial credit for a task, so a near-complete third task scores nothing. Finish two fully before chasing the third.
• Weak evidence: missing proof screenshots, missing IP address output or a script that does not match the report.
• Using banned help: asking an AI assistant or a forum contact during the exam, which breaks OffSec's rules.
• Fatigue: treating a two-day exam as a sprint and making avoidable mistakes on day two.

Measuring readiness

• Lab completion: share of course exercises and extra lab targets solved without notes.
• Time to solve: median hours per lab target in your last five attempts, against roughly 15 hours per task in the exam.
• Report replication: whether a peer can reproduce your mock report end to end.
• Tool fluency: number of sessions run entirely in WinDbg and IDA Freeware.

Cost, renewal and continuing education

• Purchase routes: OffSec lists EXP-301 under the Course and Cert Exam Bundle (one exam attempt, 90-day access, attempt valid until 120 days after lab end), Learn One (two attempts for the chosen course, plus one OSWP and one KLCP attempt), Learn Unlimited (unlimited attempts while subscribed) and Learn Enterprise. Lab extensions are sold in 30-day increments with the bundle only, and do not add exam attempts.
• Prices: the help centre pages read for this guide do not state current prices, and the course page could not be read. Check offsec.com at the time of purchase; prices change.
• Retakes: purchased retakes are valid for 120 days from purchase, or from the end of a cooling-off period.
• Expiry: OffSec's CPE handbook names OSCP+, OSTH, OSIR, OSCC-SEC and OSCC-SJD as expiring certifications. OSED is not among them, so it has no maintenance fee or CPE requirement of its own.
• Effect on OSCP+: OffSec lists OSED, alongside OSEP, OSWA and OSEE, as an exam that keeps OSCP+ status when passed before the OSCP+ expires.
• CPE for other bodies: if you hold ISC2 or ISACA credentials, check how they accept OffSec course and exam hours.

Where it fits on the career path

For employers, the skills map to recognised control areas. This mapping is our aid for justifying training budgets, not an OffSec statement:

For the broader picture, see the Cybersecurity Certifications Guide and the Red Teamer Career Guide.

Practitioner checklist

• Confirm you meet OffSec's required skills: debugger familiarity, basic 32-bit exploitation concepts and Python 3.
• Choose a purchase route by how many attempts and how much lab time you are likely to need.
• Practise only in permitted tools: WinDbg, IDA Freeware and Metasploit Community.
• Keep structured notes per course topic and repeat lab targets without them.
• Write and peer-test a full mock report, including proof screenshots and Python 3 scripts.
• Plan rest across the 47 hour 45 minute window and aim to fully finish tasks, since there is no partial credit.
• Read the current OSED Exam Guide and restrictions in the week before your exam.
• Get written authorisation before applying these skills to any software you do not own.

Standards and references

• OffSec: OSED Exam Guide
• OffSec: OSED Windows User Mode Exploit Development (EXP-301) FAQ
• OffSec: Learn Subscriptions and Course Bundles
• OffSec: Exam Retake Policy
• OffSec: OSCE FAQ
• OffSec: Recertification
• OffSec: CPE Program and Annual Membership Handbook
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: OSEE Certification Guide · OSEP and OSWE Certification Guide · OSCP Certification Guide · Vulnerability Analyst Career Guide · Cybersecurity Learning Roadmap Guide