Wireless assessments are often scoped and bought on the strength of a tester's certificate, yet the three credentials most often cited for wireless work test very different things. This guide sets out, from each certifying body's own pages, what the CWNP Certified Wireless Security Professional (CWSP), the GIAC Assessing and Auditing Wireless Networks (GAWN) and the OffSec Wireless Professional (OSWP) actually examine, how each is assessed, what it costs and how it is kept current. It is written for testers choosing a credential, hiring managers writing role requirements and security leads who buy wireless assessments and need to judge what a certificate evidences. Certifications are listed alphabetically by certifying body throughout; order is not a ranking. Facts were checked on the bodies' sites in November 2026 and fees and formats change, so confirm on the linked pages before you book.
Key takeaways
- Each credential evidences something different. CWSP evidences wireless security design and defence knowledge, GAWN evidences broad wireless and radio assessment knowledge, and OSWP evidences hands-on Wi-Fi key recovery under exam conditions.
- Format matters for hiring. CWSP and GAWN are proctored multiple-choice exams; OSWP is a proctored practical exam followed by a written report.
- Scope reaches beyond Wi-Fi in one case. GAWN and its SANS course cover Bluetooth, RFID, NFC and software-defined radio as well as 802.11.
- Renewal models differ. CWSP is valid for three years, GAWN renews on a four-year CPE cycle, and OffSec states that OSWP does not expire.
- A certificate is one input. For buying assessments, pair any credential with methodology, rules of engagement and report samples; see the Wireless Penetration Testing Guide.
The short answer
Choose by the work the role or engagement needs. For a wireless network engineer or architect moving into security design, WIPS and 802.1X, the CWSP syllabus matches that work and builds on the CWNA. For a tester or assessor who must cover Wi-Fi, Bluetooth, RFID and NFC in physical and facility assessments, the GAWN syllabus is the broadest. For a tester who wants to show practical Wi-Fi assessment ability under time pressure, with a report, OSWP is the practical option. Many wireless specialists hold more than one. For how these fit among general penetration testing credentials, see Penetration Testing Certifications Compared.
Side-by-side facts
| Attribute | CWSP (CWNP) | GAWN (GIAC) | OSWP (OffSec) |
|---|---|---|---|
| Full name | Certified Wireless Security Professional | GIAC Assessing and Auditing Wireless Networks | OffSec Wireless Professional |
| Current exam or course | Exam CWSP-208 | GAWN exam; aligned SANS course SEC617 | Course PEN-210 (level 200) |
| Format | 60 multiple-choice questions | 75 questions | Practical lab exam with three network scenarios, plus report |
| Time | 90 minutes | 2 hours | 3 hours 45 minutes, then 24 hours to upload the report |
| Pass mark | 70% (80% for instructors) | 70% | Proof captured on two of three scenarios, one of them mandatory, plus an accepted report |
| Proctoring | CWNP remote proctored exam | Remote via ProctorU or onsite via PearsonVUE | Proctored by OffSec over VPN |
| Prerequisite | Active CWNA credential | None stated on the certification page | No formal prerequisites; OffSec recommends Linux, TCP/IP and 802.11 basics |
| Validity and renewal | Three years; renew by holding a current CWNA and passing the current CWSP exam | Four-year cycle; 36 CPEs plus renewal fee | OffSec states OSWP does not expire |
| Fees listed (USD, November 2026) | $349.99 exam voucher | $999 standalone attempt for most GIAC certifications; SEC617 course $8,780 | Included with OffSec Learn subscriptions; Learn One listed at $2,199 a year (promotional, standard $2,749) |
Availability: CWNP lists the voucher price and states that CWSP-207 could be taken until 31 December 2025. GIAC states that prices may change without notice and that foundational certifications are priced lower. OffSec subscriptions renew automatically unless cancelled. Taxes are excluded from all listed figures.
CWSP: Certified Wireless Security Professional (CWNP)
What it covers: CWNP's published topic list for CWSP spans WLAN discovery techniques, intrusion and attack techniques, 802.11 protocol analysis, wireless intrusion prevention system (WIPS) implementation, Layer 2 and Layer 3 VPNs over 802.11, security design models for enterprise, SMB, SOHO and public networks, managed endpoint security, 802.11 authentication and key management, 802.1X and EAP types, fast BSS transition (fast roaming), wireless network management systems and security policy development.
How it is assessed: 60 multiple-choice questions in 90 minutes, remote proctored, with a 70% pass mark. An active CWNA is required, which places CWSP within CWNP's wireless professional track.
What it evidences: knowledge of how enterprise Wi-Fi security is designed, configured and monitored, and of the attacks those controls are meant to stop. That is directly useful for testers who must explain findings in terms engineers can act on, such as EAP method choice and roaming key hierarchy. See the 802.1X and EAP-TLS Enterprise Wi-Fi Guide.
Keeping it current: valid for three years. Renewal means holding a current CWNA and passing the current CWSP exam, which also renews the CWNA for three years.
GAWN: GIAC Assessing and Auditing Wireless Networks (GIAC)
What it covers: GIAC's published areas include wireless fundamentals and sniffing, WPA, cracking weak encryption, client-side attacks, rogue networks and hotspots, 802.11 fuzzing, wireless denial of service, bridging air-gapped systems, Bluetooth, low-frequency and high-frequency RFID, NFC and practical software-defined radio. The aligned SANS course, SEC617 Wireless Penetration Testing and Ethical Hacking, runs six days (36 CPEs, 17 hands-on labs) across Wi-Fi data collection, Wi-Fi and enterprise Wi-Fi including WPA2 and WPA3, Bluetooth Classic and BLE with SDR, RFID, smart card and NFC, and a capture-the-flag day.
How it is assessed: 75 questions in 2 hours with a 70% pass mark, proctored remotely through ProctorU or onsite through PearsonVUE. An attempt must be taken within 120 days of activation.
What it evidences: broad knowledge across the radio protocols found in offices, warehouses, healthcare and access control systems, which matters when a facility assessment includes badges, Bluetooth peripherals and IoT as well as Wi-Fi. The course is optional for the exam, but SANS lists a dedicated hardware kit (Wi-Fi cards, an RFID reader and writer, an NFC reader, a Bluetooth adapter and an SDR receiver) that shows the practical depth of the training.
Keeping it current: GIAC renews on a four-year cycle with 36 CPEs and a renewal fee, listed at $499 for most certifications.
OSWP: OffSec Wireless Professional (OffSec)
What it covers: OffSec describes PEN-210 as a level 200 course of 16 modules covering Wi-Fi network types and architectures, wireless reconnaissance, WPS weaknesses, packet capture and analysis, rogue access points and identifying a Wi-Fi adapter's chipset and driver.
How it is assessed: a proctored practical exam. OffSec's exam guide gives 3 hours 45 minutes to work three wireless network scenarios, recover the wireless key and capture a proof file; passing needs two of the three, one of them mandatory. A professional penetration test report must then be uploaded within 24 hours, detailed enough for a competent reader to reproduce the work, with screenshots of each recovered key and proof. The exam guide prohibits automated wireless attack tools and AI chatbots or LLMs during the exam.
What it evidences: that the holder has recovered Wi-Fi keys by hand under time pressure and documented the work to a reporting standard. The ban on automation is the point: the result reflects understanding rather than a wrapper script.
Keeping it current: OffSec states that OSWP does not expire. Course access is through a Learn subscription, and OffSec states that fully released courses may qualify for up to 40 (ISC)2 CPE credits. For OffSec's flagship credential, see the OSCP Certification Guide.
What each credential evidences for an assessment buyer
| Assessment need | Evidence a CWSP holder brings | Evidence a GAWN holder brings | Evidence an OSWP holder brings |
|---|---|---|---|
| Enterprise Wi-Fi configuration review (802.1X, EAP, key management) | Examined knowledge of 802.1X, EAP types and 802.11 key management | Examined knowledge of WPA and enterprise Wi-Fi assessment | Practical experience of Wi-Fi network assessment and reporting |
| Rogue and unauthorised access point detection | WIPS implementation and WLAN discovery techniques | Rogue networks, hotspots and wireless sniffing | Rogue access points and wireless reconnaissance in PEN-210 |
| Facility assessment including badges and IoT radio | Wireless security design across network types | RFID, NFC, Bluetooth and SDR in the published areas | Wi-Fi focused practical work |
| Written deliverable | Security policy development in the syllabus | Assessment and audit framing in the certification name and areas | A graded practical report is part of the exam |
Use the table to write role or tender requirements by need, not by acronym. For how wireless tests are scoped and safely run, see the Wireless Penetration Testing Guide.
Decision guidance
- Engineer moving into security: if you already hold or are working towards CWNA, CWSP extends the same body of knowledge into WIPS, 802.1X and secure design, and its renewal model keeps CWNA current at the same time.
- Consultant covering physical and facility work: the GAWN areas match engagements that include access badges, NFC, Bluetooth and SDR. Budget for the SANS course and hardware if you need guided labs; the exam itself can be taken as a standalone attempt.
- Tester building a practical portfolio: OSWP's practical exam and report are good evidence for junior testers, and OffSec includes PEN-210 in its Learn subscriptions alongside other courses.
- Hiring managers: list the skills the role needs (Wi-Fi assessment, 802.1X review, RFID and NFC, reporting) and accept any credential whose published syllabus covers them, plus demonstrated work. Avoid making a single acronym a hard filter.
- Small teams: one person often covers wireless alongside other testing. A general penetration testing credential plus one wireless credential, matched to the estate (office Wi-Fi only, or facilities with badges and IoT), is usually enough.
- Large teams and providers: mixing credentials across the team gives coverage of design review, radio breadth and practical reporting; map team members to the assessment needs table above.
Preparation and rollout for a team
- Define the wireless scope you test: 802.11 only, or also Bluetooth, RFID, NFC and SDR. This decides which syllabus fits.
- Check prerequisites and budget: CWSP needs an active CWNA; GAWN can be paired with SEC617; OSWP comes through an OffSec Learn subscription. Record fees as listed on the date checked.
- Set up a legal, isolated lab: practise only on equipment you own or are authorised to test, in a shielded or isolated space, with a written lab policy. Radio testing outside authorised scope can breach telecoms and computer misuse laws.
- Map study to the official outline: use the CWNP topic list, the GIAC areas covered and the PEN-210 module list as the plan, not third-party lists.
- Book and sit: note the GIAC 120 day window, the OSWP report deadline and each body's proctoring rules (for OSWP, the bans on automation and AI tools).
- Apply on a real engagement: pair new holders with an experienced tester on an authorised wireless assessment, using the methodology in the Wireless Penetration Testing Guide.
- Track renewal: diarise the CWSP three-year date and GAWN CPE progress; record OSWP as non-expiring but refresh skills as Wi-Fi standards change.
Where identity fits
Enterprise Wi-Fi is an identity control: 802.1X with EAP-TLS ties network access to device and user certificates, and pre-shared keys are shared secrets that are hard to rotate and attribute. A wireless tester's most valuable findings are often identity findings, such as weak EAP methods, clients that do not validate the RADIUS server certificate, shared PSKs on networks that carry corporate traffic, or IoT devices using machine credentials that never change. Credentials that cover 802.1X and EAP (the CWSP syllabus lists them explicitly) help testers report these in terms identity teams can fix. See the 802.1X EAP TLS vs MAB guide.
Measuring whether certification investment works
- Coverage: share of in-scope wireless assessment needs (Wi-Fi, 802.1X, rogue AP, RFID and NFC) with at least one certified team member.
- Currency: share of time-limited credentials within their validity or CPE cycle.
- Report quality: proportion of wireless findings with a reproducible description and a specific remediation, sampled by a senior reviewer.
- Remediation outcome: share of wireless findings closed and verified at retest.
- Time to readiness: time from course start to first supervised engagement.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AT-02 | Individuals in specialised roles receive training so they have the knowledge and skills to perform relevant tasks |
| NIST SP 800-53 Rev. 5 | CA-8, CA-8(1) | Penetration testing, including by independent agents or teams |
| NIST SP 800-53 Rev. 5 | AC-18, AC-18(1), SI-4(14) | Wireless access, authentication and encryption, wireless intrusion detection: the controls wireless testers assess |
| CIS Controls v8.1 | Control 18 | Penetration testing programme and testers |
| ISO/IEC 27001:2022 | Annex A 6.3 | Information security awareness, education and training |
| MITRE ATT&CK for ICS | T0860, T0887 | Wireless Compromise and Wireless Sniffing, relevant where testers assess industrial wireless |
Common failure patterns
- Treating any wireless acronym as interchangeable: a design-focused credential, a broad radio credential and a practical Wi-Fi credential answer different questions; tender requirements should say which skills are needed.
- Ignoring non-Wi-Fi radio: facilities with badge readers, Bluetooth and IoT need testers whose training covered them, or those surfaces go untested.
- Practising outside authorisation: testing neighbouring or public networks while studying creates legal exposure; keep practice to owned or authorised equipment.
- Letting time-limited credentials lapse: CWSP and GAWN need tracked renewal; lapsed credentials can fail client due diligence.
- No report standard: wireless findings without reproduction detail and specific fixes (EAP method, certificate validation, WPA3 transition) rarely get remediated.
Practitioner checklist
- Write down the wireless scope your role or engagements cover before choosing a credential.
- Read the official outline: CWNP CWSP topics, GIAC GAWN areas covered, OffSec PEN-210 modules.
- Confirm current fees, exam format and renewal on the certifying body's page on the day you book.
- Check prerequisites (CWNA for CWSP) and windows (GIAC 120 days, OSWP 24 hour report).
- Build an isolated, authorised practice lab with a written policy.
- Track renewal dates and CPEs for time-limited credentials.
- For buyers, ask for methodology, rules of engagement and a redacted sample report alongside certificates.
- Include 802.1X and EAP configuration in wireless test scope, not only key recovery.
Standards and references
- CWNP: CWSP Certified Wireless Security Professional
- GIAC: Assessing and Auditing Wireless Networks (GAWN)
- GIAC: Renewing Your GIAC Certification
- OffSec: PEN-210 Course and OSWP Certification
- OffSec: OSWP Exam Guide
- SANS: SEC617 Wireless Penetration Testing and Ethical Hacking
- NIST: SP 800-153 Guidelines for Securing Wireless Local Area Networks
- NIST: SP 800-115 Technical Guide to Information Security Testing and Assessment
Related NHI Mgmt Group resources: Wireless Penetration Testing Guide, Penetration Testing Certifications Compared, OSCP Certification Guide, Cybersecurity Certifications Guide.