How Hard Is the OSCP? An Honest Look for Beginners

    The OSCP+ is hard and passable. Here's what makes it hard according to OffSec's own rules, who it suits, and how to test where you stand before you book the exam.

    By Hacker Blueprint··Updated ·14 min read

    The short answer

    The OSCP® is hard, and it is passable. The OSCP+™ (OSCP Plus) exam gives you 23 hours and 45 minutes under a proctor to compromise three standalone machines and a three-machine Active Directory set, with no hints from OffSec, and then 24 hours to write a professional report. A machine without the right proof screenshot scores zero, however well you hacked it.

    It is also an entry-level exam for penetration testing. OffSec sets no formal prerequisites, the exam is open book (AI chatbots excepted), and partial results still score points. Most people who struggle know the individual techniques. The hard part is running them together on machines you've never seen, for a full day, while documenting everything to a strict standard.

    If you're new to IT, the exam is a later step, and the path starts with free foundations. If you've been practicing for a while, a timed Active Directory chain will tell you more about your chances than any pass-rate figure you find online.

    We're Hacker Blueprint. Our instructor holds the OSCP, our academy has more than 600 students, and around 7,000 people have claimed our prep materials. Below is how we answer the question, with OffSec's own rules as the evidence.

    Our instructor's OSCP story

    Our instructor holds the OSCP, and called it "Cybersecurity's Most DIFFICULT Beginner Exam" in the title of this video. That phrase sums up this post: it's a beginner exam for the pentesting field, with a high bar. In the video they talk through why they got into ethical hacking, their preparation plan, their lab experience, exam day and reporting. Three chapters are worth jumping to: lab experience and weaknesses at 2:31, exam day and methodology at 4:22, and reporting and tips for passing at 6:36.

    For a direct answer to "am I ready?", watch When Are You Ready for the OSCP? (2026 Guide). The chapters on assessing exam readiness (1:13) and the technical methodology check (4:23) pair well with the self-check below.

    What makes the OSCP+ exam hard

    The difficulty comes from the format as much as from the machines. Every row below comes from OffSec's exam guide, exam FAQ or scaled scoring FAQ.

    What makes it hard What OffSec's rules say
    One long sitting 23 hours 45 minutes of hacking, then 24 hours to upload the report
    Proctored Every OSCP+ exam is proctored
    No hints Support helps with technical problems only, and asking for hints online breaks OffSec's academic policy
    The AD set Three machines from one domain login, and pivoting may be required
    Proof rules No valid proof screenshot means zero points for that machine
    A final report Once you submit it, the submission is final
    Tool limits Metasploit on one target only; automatic exploitation tools and AI chatbots banned
    No visible pass line From Dec 1, 2026, a scaled score of 400 passes, and the raw points needed vary by set

    Documentation is the row people underrate. OffSec's exam-prep article for the OSCP+ weights five skill domains, and documenting findings carries the most: 33%, ahead of Active Directory at 26%, escalating privileges at 18%, identifying vulnerabilities at 12% and exploiting systems at 11%. You earn points only for objectives you prove and write up, so a flag you didn't screenshot to the rules counts for nothing.

    The Active Directory set is the other big one. You start it with a domain username and password (an assumed breach), and its three machines are worth 10, 10 and 20 raw points, the largest block on the exam. If you're hoping to pass while skipping it, our post on passing the OSCP+ without Active Directory runs the numbers. When our students fail the AD set, they usually know the headline attacks. What catches them is pivoting, relaying and coercion, credentials stored in unusual places, skipping a fresh round of enumeration after each new login, or a topic they were sure wouldn't come up. Our guide to the OSCP+ Active Directory set goes through each one.

    The clock is less brutal than it sounds. OffSec expects you to take breaks, eat and sleep during the exam, and its prep guide is blunt about the time: "There is more than enough time to finish the exam. If you need to work for 24 hours, you need more preparation." The exam is also open book. Your notes, online resources and the OffSec Learning Platform are all allowed. What you can't do is use an AI chatbot or ask anyone online for hints.

    Is the OSCP for beginners?

    It's an entry-level exam for penetration testing, and it assumes you already know IT.

    On paper, anyone can sit it. OffSec's exam guide says the OSCP is "awarded without prerequisites to individuals who pass a performance test". PEN-200, OffSec's course for the exam, has no formal prerequisites either. OffSec does strongly recommend a solid understanding of TCP/IP networking, reasonable Windows and Linux administration experience, and familiarity with basic Bash or Python scripting. In practice, treat that list as the entry requirement. No other certification is required first, and our post on taking the eJPT or Security+ before the OSCP covers when a warm-up exam is worth it.

    How hard the OSCP feels depends mostly on where you start:

    Your background What will feel hardest Where to start
    New to IT Linux, networking and Windows all at once Free beginner learning paths
    IT or sysadmin, new to hacking Finding a way in and exploiting it Free 2-hour OSCP course
    CTF or Hack The Box regular The AD set, the report and the 24-hour format Free AD chains on a timer
    Studying PEN-200 now Stamina, documentation and unfamiliar sets OSCP exam tips

    Be honest with yourself about the first row. If a terminal still slows you down, you'd be learning the basics and the exam material at once.

    If that's you, start with our free Hacking 101 playlist: Linux, a Kali lab, Burp Suite, and recon and exploit basics.

    Can you pass the OSCP with no experience?

    You don't need hacking experience, and OffSec sets no prerequisites. You do need IT foundations. With none at all, booking the exam now means paying for an attempt before you have the skills it tests.

    OffSec's own numbers give a sense of scale. Its two PEN-200 learning plans add up to roughly 250 hours: about 20 hours a week over 12 weeks, or about 10 a week over 24 weeks. Both assume you already have the networking, Linux, Windows and scripting basics. If you don't, that groundwork comes first, and it's the part you can do for free.

    A path that costs nothing to start:

    1. Work through our free beginner learning paths: Linux for Hackers, Networking Fundamentals, VM Lab Setup, Python for Hacking and Offensive Cyber Intro, which includes your first hands-on attack lab.
    2. Follow Phase 1 of our OSCP+ roadmap. It ends with a checkpoint that tells you when you're ready to move on to standalone machines.
    3. Watch our free 2-hour OSCP course to see the whole exam skill set in one sitting, then start practicing machines with the walkthrough closed.

    Don't book the exam to find out where you stand. The attempt is the expensive part, and our OSCP cost breakdown shows what retakes add on top.

    What is the OSCP pass rate?

    OffSec doesn't publish an OSCP pass rate. Its exam FAQ says: "We do not release the number of people who hold our certifications or the success rate of completing them. The exam-taking experience and perceived difficulty are different for everyone and we don't want to needlessly discourage or encourage learners with numbers based on success or failure."

    The closest OffSec comes is a headcount without a rate: its October 2026 exam guide says it has helped "tens of thousands of security professionals earn their OSCP" since 2006, with no figure for how many attempted.

    So any first-attempt percentage you see on Reddit or a blog is somebody's estimate, built from whoever chose to post about their result. Don't plan around it.

    OffSec is open about failure happening. Its PEN-200 page says it plainly: "Not everyone passes on the first try." The retake policy builds that in. After one failed attempt you wait 4 weeks to retake, after two you wait 8 weeks, and after three or more you wait 12. If you need the certification by a fixed date, such as a job start, leave room for one retake.

    Is the OSCP+ harder in 2027?

    OffSec says no. OSCP+ exams that start on or after December 1, 2026 at 08:00 GMT use equated scaled scoring: your raw points convert to a score from 100 to 500, and 400 passes. Asked whether that makes the exam easier or harder, OffSec's scaled scoring FAQ answers: "Neither. The level of skill needed to earn OSCP+ will be the same as it is today."

    Three things will still feel different in 2027:

    • You can't count your way to a pass. The raw points you need depend on your exam set, so you work every machine until the end and always submit the report.
    • OffSec says exam sets "can now differ more in their scenarios", which makes skipping parts of the PEN-200 syllabus a bigger gamble.
    • There are no bonus points. OffSec removed them on November 1, 2024, so course exercises add nothing to your exam score.

    We're neutral on the change. We've coached students who kept drawing very hard sets, and a fixed 70-point bar kept them from passing despite knowing the material. Equating is built to account for differences between sets. It's also less transparent, since you can't tell from your own points where you stand. Our full breakdown is in OSCP+ scaled scoring explained.

    How hard is the OSCP compared with CPTS or PNPT?

    The three exams are built differently, so a single "harder or easier" ranking hides more than it shows. The OSCP+ is one proctored sitting of 23 hours and 45 minutes, with the report due within 24 hours. Hack The Box keeps the CPTS exam lab open for 10 days, and you submit flags along with a commercial-grade report. TCM Security gives PNPT candidates five full days for the assessment and two more for the report, followed by a live 15-minute debrief with its assessors. If working against the clock is your weak spot, plan for it: the OSCP+ has the shortest window of the three. Our OSCP vs CPTS post compares the exams side by side, along with PNPT, CEH and OSEP.

    How to tell if you're ready for the OSCP

    OffSec suggests "at minimum completing the course labs and exploiting the challenge labs", which it says "will give you the bare skills needed to pass the exam." Treat that as the floor.

    For a self-check, you're close when most of these are true:

    • You can explain every open port in a scan result and what's worth checking on each service.
    • You can get a foothold on an unfamiliar Linux machine and an unfamiliar Windows machine without a walkthrough.
    • You can explain why a privilege escalation path exists, beyond which tool flagged it.
    • You can fix a public exploit that doesn't run as written.
    • You can take an AD environment from one low-privilege domain login to domain admin, including a host you can only reach through a machine you've compromised.
    • When you're stuck, your notes tell you what to try next.
    • You can write up a machine so a stranger could repeat every step, with proof screenshots that meet OffSec's rules.
    • You've worked a full day on machines, with planned breaks, and still thought clearly at the end.

    Then test yourself under exam conditions:

    1. Run a free AD chain cold. Pick one of our free AD chains and set a four-hour timer, the time OffSec's prep guide suggests for the AD set. Keep the walkthrough closed, take proof screenshots to exam standard, and write each machine's report section before you look at any solution.
    2. Take the quizzes. Prove You're OSCP Ready (The Ultimate OSCP Scenario Quiz) has 13 exam-style questions in three stages (initial access and enumeration, web and service exploitation, privilege escalation to root), each with a reveal and a diagram of the attack path. The Brutally Honest OSCP Quiz works through an Active Directory scenario, from reading a port scan to dumping secrets. More are in our PenTesting Quiz playlist. Pause before every answer and commit to it.
    3. If you have PEN-200, sit a mock exam. OSCP A, B and C are retired exam sets, and both of OffSec's learning plans end with a full attempt at one of them in under 24 hours.

    If the chain stalls in the same place twice, that's your next study topic. If you can run it cleanly again a week later, the AD set is in good shape.

    How to make the OSCP easier to pass

    The exam stays the same. What you can change is how familiar it feels on the day.

    • Build a methodology, then a checklist. After every practice machine, add the step you missed, so that on exam day the checklist shows what you haven't tried yet.
    • Start Active Directory early. It's the biggest block of raw points and builds on everything else. Practice full chains from a single domain login, the way the exam starts.
    • Practice the report. Write one for every mock exam within 24 hours, in the template you plan to use on exam day. OffSec weights documentation more than any other domain.
    • Rehearse exam day. Run at least one full-length attempt with breaks and sleep planned in. Our OSCP exam tips include a sample 24-hour timeline.
    • Learn the rules before you build habits. Practice without the banned tools from the start. The full list is in OSCP+ allowed and banned tools.

    The whole plan, phase by phase, is in our OSCP+ roadmap. If you want the method laid out for you, our course for OSCP prep covers exam tactics, Active Directory, initial access, privilege escalation, pivoting and tunneling, and reporting. It's preparation for the exam, which you book with OffSec, and you can start with a free trial.

    FAQ

    Is the OSCP hard to pass?

    Yes. It's a 23-hour-45-minute proctored practical exam with strict proof and report rules, no hints, and no published pass rate. With OffSec's recommended foundations and steady practice it's very passable, and partial results still count.

    Is the OSCP good for beginners?

    It's an entry-level penetration testing certification with no formal prerequisites. OffSec strongly recommends TCP/IP networking, Windows and Linux administration, and basic Bash or Python first, so complete IT beginners should build those skills before starting.

    Can I pass the OSCP with no experience?

    You don't need hacking experience. You do need IT foundations: Linux, Windows, networking and basic scripting. OffSec's PEN-200 learning plans add up to roughly 250 hours and assume you already have those basics.

    What is the OSCP pass rate?

    OffSec doesn't publish an OSCP pass rate. Its exam FAQ says it doesn't want to "needlessly discourage or encourage learners" with pass or fail numbers, so any percentage you see online is an estimate.

    What is the OSCP passing score?

    For exams taken through November 30, 2026, you need 70 of 100 points. From December 1, 2026, OffSec uses scaled scoring instead: your raw points convert to a score from 100 to 500, and 400 passes. Our guide to OSCP+ scaled scoring explains why the raw points behind a 400 vary by exam set.

    Is the OSCP open book?

    Yes. OffSec allows your notes, the OffSec Learning Platform and online resources that comply with the exam rules, all used on the machine running the proctoring software. AI chatbots, including OffSec's own KAI, are banned during the exam and the report, and our guide to what the open-book rule allows covers the rest.

    How hard are OSCP A, B and C compared with the exam?

    They're the closest official preview. OffSec's learning plans call them retired OSCP exams, the PEN-200 page says three challenge labs are "designed to closely replicate the OSCP+ exam environment", and each of the three includes an AD set. Both learning plans end with a full attempt at one of them in under 24 hours.

    Find your starting point

    If the basics are new to you, start with the free beginner learning paths and Phase 1 of the OSCP+ roadmap. If you're further along, run one of our free AD chains on a four-hour timer this week and note where it stalls.

    Ahmad Salem, one of our students, wrote: "I took my exam today, honestly this course covers the main stuff you need. You must know that there is no golden ticket to pass the OSCP, you have to put effort, develop a methodology and do LOTS of practice. I do not think I would have passed if it wasn't for Hacker Blueprint." (More reviews)

    Try our 30+ hour course for OSCP prep with a free trial, or start with one of our free Active Directory chains.

    Not sure where you stand? Ask in the Hacker Blueprint Discord.

    Sources

    Keep reading

    Hacker Blueprint

    Hands-on certification prep, trusted by certified hackers around the world.

    Want new labs and discount codes first?

    We'll email you when a new lab drops or a sale goes live.

    Your email is safe with us. We don't spam.

    © 2026 Hacker Blueprint. All rights reserved.

    Built for hackers, by hackers.

    OSCP® and OSCP+™ are trademarks of OffSec. Hacker Blueprint is an independent training provider and is not affiliated with, endorsed by, or sponsored by OffSec. All content is our own original material and contains no OffSec course, lab, or exam content. Individual results vary: passing any exam depends on your own study and practice. * Lifetime access and lifetime updates run for as long as Hacker Blueprint operates, with no renewal and no extra charge.