Skip to content

Certifications

Certs are expensive , time-consuming , and sometimes outright scams
But the right ones open doors

Here's how to navigate the minefield without wasting thousands of dollars

The Truth About Certifications

Certs don't make you good at security
They prove you can pass a test

That said , HR filters by certs
No OSCP -> no interview at many pentesting shops
It's stupid but it's reality

Entry Level (No Experience Required)

CompTIA Security+

  • Cost: ~$400
  • Best for: Getting past HR filters for entry-level SOC roles
  • Time to prepare: 2-3 months
  • Verdict: Useful for breaking into the industry , useless for actual skills
  • Don't waste money on the CompTIA cert path beyond this one (skip CySA+ , CASP+)

Google Cybersecurity Certificate

  • Cost: ~$50/mo on Coursera
  • Best for: Absolute career changers with zero IT background
  • Time to prepare: 3-6 months
  • Verdict: Decent structured intro , won't impress hiring managers

Professional Level (1-3 Years Experience)

PNPT (Practical Network Penetration Tester)

  • Cost: ~$500
  • Best for: Real-world pentesting skills without OSCP's gotcha exam format
  • Time to prepare: 3-6 months
  • Verdict: Better exam than OSCP (24 hours , actual AD environment , report writing)
  • Created by TCM Security , includes AD , no arbitrary restrictions

eJPT (Junior Penetration Tester) / eCPPT (Certified Professional Penetration Tester)

  • Cost: ~\(200 / ~\)400
  • Best for: Budget-friendly pentesting certs
  • Time to prepare: 1-3 months each
  • Verdict: eJPT is great for beginners , eCPPT has a solid practical exam

OSCP (Offensive Security Certified Professional)

  • Cost: ~$1600
  • Best for: The most recognized hands-on pentesting cert
  • Time to prepare: 3-6 months
  • Verdict: The gold standard despite its flaws
# OSCP prep checklist
# 1. Finish all TJNull's recommended HTB machines
# 2. Work through the PEN-200 course material
# 3. Practice report writing (exam requires professional report)
# 4. Learn buffer overflow basics (still on older exam versions)
# 5. Do the 90-day lab time if you can afford it

Known OSCP criticisms: * Expensive * Exam format changes frequently * Some say it's more about "can you hack OSCP-boxes" than real-world pentesting * Still better than most alternatives for resume power

eWPT / eWPTX (Web Application Pentesting)

  • Cost: ~\(400 / ~\)600
  • Best for: Web app security specialization
  • Time to prepare: 2-4 months
  • Verdict: eWPTX is a solid web-specific cert

Advanced Level (3+ Years)

OSEP (Offensive Security Experienced Penetration Tester)

  • Cost: ~$1600
  • Best for: Advanced evasion , AV bypass , advanced AD
  • Time to prepare: 3-6 months
  • Verdict: Hardest practical cert worth having

CRTP / CRTE (Certified Red Team Professional / Expert)

  • Cost: ~\(400 / ~\)500
  • Best for: AD-specific certification
  • Time to prepare: 1-3 months
  • Verdict: Excellent AD training , affordable

CISSP

  • Cost: ~$750
  • Best for: Management roles , government positions
  • Time to prepare: 3-6 months
  • Verdict: Not a technical cert , but required for many senior positions

Certs NOT Worth Your Money

  • CompTIA CySA+ / CASP+ — overpriced , not respected in the industry
  • CEH (Certified Ethical Hacker) — multiple-choice test about hacking , learn what CEH stands for in the community — "Can't Actually Hack"
  • Anything from "self-paced academy" — if you've never heard of them , it's likely a cert mill
flowchart TD
    A[Security+ or eJPT] --> B[PNPT or OSCP]
    B --> C[OSEP or CRTP]
    C --> D[CISSP]
    A --> E[Specialize: eWPTX]
    E --> C

Budget option: eJPT -> PNPT -> CRTP -> OSEP Traditional route: Security+ -> OSCP -> CISSP Web specialist: eJPT -> eWPTX -> OSEP

Final Reality Check

A cert without skills is a piece of paper
Skills without a cert might not get you an interview

Get the certs that open doors , but never confuse passing a test with being good at security
The best operators I know have a mix — some have OSCP , some have nothing , all of them can actually hack