OSCP+ Roadmap 2027: How to Prepare From Scratch to Exam Day

The short answer

To prepare for the OSCP+^™ in 2027, follow a study path of five phases, in order: foundations (Linux, networking, Windows and basic scripting), a methodology for standalone machines, Active Directory with pivoting, OffSec's PEN-200 course with full mock exams, and exam-day preparation. Expect it to take months, and move on to the next phase once you can pass the checkpoint at the end of the one you're in.

The big change for 2027 is how you pass. Every OSCP+ exam that starts on or after December 1, 2026 at 08:00 GMT uses scaled scoring: your raw points are converted to a score from 100 to 500, and 400 passes. The conversion differs by exam set, so the old plan of "AD set plus three local.txt flags makes 70" is no longer something you can aim for. If you searched for an OSCP^® roadmap or OSCP path for 2026, the plan is the same.

The phase people underestimate is Active Directory, worth 40 of the 100 raw points. Phase 3 covers where candidates lose those points.

We're Hacker Blueprint. Our instructor holds the OSCP, our academy has more than 600 students, and around 7,000 people have claimed our prep materials. This roadmap puts our free material in the order we'd study it, so you can start today without buying anything.

Video: the exam rules and study plan in 16 minutes

The Only OSCP Guide You'll Ever Need! (2026) covers how the exam works and how to study for it. Useful chapters: documentation requirements at 1:05, exam and tool restrictions from 3:55, OffSec's official learning plans at 7:16, recommended practice labs at 8:26 and a skills checklist at 9:42. It went up in December 2025, before OffSec announced scaled scoring, so for the pass mark go by our scaled scoring guide.

The OSCP+ roadmap at a glance

The phases overlap. Keep doing practice machines from phase 2 onward, and start taking notes on day one: the notes you write in phase 1 grow into the checklist you use on exam day.

What changes for OSCP+ candidates in 2027

The exam itself stays the same: OffSec says the format, time limits, proctoring, rules and report deadline are unchanged. Four rules shape a 2027 study plan:

Scaled scoring. Your raw points (10 for initial access and 10 for privilege escalation on each standalone, then 10, 10 and 20 on the AD set) go through a conversion specific to your exam set. On a harder set you may pass with fewer than 70 raw points; on an easier one you may need more. OffSec also says the new system lets exam sets "differ more in their scenarios", which makes skipping parts of the syllabus a bigger gamble than it used to be. Every attempt you sit in 2027, retakes included, is scored this way. Our full breakdown and team view are in OSCP+ scaled scoring explained.

Expiry. OffSec offers three ways to keep the "+": pass a recertification exam in the six months before it expires, pass another qualifying OffSec certification such as OSEP or OSWA, or complete its CPE program. If you let it lapse, you still hold the OSCP. Our OSCP vs OSCP+ post covers each renewal route and how to list both.

AI. OffSec's exam FAQ bans KAI and any other chatbot during the exam and the reporting phase. If AI has crept into how you study, do your mock exams and practice reports without it.

Phase 1: Build the foundations PEN-200 assumes

PEN-200 has no formal prerequisites. OffSec does strongly recommend a solid understanding of TCP/IP networking, reasonable Windows and Linux administration experience, and familiarity with basic Bash or Python scripting. Skip this phase and you end up learning what a subnet is on paid lab time.

No certification is required before PEN-200 either. If you're weighing a first step such as the eJPT or Security+, our guide on taking the eJPT before the OSCP covers when one helps and when it doesn't.

At the skill level, phase 1 means you can:

• Work in a Linux shell without looking things up: files and permissions, users, processes, services, scheduled jobs, SSH.
• Read a port scan, know what each common service does, and know enough subnetting and routing to see why a host is unreachable.
• Find your way around Windows as an admin: users and groups, services, the registry, scheduled tasks and basic PowerShell.
• Read a short Python or Bash script and change it with confidence. Public exploits often need edits before they run.
• Build your own lab: a Kali VM, a couple of targets, and snapshots you can roll back to.

Our free beginner learning paths cover this ground in order: Linux for Hackers, Networking Fundamentals, VM Lab Setup, Python for Hacking, and an Offensive Cyber Intro with your first hands-on attack lab. If you want the overview first, our six-minute OSCP roadmap for beginners walks through the same order: Linux, networking, then hacking.

On YouTube, our Hacking 101 playlist adds free videos on Linux, a Kali and VirtualBox lab, Burp Suite, and recon and exploit basics.

Start your notes now, in a tool you'll keep using, such as Obsidian or CherryTree, with one page per service or technique. The OSCP+ is open book (AI chatbots excepted), and searching your own notes at hour 16 is faster than searching the internet. Our OSCP note-taking guide shows a structure that works and compares Obsidian, CherryTree and Notion.

You're ready for phase 2 when you can set up a small VM network from scratch, explain every open port in a scan result, and edit a script without guessing what each line does.

Phase 2: Learn a methodology for standalone machines

Three of the exam's four targets are standalone machines, each worth 10 raw points for initial access and 10 for privilege escalation. This phase turns a pile of techniques into a routine you run on every box.

The topics come straight from the PEN-200 syllabus:

• Information gathering and enumeration of every open service
• Web attacks: SQL injection, command injection, directory traversal, file uploads, XSS
• Finding public exploits and fixing them so they run
• Password attacks and client-side attacks
• Linux and Windows privilege escalation
• Transferring files, catching shells and keeping them stable

Practice under exam rules from the start. Automated exploitation tools such as sqlmap and mass vulnerability scanners such as Nessus are banned on the exam, and Metasploit is limited to a single target, so learn the manual route first. A habit you build in month two is hard to drop in month five.

Three study habits make this phase stick:

1. Give each machine a fixed block of time before you open a hint or walkthrough, and stick to it.
2. After every box, add the step you missed to your checklist. This is how your notes become a methodology.
3. Alternate Linux and Windows machines. Most people are stronger on one, and the weaker one is where the exam takes points from you.

For practice machines, the PEN-200 labs, OffSec's Proving Grounds, Hack The Box and TryHackMe all have OSCP-style boxes. From us:

• Our free 2-hour OSCP course shows the whole exam skill set in one sitting: initial access, privilege escalation, pivoting and Active Directory, ending with exam tips. The video on YouTube has more than 128,000 views. Watch it early in this phase to see where everything fits.
• The OSCP Exam Prep Guide playlist has more than 170 videos, including OSCP Exam Initial Access (Complete Course) and OSCP Privilege Escalation Complete Course (2026).
• The My Pentesting Methodology playlist shows how we approach initial access and Linux privilege escalation on any machine, and Most Common OSCP Attacks takes one technique per video.

You're ready for phase 3 when you can root an unfamiliar Linux machine and an unfamiliar Windows machine without a walkthrough, and when you get stuck, your checklist tells you what to try next.

Phase 3: Add Active Directory and pivoting

Start Active Directory once you can own a Windows machine by yourself, and well before your final weeks. The AD set is three linked machines worth 10, 10 and 20 raw points, 40 of the exam's 100 and the biggest single block. You start with a domain username and password (an assumed breach), and each machine is credited on its own.

AD builds on phase 2: the machines in the set still need a foothold, local privilege escalation and careful looting. PEN-200 covers it in three modules (Active Directory Introduction and Enumeration, Attacking Active Directory Authentication, and Lateral Movement in Active Directory). OffSec says pivoting may be required on the AD set, and that anything in the course material can appear on the exam.

What to learn, at the topic level:

• Domain enumeration with the credentials you're given, then again with every new account you get
• Kerberos attacks and offline password cracking
• Credential hunting on every machine you own
• Lateral movement with passwords, hashes and tickets
• Pivoting and tunneling through a host you've compromised
• NTLM relaying and coercion

We see five common reasons people fail the AD set: pivoting, relaying and coercion, credentials stored in unusual places, not enumerating again after getting a new user, and overconfidence that a topic won't appear on the exam. Our guide to the OSCP+ Active Directory set has the step-by-step methodology and goes through each of these.

Practice full chains from a single set of domain credentials, the way the exam starts. Our free AD chains are built for exactly that: each one is two Windows clients and a domain controller that you run on your own machine, starting from an assumed breach. A home domain needs more memory than Kali alone, so check what computer an Active Directory lab needs before you download one. Our free OSCP labs guide shows how to run them under exam conditions. If AD is new to you, start with our free Hacking Active Directory Course for Beginners, over five hours long, and use Ligolo-NG Makes OSCP Pivoting EASY to get comfortable with tunneling.

Our Hacking Active Directory playlist covers these topics on video, from a 5+ hour beginners course to BloodHound and certificate attacks, and the Pivoting and Network Tunneling playlist covers Ligolo-ng and Chisel.

You're ready for phase 4 when you can take a chain from one domain credential to domain admin without a walkthrough, tunnel included, and do it again a week later just as cleanly.

Phase 4: Test yourself with PEN-200 and full mock exams

PEN-200 is OffSec's course for the exam: more than 20 modules with hands-on labs, then nine challenge labs. Three of them, OSCP A, B and C, are retired exam sets designed to closely replicate the exam environment. OffSec's own readiness advice is to complete the course labs and exploit the challenge labs, at minimum.

On offsec.com, as of October 29, 2026, the Course + Cert Bundle is $1,749 for 90 days of access and one exam attempt, Learn One is $2,749 a year with two attempts, and the exam on its own is $1,699. With $50 between the exam alone and the bundle, the course and its challenge labs cost very little extra once you've decided to sit the exam. With 90 days of access, arrive with phase 1 done and much of phase 2 behind you.

Treat OSCP A, B and C as mock exams. OffSec's 12-week and 24-week PEN-200 learning plans both end the same way: attempt one of them in under 24 hours. Run at least one full 23-hour-45-minute attempt under exam rules, with breaks and sleep planned in, then write the complete report within 24 hours using OffSec's report template. Points only count for objectives documented in the report, and it has to go in as a PDF inside a .7z archive, so the report deserves the same practice as the hacking. Our short video OSCP Exam - How to Write the Report covers the basics.

Between mocks, the quizzes in our PenTesting Quiz playlist are a quick way to test yourself.

Our 30+ hour course for OSCP prep puts the exam skills from phases 2 to 5 in one place, with modules on exam tactics, Active Directory with custom labs, initial access, privilege escalation, pivoting and tunneling, and reporting. There's a free trial, so you can check it fits before paying. If you'd rather not build your checklist from scratch, our OSCP notes are copy-paste methodology in CherryTree and Markdown, which opens in Obsidian.

You're ready to book when you've finished at least one full-length mock under exam rules, written a complete report for it, and know which kinds of machines still slow you down.

Phase 5: Book the exam and plan exam day

Book the date you're ready for. The exam is proctored and runs 23 hours and 45 minutes, and you get another 24 hours to upload the report. Before the day, read how OSCP+ exam proctoring works, from the system test and ID check to breaks and disconnects.

Under scaled scoring, OffSec's guidance comes down to four habits: attempt every machine, submit every flag in the control panel, document everything to the exam guide's standard, and always submit the report, because you can't tell from your raw points whether you passed. A machine without a proof screenshot scores zero. The exam guide also expects you to take breaks, eat and sleep, so decide in advance when you'll stop.

Plan for retakes as well. After a first failed attempt you can retake after 4 weeks, after a second after 8 weeks, and from the third onward after 12 weeks. If you need the certification by a fixed date in 2027, such as a job start, leave room for one retake.

Our OSCP exam tips cover the 24-hour plan, proof screenshots and the report in detail. To check where you stand before booking, watch When Are You Ready for the OSCP? (2026 Guide) and try our 13-question OSCP scenario quiz.

How long OSCP+ preparation takes

There's no official answer, because it depends on where you start. A working Linux or Windows admin can move through phase 1 quickly, and a complete beginner needs all of it.

OffSec does publish a number for the course itself. Its two PEN-200 learning plans both add up to roughly 250 hours: about 20 hours a week over 12 weeks, or about 10 a week over 24 weeks, with a week off built into the longer plan. Both assume you already have the phase 1 foundations, and both end with a 24-hour attempt at OSCP A, B or C. Use either one as an OSCP study plan for phase 4.

OffSec doesn't publish pass rates, so any first-attempt percentage you read online is somebody's estimate.

We cover the question in a short video, How Long Does It Actually Take to Pass the OSCP? After that, track progress by the checkpoint at the end of each phase. It tells you more than the calendar does.

FAQ

How do I prepare for the OSCP+ from scratch?

Start with the foundations OffSec recommends before PEN-200: TCP/IP networking, Linux and Windows administration, and basic Bash or Python. Then learn a standalone methodology, add Active Directory and pivoting, and finish with PEN-200's challenge labs and full mock exams. Our free beginner learning paths cover the first step.

How long does it take to prepare for the OSCP+?

It depends on your starting point. OffSec's PEN-200 learning plans add up to roughly 250 hours for the course alone, spread over 12 or 24 weeks, and they assume you already have the basics.

What score do I need to pass the OSCP+ in 2027?

A scaled score of 400 on a range of 100 to 500. It applies to every exam that starts on or after December 1, 2026 at 08:00 GMT. The raw points you need depend on your exam set and may be more or less than 70.

Do I need PEN-200 to take the OSCP+ exam?

No. OffSec sells the exam on its own for $1,699, and the Course + Cert Bundle with 90 days of PEN-200 and one attempt costs $1,749 (offsec.com, October 29, 2026). The course includes the OSCP A, B and C challenge labs, which are retired exam sets. Every fee, including retakes and renewal, is in our OSCP cost breakdown.

What is on the OSCP syllabus?

The syllabus is OffSec's PEN-200 course, 20+ modules covering information gathering and vulnerability scanning, web attacks such as XSS, command injection and directory traversal, client-side and password attacks, antivirus evasion, Windows and Linux privilege escalation, pivoting and tunneling, Active Directory attacks and lateral movement, and AWS cloud attacks. Three of its nine challenge labs are designed to closely replicate the exam environment.

Does the OSCP+ expire?

Yes, three years after it's issued. You can renew it with a recertification exam, another qualifying OffSec certification such as OSEP or OSWA, or OffSec's CPE program. The OSCP you earn alongside it never expires.

Is the OSCP+ harder in 2027?

OffSec says the skill level needed to pass stays the same, and the format, time limits and proctoring are unchanged. What changes is how results are calculated, and OffSec says exam sets can now differ more in their scenarios. For what makes the exam hard and how to test where you stand, see how hard the OSCP is.

Pick your phase and start

Most of this roadmap costs nothing. Start the beginner learning paths if you're in phase 1, the free OSCP course in phase 2, or the free AD chains in phase 3.

Talez's advice after finally passing the OSCP: "Follow the roadmap properly like outlined in the course and you will likely be able to pass too." (More reviews)

Try our 30+ hour course for OSCP prep with a free trial, or start with one of our free Active Directory chains.

Not sure which phase you're in? Ask in the Hacker Blueprint Discord.

Sources

• OffSec: OSCP+ Exam Guide (exam structure and raw points, 23h 45m plus 24h report, proctoring, restricted tools, Metasploit rule, breaks, report format)
• OffSec: OSCP+ Exam FAQ (no bonus points, AD modules to study, pivoting, AI chatbot ban, open book, readiness advice, pass rates not published)
• OffSec: OSCP+ Equated Scaled Scoring FAQ (400 on 100 to 500, no point target, sets can differ more, format unchanged)
• OffSec: OSCP+ Scoring Update (Oct 21, 2026)
• OffSec: PEN-200 course page (prerequisites, modules and challenge labs, prices, OSCP+ expiry and renewal; checked Oct 29, 2026; syllabus topics checked Nov 3, 2026)
• OffSec: PEN-200 Learning Plan, 12 Week and 24 Week (weekly hours, final mock exam on OSCP A, B or C)
• OffSec: What is the Exam Retake Policy? (cooling-off periods)
• OffSec: Renewing OffSec Certification by Taking a Qualifying Certification Exam (OSCP+ renewal options)
• Hacker Blueprint: The Only OSCP Guide You'll Ever Need! (2026) (YouTube, Dec 23, 2025)
• Hacker Blueprint: How Long Does It Actually Take to Pass the OSCP? (YouTube, Jun 12, 2025)
• Hacker Blueprint: free 2-hour OSCP course (YouTube, May 6, 2025)
• Hacker Blueprint: OSCP roadmap for beginners (YouTube, Jun 22, 2025)