Ethical Hacker Certification Guide: Best Certs, Costs (2026)

No single exam “makes” you an ethical hacker. The credentials you’ll see in job posts fall into three groups, and knowing the difference saves you money. Spending a thousand dollars on the wrong type of exam is one of the most common early mistakes, and it’s easy to avoid. Here’s how the groups differ.

• Knowledge exams - test whether you understand tools, attacks, and rules. Security+ and CEH work this way.

• Hands-on exams - drop you into a lab and ask you to break in. eJPT, PNPT, OSCP, and CEH Practical work this way.

• Mixed exams - blend both. PenTest+ is mostly questions, with some performance-based tasks.

A knowledge exam gets your résumé noticed. A hands-on exam gives you something to talk about once you’re in the interview. Most people who stay in the field end up earning one of each.

If you’re still deciding whether this career fits you, our guide to ethical hacker roles and responsibilities walks through the day-to-day work. If you’re leaning toward penetration testing specifically, the penetration tester certification guide compares the same exams from that job’s angle.

Not always, but it helps more than most people admit, especially when your résumé has no security jobs on it yet. Outside certain government and defense roles, no law requires one. What hiring managers really want is evidence that you can do the work, and a certification is often the quickest way to offer it. Here’s what the data says.

The U.S. Bureau of Labor Statistics notes that employers may prefer to hire analysts who hold professional certification, and some of those certifications are aimed at entry-level workers.

What can you earn?

Pay is the first thing most people look up, so here’s a grounded way to read the numbers. The Bureau of Labor Statistics doesn’t track “ethical hacker” as its own occupation. The closest match is information security analysts, who earned a median of $129,180 in May 2025. The lowest-paid 10% earned under $75,090, and the top 10% earned over $199,850. Employment is projected to grow 21% from 2025 to 2035, with about 14,100 openings a year.

Treat those numbers as a rough map, not a promise. Your own pay will depend on your city, your industry, and how much hands-on experience you can show. Private salary sites publish higher and lower figures than BLS, so the best reality check is ten job posts in your area.

AI now shows up in this work in two ways: you use it to move faster, and you sometimes have to test AI systems themselves. The exams have started to follow. That means the version of an exam you study for matters more than it used to. Here’s what has changed so far.

• EC-Council built AI into CEH v13, with AI-assisted labs in areas like footprinting, scanning, enumeration, and vulnerability analysis.

• CompTIA’s PenTest+ (PT0-003) now covers AI attacks, such as prompt injection and model manipulation.

• CompTIA’s Security+ V8 adds an objective on the security risks associated with AI.

You don’t need a separate “AI hacking” credential to start. Study the current version of whichever exam you choose and you’ll pick up the AI material along the way. What AI doesn’t replace is judgment: deciding whether a finding is truly exploitable, chaining small weaknesses together, and explaining the risk clearly to someone non-technical.

Here’s the whole path in one place so you can see how the pieces fit before we dig into each one. Think of the stages as levels, not strict rules. Plenty of people skip Stage 1, and some jump straight to CEH when a job requires it. Fees are list prices that were current in October 2026, and “experience” means formal requirements unless it says “recommended.”

Pay is the question behind most certification decisions, so here’s how the stages line up with common job titles and typical US pay. Think of these as the ranges you’ll see for people who hold those titles, not a promise that a certification alone sets your salary.

Ranges come from 2026 salary data and vary a lot by city, industry, and employer. Sources: QuickStart (junior analyst pay), Payscale’s penetration tester data, Payscale’s vulnerability analyst data, and KORE1’s penetration tester salary guide (senior and lead pay). Some sources run higher, especially for experienced testers at large firms, so treat these as conservative reference points. The figures follow job titles and years of experience more than any single exam, so use job posts in your area to check what your target employers pay.

Exam versions and prices are shifting this year, and timing mistakes are expensive. A voucher bought for a retiring version can leave you studying the wrong material. Booking at the wrong moment can also cost you weeks. These are the changes worth knowing before you spend anything.

• Security+: SY0-701 is the current exam, and CompTIA says its English version retires on June 11, 2027. The next version, Security+ V8 (SY0-801), is scheduled to launch on or around November 17, 2026. A Security+ you earn stays valid for three years either way, so if you can test before the switch, V7 is a sound choice. If you won’t be ready until after launch, study for V8.

If you’re testing before June 11, 2027, SY0-701 is a fully valid choice. CompTIA says V7 remains a strong option for anyone ready to certify now, and you earn the same Security+ credential, valid for three years, either way. Aiming for a DoD role? Check that your version is listed for your work role.

• CompTIA prices went up on June 1, 2026. Security+ and PenTest+ are now $439, and Network+ is $399.

• ISC2 CC: ISC2 closed its free-exam program on May 20, 2026. The exam now costs $199.

• CEH: The current version is v13 (312-50). EC-Council says new versions arrive every 12 to 18 months, so check that every study resource names v13.

• PenTest+: PT0-003 launched in December 2024, and CompTIA usually retires a version about three years after launch. Expect a refresh around 2027.

You don’t have to start with the hardest exam. These steps build vocabulary and confidence, and every one of them is optional. If you already work in IT, you can probably skip most of them. If you’re brand new, one or two will make Stage 2 much smoother.

CompTIA Network+ (N10-009) - makes sense if networking is your weak spot. Network+ is a maximum of 90 questions in 90 minutes, with a passing score of 720, and it costs $399. Ethical hacking happens inside networks, so if TCP/IP, DNS, and routing already feel comfortable, skip it.

ISC2 Certified in Cybersecurity (CC) - is a gentle first exam with no experience requirement. ISC2’s CC page notes that it’s accredited to ISO/IEC 17024 and approved under DoDM 8140.03. The exam costs $199, and third-party sources report a $50 annual maintenance fee. Plenty of people skip CC and go straight to Security+.

EC-Council’s entry options - make the most sense if you already plan to follow EC-Council’s path toward CEH. Ethical Hacking Essentials (112-52) is a 75-question, two-hour exam with no prerequisites. EC-Council sells it with 47 labs and a proctored exam voucher for $299. The Certified Cybersecurity Technician (CCT, exam 212-82) is another entry-level option, with a hands-on practical component. Check EC-Council’s store for its current price.

What this means for your pay

A foundation certification won’t raise your pay on its own. Its job is to help you land your first technical role and get you ready for Stage-2. BLS notes that many information security analysts come up through IT departments, often as network and systems administrators, so this stage is more about getting your foot in the door than about a raise. For a sense of the starting line, BLS lists 2025 median pay of $62,890 for computer support specialists and $99,130 for network and computer systems administrators.

Stage 2 is where your path stops being theory and starts looking like a job. You’ll take one broad exam that employers recognize and one hands-on exam that proves you can use real tools under pressure. Together they give you a résumé keyword and a story to tell in interviews. Neither requires prior security experience on paper, though both reward some lab time.

CompTIA Security+ (SY0-701)

Security+ is a common first step into security work, and CompTIA lists DoD 8140 work roles for it, including cyber defense analyst and vulnerability analyst. The exam allows a maximum of 90 questions in 90 minutes, mixing multiple-choice and performance-based questions, with a passing score of 750 on a 100–900 scale. The fee is $439. CompTIA recommends Network+ and two years of security or systems administration experience, but treats that as a recommendation.

For prep time, CompTIA’s own CertMaster Learn+Labs course is estimated at 30 to 60 hours, and its practice product adds 10 to 20 more. The limit of Security+ is that it teaches concepts, not tool skills. That’s why the next step matters.

INE eJPT

eJPT is the friendliest hands-on exam out there. INE designed it for people with little to no cybersecurity experience, and it simulates real work. The exam covers host and network penetration testing (35%), assessment methodologies (25%), host and network auditing (25%), and web application testing (15%). You’ll find hosts and services, exploit weaknesses with Metasploit, and pivot between machines.

You need an INE subscription plus an exam voucher, and INE sells bundles that include both. Third-party sources put the voucher at about $249, so confirm the price at checkout. The voucher lasts 180 days, a failed attempt gets one free retake within 14 days, and a pass is valid for three years. For many people it’s the best first answer to a hiring manager’s question: “Can you actually do this?”

What this stage means for your pay

With Security+ and eJPT behind you, you’re positioned to apply for junior security roles, and that’s where your pay can start to separate from general IT work. BLS says information security analysts typically need a bachelor’s degree and less than five years of related experience, although some people enter with a high school diploma plus relevant training and certifications. BLS doesn’t publish an entry-level figure for these jobs. Its lowest tier is the bottom 10% of information security analysts, who earned under $75,090 in May 2025, which gives you a rough picture of the floor. Where you land depends on your city, your industry, and how much hands-on proof you can show.

This is where most people ask which of the top ethical hacker certifications to pick. The honest answer depends on what you want the certificate to do for you. One option helps you clear HR filters and defense requirements. Another proves hands-on skill, and a third gives you a broad, employer-recognized exam with reporting built in. Here’s how each one works.

CEH (Certified Ethical Hacker v13, exam 312-50)

CEH is EC-Council’s flagship credential and one of the most widely recognized names in ethical hacking. The knowledge exam has 125 multiple-choice questions over four hours, and EC-Council says passing scores run from 60% to 85% depending on the exam form. The course covers 20 modules, from reconnaissance and scanning to web applications, SQL injection, wireless, IoT, cloud, and cryptography. EC-Council also advertises 221 labs and 550+ attack techniques.

How you become eligible:There are two routes. Take official EC-Council training (through iClass, an authorized training center, or an academic partner) and you can skip the application. Or apply for eligibility with at least two years of information security experience and a $100 application fee. EC-Council also recommends about two years of IT security experience before attempting the exam, even though it lists no formal prerequisites. So CEH works best once you’ve built some foundation, not as a first leap.

What it costs: EC-Council’s official course packages start at $1,699 for on-demand and $2,499 for live online, and EC-Council says its course kits include an exam voucher. If you qualify through experience, third-party sources put the voucher at about $950 to $1,199 depending on how you test, plus the $100 application fee. To keep the credential, you’ll earn 120 continuing-education credits over three years and pay an annual fee of $80, per EC-Council’s ECE policy.

Government and defense: If you’re eyeing federal or defense work, CEH counts for more than usual. EC-Council says it’s approved for DoD roles such as Cyber Defense Analyst and Vulnerability Assessment Analyst. The rules sit in DoDM 8140.03, which requires personnel certifications to be accredited to ISO/IEC 17024.

Where it falls short: CEH is a knowledge exam, so it proves what you know, not what you can do. Pair it with a hands-on credential like eJPT or PNPT, and you cover both sides.

CompTIA PenTest+ (PT0-003)

Plenty of lists call PenTest+ a beginner exam, but CompTIA recommends three to four years in a penetration tester role, plus Network+ and Security+ or equivalent knowledge. You can still pass sooner with solid study. The exam allows a maximum of 90 questions over 165 minutes, with a 750 passing score. Attacks and exploits make up the biggest slice at 35%, and planning, legal rules, and report writing round it out. Choose it when you want one broad, employer-recognized exam that includes the reporting side. The fee is $439.

TCM Security PNPT

PNPT is a practical exam that simulates a real engagement. You’ll have five days to run an assessment, including open-source intelligence and Active Directory exploitation, plus two more days to write a professional report. Then you present a 15-minute live debrief to TCM’s assessors. There are no flags to capture and no multiple-choice questions.

TCM sells the exam for $499, including 45+ hours of on-demand training with 12 months of access and one free retake. TCM calls PNPT a professional-level exam and recommends that people without professional hacking experience start with its PJPT first, so be honest with yourself about where you are.

OffSec OSCP (PEN-200)

OSCP is the heavyweight. It’s a proctored 24-hour practical exam, followed by another 24 hours to submit your report. PEN-200 has no formal prerequisites, but OffSec expects a solid grounding in networking and basic familiarity with Linux and Windows. The course-and-exam bundle, with 90 days of labs and one attempt, costs roughly $1,650 to $1,750, and OffSec’s pricing has shifted over time. OffSec itself describes OSCP as more technical than other penetration testing certifications, which is why eJPT or PNPT first is a smart warm-up.

If you want a natural next step after eJPT inside INE’s catalog, eCPPT is the one INE points to.

What this stage means for your pay

At this level you’re hired to test systems, not just assist, and your pay can reflect that. The BLS median for information security analysts was $129,180 in May 2025. Industry matters: BLS lists medians of $138,650 in the information industry, $132,410 in computer systems design, and $130,630 in finance and insurance.

You’ll also see higher figures from vendors. EC-Council’s CEH page cites Glassdoor data (July 2026) putting U.S. ethical hacker pay at about $174,000, with a range of roughly $132,000 to $233,000. That’s well above BLS, and the two sources define the job and gather data differently. Treat the BLS numbers as the conservative reference and the vendor-cited number as the upper end. Neither source shows that a single certification, CEH or otherwise, causes a raise, so use job posts in your area to see what your target employers pay.

Once you hold CEH and a few years of experience, you’ll start seeing credentials that sound impressive but serve narrower goals. This stage is short on purpose, because most readers won’t need it for a while. Think of it as a preview so you can plan ahead without overspending today.

If you want hands-on proof inside EC-Council’s own path, the CEH Master track adds a six-hour practical exam with 20 challenges. Confirm current pricing with EC-Council.

Beyond that, certifications like OSEP (PEN-300), EC-Council’s CPENT, and CISSP are later-career moves. They suit people with several years in the field, so you can safely leave them off your list for now.

What this stage means for your pay

This is where experience, not any one exam, drives the biggest gains. BLS reports that the top 10% of information security analysts earned more than $199,850 in May 2025. It also notes that analysts can advance to chief security officer or other computer and information systems manager roles, and BLS puts the median for those managers at $175,140. Advanced certifications like CEH Master, OSEP, or CISSP can support that climb, but they work best alongside years of real engagements and leadership. BLS doesn’t tie pay to specific certifications, so I haven’t quoted any “X% raise” figures.

Not every well-known certification is a good first purchase. Some are built for senior roles, and others are great goals but frustrating starting points. Skipping them for now won’t hurt your career, and it will keep your budget focused on exams that move you forward. Here’s what to put off.

• CISSP and other senior credentials: valuable later, but built for people with years of experience.

• OSCP as your first exam: a great goal, a frustrating starting point.

• CEH as your only credential: it opens doors but doesn’t prove hands-on skill on its own.

• Exam dumps: they build no skill and can get a certification revoked.

Mostly, yes. You can study for every certification in this guide online, and many exams can be taken from home. The details vary by provider, so it’s worth knowing what to expect before you book. A little preparation avoids stressful surprises on exam day.

EC-Council offers live online and on-demand courses through iClass, and it delivers the CEH knowledge exam online through its exam portal. INE’s training and eJPT exam run on its platform. OffSec’s PEN-200 is self-paced with a virtual lab, and the OSCP exam is proctored. PNPT is the most relaxed: TCM says you complete it at home with no proctor or installed monitoring software. For Security+ and PenTest+, check CompTIA’s exam pages for current test-center and online options.

If you test from home, check your webcam, internet connection, and ID requirements well before exam day. A quiet room matters more than most people expect. In every case, the certification body (EC-Council, CompTIA, INE, TCM, OffSec) issues the credential, not whoever taught you the material.

Exam fees are only part of the picture, so this section shows what a few realistic routes actually add up to. We’ve built three sample routes from the list prices above. Your own total will depend on your study materials, any retakes, and whether an employer helps pay. Use these as a starting budget, not a quote.

Add roughly $1,650 to $1,750 if you want OSCP on top of any route, plus $399 if you need Network+. A hands-on route of Security+, eJPT, and OSCP comes to roughly $2,340 to $2,440. Totals exclude taxes, retakes, and renewals.

A few things add up quietly:

• Retakes: a failed attempt means paying again on most exams, although eJPT and PNPT each include one free retake.

• Practice tests: official practice products often run $100 to $150.

• Version changes: a voucher bought for a retiring exam version may not transfer.

• Renewals: Security+ and PenTest+ renew every three years, and CEH needs continuing-education credits plus an annual fee.

To spend less, ask your employer to reimburse exam fees, use the free official exam objectives, and buy vouchers close to your test date.

The right route for you depends mostly on where you’re starting. A career switcher, a help desk veteran, and a developer can all end up in the same job via very different paths. Use the table below as a starting point, then adjust based on what your target employers ask for. If you’re unsure, the ten-job-posts test at the end of this section will settle it.

If you want the single best ethical hacker certification for beginners, it’s the Security+ and eJPT pairing. The “best” pick for jobs later depends on what your target employers write in their postings. Copy ten listings into a spreadsheet and count which certifications repeat. That tells you more than any ranking can.

A certificate gets you the interview. Your proof gets you the job. The good news is that you can build that proof while you study, using free tools and a little discipline. A small portfolio also gives you real answers to the classic interview question: “Tell me about something you’ve broken into.”

• Build a home lab: Kali Linux plus a few deliberately vulnerable machines gives you a safe place to practice.

• Write up what you learn: A short post on how you solved a machine shows how you think.

• Produce one sample report: Clients pay for the report, and PenTest+ tests it directly.

• Try bug bounty programs: A bug bounty pays researchers for responsibly disclosed vulnerabilities, so it’s real practice with real stakes. Read each program’s scope carefully first.

Common mistakes to avoid

Most delays in this career come from a handful of avoidable choices. They show up again and again, and almost all of them cost either money or months. Knowing them in advance puts you ahead of most people on the same path. Here’s the short list.

• Collecting several entry-level certifications before applying anywhere.

• Studying from material for the wrong exam version. Check the exam code before you buy.

• Treating CEH as the finish line instead of the starting line.

• Jumping to OSCP before you have the basics.

• Skipping report writing, which is half of the real job.

Exams reward structure, and plenty of people learn faster with a live instructor than with a stack of videos. JanBask Training’s cybersecurity programs are built around live, online, instructor-led classes, plus a 4-week job assistance program with resume and interview preparation. Here’s how each program lines up with the stages in this guide.

A few honest notes. JanBask’s training builds your knowledge, but the CEH credential itself comes from EC-Council, so you’ll still need to register for and pass the exam. eJPT, PNPT, and OSCP are lab exams you’ll also need to practice for on your own. JanBask’s Security+ course currently references the SY0-701 objectives, so ask your advisor which version your batch prepares you for, since V8 (SY0-801) is scheduled for November 17, 2026. Not sure where to start? A free career counseling session can map your background and budget to the right first step.

The path is shorter than the long lists make it look. Security+ opens the first door, eJPT shows you can do the work, and one professional certification (CEH, PNPT, PenTest+, or OSCP) signals where you’re headed. Exam versions are shifting this year, so match your study materials to the exam code and your timeline will thank you. Beyond the exams, a lab, a few write-ups, and clear communication do the rest.