Penetration Tester Certification Guide: Best Certs & Order (2026)

A pen tester is hired to break into a company's systems, with permission, before a real attacker does. You scan networks, test web apps, try to get in, and then write a report that tells the company how to fix what you found. The report matters as much as the hack.

Certification exams fall into two groups:

• Knowledge exams - You answer multiple-choice questions about tools, attacks, and rules. Security+ and CEH work this way. PenTest+ is mostly knowledge, with a few hands-on tasks mixed in.

• Hands-on exams - You get a lab network and a clock, and you have to break in. eJPT, OSCP, and CEH Practical work this way.

Why does this matter? A knowledge exam shows you know the terms and the rules. A hands-on exam shows you can do the work. Hiring filters often look for a familiar name like CEH. Technical managers often trust the hands-on exams more. Over time, most testers earn one of each.

No law says you must have one. Even the word "licensed" in LPT is just a badge name from a company. It is not a government license.

Still, a certification helps most early in your career, when you have no pen testing jobs to point to. It gives a hiring manager a quick reason to say yes to an interview. Later, your work history and your skills do most of the talking.

Pay varies a lot with experience. The Bureau of Labor Statistics counts pen testers inside the information security analyst group, which had a median pay of $129,180 in May 2025. EC-Council's page quotes 2026 Payscale numbers for pen testers: about $72,800 at the start, about $96,400 on average, and up to about $142,200 for the most experienced.

AI now shows up in pen testing in two ways. Testers use AI tools to work faster. And testers have to attack AI systems, which is a new kind of target.

The main exams have started to reflect this. EC-Council sells CEH v13 (exam code 312-50) as an AI-powered version of its course. CompTIA's PenTest+ (PT0-003) now tests you on AI attacks, such as prompt injection and model manipulation. SANS also lists a course on testing AI systems, called SEC536.

Right now, the AI parts sit inside the main exams instead of in a separate certificate you must have. So the smart move is simple: study for the current version of the exam you pick, and you'll pick up the AI material along the way.

This table puts every certification in the order most testers take them. The levels are rough guides, not rules. A dash means the provider has no standard exam code. OffSec codes are course codes that lead to the exam.

A few dates can change which exam you should sit for:

• Security+: SY0-701 is the current exam. CompTIA expects the next version, SY0-801, on November 17, 2026. Always match your study material to the exam code you will take.
  Tip: If you take SY0-701 before it retires on June 11, 2027 (English), your credential has the same three-year validity as a SY0-801 pass. Either way you hold Security+, so pick the version that fits your study timeline.

• PenTest+: PT0-003 launched on December 17, 2024. CompTIA usually retires a version about three years after launch, so a new one may arrive around 2027.

• CompTIA prices: they went up on June 1, 2026. Security+ and PenTest+ are now $439, and Network+ is $399.

• ISC2 CC: the free program ended on May 20, 2026. The exam now costs $199, plus $50 a year.

• OSCP: passing PEN-200 now earns two credentials. OSCP never expires. OSCP+ lasts three years and can be renewed.

• CEH: the current version is v13 (exam code 312-50).

If you're new to IT, build the basics first. Pen testers spend their days inside networks, so you need to know how traffic moves.

CompTIA Network+ (N10-009, $399) teaches that. Skip it if you already work in network support or admin. ISC2 CC costs $199 plus $50 a year. It's a gentle first exam, but most pen testers skip it. EC-Council CCT (212-82) is an entry exam with a hands-on part. It makes the most sense if you plan to follow the EC-Council's ladder toward CEH.

These same starter certifications also help SOC and GRC careers. We cover them in more detail in our SOC analyst certification guide and our GRC analyst certification guide.

CompTIA Security+ (SY0-701, $439) is the one almost every path starts with. It's a knowledge exam that covers security basics, threats, and rules. CompTIA itself recommends Network+ and Security+ (or the same knowledge) before PenTest+. So this exam keeps doors open later.

INE eJPT is the best junior penetration tester certification to start with. It's built for people with little or no security experience, and it's hands-on. INE's own page says the exam simulates real-world work. You scan targets, find weak spots, break in with tools like Metasploit, and test a web app. About a third of the exam is host and network testing.

Here is how it works. You need an INE subscription and an exam voucher, and INE sells bundles that include both. The voucher is good for 180 days. If you fail, you get one free retake, and you must take it within 14 days. Results come back within a few hours, and a pass lasts three years.

Two optional exams sit at this level. EC-Council CND (312-38) is built for defenders, and ISC2 SSCP ($249) is a systems security exam. Most pen testers skip both.

This is where most people ask which of the top penetration testing certifications to pick. Three names come up again and again. Here they are side by side.

1. PenTest+ (PT0-003)
Many lists call it a beginner exam, but CompTIA recommends 3–4 years in a pen tester role. You can still pass it sooner with good study. Most of the exam is about attacks and exploits (35%), followed by recon (21%) and finding weak spots (17%). Planning, legal rules, and report writing make up the rest.

2. CEH (312-50)
It's the name most hiring filters know, which is why it shows up in so many job posts. It's a knowledge exam, though, so pair it with something hands-on. EC-Council asks for two years of security work or its official training before you test.

3. OSCP (PEN-200)
This one has no formal prerequisites, but it's tough for beginners. That's why we suggest eJPT first. Passing earns you both OSCP and OSCP+. Prices differ between sources, so check OffSec's page for today's number.

Two more options live here. INE eCPPT is the natural next step after eJPT. ISC2 CSSLP fits testers who focus on application security.

Working with or for the US government? 

DoD’s workforce rules now sit in DoDM 8140.03, which replaced the older 8570 manual and applies to service members, civilian employees, and contractors. It qualifies people by work role, and certifications must be accredited to ISO/IEC 17024. Three certifications in this guide are tied to DoD work roles: Security+ (CompTIA lists DoD 8140 roles such as cyber defense analyst and vulnerability analyst), PenTest+ (CompTIA says it’s approved for DoD 8140/8570.01-M), and CEH (EC-Council lists roles such as Cyber Defense Analyst and Vulnerability Assessment Analyst). Requirements vary by position, so check which certification your target role lists.

Most readers won't need these for a few years. Here is what they're for.

• EC-Council CEH Practical - A 6-hour hands-on exam with 20 challenges, priced around $550. Pass it on top of CEH and EC-Council awards you the CEH Master title.

• OffSec OSEP (PEN-300) - A 48-hour exam about getting past a company's defenses.

• INE eWPTX - A deep web application test for people who work mostly on websites.

• CompTIA SecurityX (CAS-005) - An advanced knowledge exam that looks at security design, not just attacks.

• ISC2 CCSP - A cloud security exam, at $599 plus $135 a year.

• EC-Council LPT - The top EC-Council badge. You earn it by scoring 90% or higher on its hardest hands-on exam.

• OffSec OSWE (WEB-300) and OSED (EXP-301) - These go deep on web attacks and on writing exploits.

• ISC2 CISSP - It costs $749 plus $135 a year and asks for five years of experience. It suits you when you move toward leading a security team.

There's no single best penetration tester certification. The right one depends on what you want it to do. Use this table.

A simple test works well. Open ten pen tester job posts in your area. Count which certifications they name, and plan around the winners.

Penetration tester certification cost: four paths

Here are four common paths and what the exams add up to. Totals are exam fees only.

A few costs sit outside those totals. Add $399 if you also need Network+. Add training and study materials, plus the INE plan that eJPT requires. Add the $100 CEH application fee if you skip official training. And plan for renewals: CEH needs 120 credits every three years plus $80 a year, and ISC2 CC costs $50 a year.

A certificate gets the interview. Your proof gets you the job. Here is how to build it while you study:

• Set up a home lab - Use Kali Linux and practice with tools like Nmap, Burp Suite, and Metasploit.

• Practice on legal targets - Sites like Hack The Box, TryHackMe, and Vulnhub give you safe machines to break into.

• Write up what you learn - A short post on how you solved a machine shows how you think.

• Write one sample report - Reporting is part of every pen test, and PenTest+ tests it directly. A clean sample report sets you apart.

• Try CTFs or bug bounties - Both give you real practice under a little pressure.

• Stopping at CEH - It's a knowledge exam. Add something hands-on so you can show you can do the work.

• Jumping to OSCP too soon - Build the basics with Security+ and eJPT first.

• Studying for the wrong version - Check the exam code (like SY0-701 or PT0-003) before you buy study material.

• Skipping report writing - Clients pay for the report, so practice it.

• Using exam dumps - Leaked questions teach you nothing, and they can cost you your certification.

JanBask Training's courses build your base and get you ready for the knowledge side. Here's where each one helps.

One honest note: these courses build your knowledge, but eJPT and OSCP are lab exams. Plan on practicing in your own lab too. You book each exam with its provider, such as EC-Council or CompTIA.

Keep the order simple. Start with Security+ (SY0-701). Add eJPT for your first hands-on proof. Then choose PenTest+ (PT0-003), CEH (312-50), or OSCP (PEN-200) based on the jobs you want. Build your lab and your sample report as you go.

If you'd like guided help with the knowledge side, look at our CEH training or the Cyber Security Master program. Pick the exam that matches your next job, and take it one step at a time.