Penetration Testing Certifications Compared: Six Credentials Matched to Roles and Hiring

Penetration testing certifications are often treated as interchangeable CV keywords, yet they prove very different things, from multiple-choice recall to five days of unsupervised testing followed by a live client-style debrief. This guide compares six widely named credentials side by side: CompTIA PenTest+, EC-Council CEH, GIAC GPEN, INE eJPT, OffSec OSCP and TCM Security PNPT. Credentials are listed alphabetically by provider in tables, and order is never a ranking. It is written for candidates choosing a route, hiring managers reading CVs, and buyers who see these names in penetration testing proposals. Each credential has its own deep guide on nhimg.org; this page does not repeat them, it compares what each one evidences and when to ask for which. Facts are as published on each provider's own pages, checked 14 November 2026. Providers change prices and rules often, so confirm before you book or write a job advert.

Key takeaways

• Format is the main difference. CEH (core exam) is multiple choice, PenTest+ mixes multiple choice with performance-based questions, GPEN adds CyberLive lab challenges, and eJPT, OSCP and PNPT are fully practical lab exams.
• Only some test reporting. OSCP requires a report uploaded within 24 hours of the exam, and PNPT requires a professional report within two days plus a live 15-minute debrief; the knowledge exams assess reporting through questions rather than a written deliverable.
• Level varies more than names suggest. eJPT is aimed at people with little or no security experience, while CompTIA recommends three to four years of testing experience for PenTest+ and TCM Security calls PNPT a professional-level exam.
• Renewal models differ. CEH, GPEN, PenTest+ and eJPT run three or four year cycles, the OSCP+ designation is maintained while the base OSCP is retained, and TCM Security states that PNPT does not expire.
• A certification is evidence, not a methodology. When you buy a test, a tester's credential tells you about training and an exam, never about your scope, rules of engagement or report quality.

The short answer

Pick by what you need the credential to prove:

• A first practical step for a beginner: eJPT, which INE positions for people with little to no security experience. See the eJPT Certification Guide.
• Broad, recognised knowledge with a structured syllabus: PenTest+ or CEH. PenTest+ weights engagement management and reporting as a domain; CEH covers a wide catalogue of attack categories and offers an optional practical. See the CompTIA PenTest+ Guide and the CEH Certification Guide.
• Accredited, process-oriented testing knowledge with lab elements: GPEN, usually taken after SANS training. See the GIAC GPEN Guide.
• Proof of sustained, proctored hands-on compromise of unfamiliar hosts: OSCP. See the OSCP Certification Guide.
• Proof of a full engagement through to client communication: PNPT, where the report and the debrief are part of the pass. See the Practical Red Team Certifications Guide, which covers PNPT alongside CRTO and CRTP.

Side-by-side comparison

The table below uses only what each provider publishes. Prices are given only where the provider's own page lists them.

What each credential actually evidences

For each option this section sets out what the exam proves, how it is built, where it misleads, and when to ask for it.

CompTIA PenTest+

• What it proves: structured knowledge of the whole engagement. The five domains are engagement management (13%), reconnaissance and enumeration (21%), vulnerability discovery and analysis (17%), attacks and exploits (35%), and post-exploitation and lateral movement (14%).
• Architecture in words: a timed exam of up to 90 items, some performance-based simulations, scored on a scale. No live target network.
• Failure mode: reading it as proof of hands-on depth. A holder may know the right sequence and terms without having compromised a domain under time pressure.
• When to ask for it: internal assessment teams, auditors and consultancy staff who need a common baseline in scoping, rules of engagement and reporting; roles where an employer framework already lists CompTIA credentials.

EC-Council CEH

• What it proves: breadth. The v13 course runs across 20 modules, from footprinting to cloud, IoT and OT, and cryptography. The CEH Practical, if taken, adds 20 challenges over six hours; passing both earns CEH Master.
• Architecture in words: a 125-question knowledge exam with a variable cut score, plus an optional range-based practical.
• Failure mode: treating the knowledge-only CEH and CEH Master as the same signal. Ask which one the candidate holds.
• When to ask for it: contracts or employer frameworks that name CEH, SOC and infrastructure roles that need vocabulary across many attack types, and candidates who will later add a practical. The CEH Certification Guide covers eligibility in detail.

GIAC GPEN

• What it proves: a full testing process, from planning and reconnaissance through exploitation, password attacks, Kerberos and Active Directory, and Azure and Entra ID topics, across 16 objectives.
• Architecture in words: 82 questions in three hours with CyberLive performance-based challenges in lab virtual machines. GIAC states it is an accredited ISO/IEC 17024 personnel certification body through ANAB, and the GPEN page carries a DoD 8140 badge.
• Failure mode: assuming cost equals depth. GPEN is the most expensive exam here, mostly because it usually follows paid training; it is shorter than the practical exams.
• When to ask for it: employers that need an accredited certification for workforce compliance, and teams with SANS training budgets. Confirm any DoD 8140 work role mapping with the hiring organisation.

INE eJPT

• What it proves: that a newcomer can work methodically in a small lab. Domains are host and network penetration testing (35%), assessment methodologies (25%), host and network auditing (25%) and web application penetration testing (15%).
• Architecture in words: a hands-on lab exam with questions about what the candidate found, no report.
• Failure mode: using it as evidence that someone can run a client engagement. It is a junior credential and says so in its name.
• When to ask for it: graduate, apprentice and junior SOC or vulnerability analyst hiring, where it shows lab time. Next steps are covered in the eCPPT Certification Guide and the HTB CPTS Certification Guide.

OffSec OSCP

• What it proves: the ability to gain access and escalate privileges on unfamiliar hosts, and to work through an Active Directory set from a supplied low-privilege account, alone and under proctoring for almost a day.
• Architecture in words: three standalone machines worth 20 points each (10 for initial access, 10 for privilege escalation) and an Active Directory set worth 40 points, maximum 100, pass at 70, then a report within 24 hours.
• Failure mode: confusing OSCP and OSCP+. Since late 2024 a pass earns both; OSCP+ must be kept current, the base OSCP does not. Check which a candidate claims and its date.
• When to ask for it: junior to mid-level infrastructure testers and red team trainees where hands-on compromise skill is the deciding factor. Pricing, scaled scoring and maintenance are in the OSCP Certification Guide.

TCM Security PNPT

• What it proves: a full engagement, including open-source intelligence gathering, Active Directory compromise through to the domain controller, a professional report and a live debrief in front of assessors.
• Architecture in words: five days of testing and two days to write, no flags or multiple choice, unproctored, with any tools allowed if their use is disclosed in the report.
• Failure mode: assuming "no proctor" means "easier". The pass depends on a defensible report and debrief, which is closer to client work than any timed exam. The opposite failure is assuming it carries accreditation or workforce-framework mapping that the provider does not claim.
• When to ask for it: consultancy roles where reporting and client communication matter as much as technical skill.

When to use each: decision guidance

Trade-offs for small and large organisations

• Small teams: a single generalist often needs breadth and a practical signal. A lower-cost practical credential plus a knowledge credential usually beats one premium exam. Self-funded candidates should weigh total cost including training.
• Large employers: standardise on a ladder (entry, practitioner, advanced) and record which credentials meet each rung. Map the ladder to job architecture using a skills framework; see Cyber Skills Frameworks Compared and the NICE Workforce Framework Guide.
• Renewal load: CEH and PenTest+ renew on three-year cycles with continuing education, GPEN every four years with a fee, eJPT after three years; PNPT does not expire. Budget renewal fees for every holder, not just exam fees.

Worked scenarios

1. Hiring a graduate tester: a mid-size consultancy advertises for "OSCP required". It receives few applicants and loses good candidates holding eJPT and PNPT. It rewrites the advert to ask for one practical credential (eJPT, OSCP or PNPT) or equivalent evidence such as lab write-ups, then tests reporting with a short take-home exercise. Shortlist quality rises because the advert now describes the skill rather than one brand.
2. An internal team in a regulated bank: the bank needs testers whose credentials satisfy auditors and a contractual workforce clause. It chooses GPEN for senior staff and PenTest+ for juniors, then adds OSCP for two staff who run Active Directory assessments. The mix covers accreditation, a common engagement baseline and deep hands-on skill.
3. Buying a test: a provider's proposal lists "all testers CEH certified". The buyer asks which testers hold practical credentials, requests a redacted sample report, and checks the methodology against the Penetration Testing Methodologies Compared page. Credentials become one input among several, as the Penetration Testing Provider Buyer's Guide recommends.

Where identity fits

Four of the six credentials put Active Directory or cloud identity in scope: OSCP's Active Directory set starts from a supplied domain account, PNPT ends at domain controller compromise, GPEN covers Kerberos, Active Directory and Azure and Entra ID, and CEH and PenTest+ include post-exploitation and lateral movement. That is why identity and NHI teams gain from testers who hold a practical credential: the findings that matter most in modern tests are often over-privileged service accounts, reusable credentials and weak delegation. When you scope a test, name service accounts and machine identities explicitly. See the Internal Network Penetration Testing Guide and the Penetration Test Scoping Checklist.

Measuring whether your certification policy works

• Time to productive engagement: weeks from hire to running a scoped test unsupervised, split by credential held at hire.
• Report rework rate: share of reports returned by quality review, by tester credential type (practical with report versus knowledge only).
• Finding quality: proportion of findings with reproducible evidence and remediation advice accepted by the client or system owner.
• Renewal compliance: percentage of holders current on CPE or CEU obligations at quarter end.
• Training spend per rung: exam plus training plus renewal cost per tester at each ladder level.

Common failure patterns

• One brand in every advert. Requiring a single named credential filters out equivalent practical evidence and shrinks the pool. Describe the skill, then list acceptable credentials.
• Ignoring the date and version. PenTest+ V3 replaced the previous exam in 2025, CEH is on v13, and OSCP holders since November 2024 may hold OSCP+. A credential from years ago may describe a different exam.
• Treating knowledge and practical as equal. CEH and CEH Master, or PenTest+ and OSCP, evidence different abilities. Ask which exam was passed.
• Forgetting reporting. Many testers fail clients on the report, not the exploitation. Only some exams assess a written report, so test this separately.
• Using credentials instead of authorisation and scope. A certified tester working outside written authorisation is still unlawful. Pair hiring with the Penetration Testing Policy Template.

Framework mapping

Practitioner checklist

• Decide what you need proven: knowledge breadth, hands-on compromise, reporting, or accreditation.
• Write job adverts around skills, then list two or more acceptable credentials for each level.
• Ask candidates which exam and version they passed, and when (CEH or CEH Master, OSCP or OSCP+).
• Test reporting separately when the credential did not assess a written report.
• Budget renewal fees and CPE time for every holder, by cycle length.
• Map credentials to work roles in your skills framework, not to job titles alone.
• When buying tests, request methodology and a sample report alongside tester credentials.
• Recheck provider pages before each hiring round or funding decision; formats and prices change.

Standards and references

• OffSec: OSCP+ Exam Guide
• OffSec: OSCP+ Recertification Exam
• TCM Security: Practical Network Penetration Tester (PNPT)
• GIAC: Penetration Tester (GPEN)
• GIAC: Certification Pricing
• EC-Council: Certified Ethical Hacker (CEH)
• CompTIA: PenTest+ V3 (PT0-003)
• INE Security: eJPT Certification

Related NHI Mgmt Group resources: Penetration Tester Career Guide, Cybersecurity Certifications Guide, CREST Certifications, Penetration Testing Guide.