OSCP+ Scaled Scoring Explained: What Changes on December 1, 2026

The short answer

If your OSCP+^™ exam starts on or after December 1, 2026 at 08:00 GMT, "get 70 points" is no longer the rule. OffSec will convert your raw points into a scaled score between 100 and 500, and the passing score is 400.

The catch is that the conversion isn't fixed. Each exam set gets its own, based on how hard that set is. On a harder set, you might pass with fewer than 70 raw points. On an easier one, you might need more. OffSec's own advice is blunt: stop aiming for 70, or for any raw number at all.

Exams that start before that cutoff keep the old passing score: 70 out of 100 raw points.

The machines don't change, the points per flag don't change, and the 23 hours and 45 minutes don't change. What changes is the math after grading, and that changes how you should think on exam day.

We're Hacker Blueprint. Our instructor holds the OSCP^®, our academy has more than 600 students, and around 7,000 people have claimed our prep materials. Since OffSec announced the change on October 21, 2026, it's been the main question in our Discord, so here's everything we know, plus our honest take.

Prefer video? We go through OffSec's blog post and FAQ line by line in The OSCP+ Just Changed (New Scoring System) on the Hacker Blueprint YouTube channel.

How the pass decision works now

You still earn the same raw points for the same flags. The new step sits between those points and the pass mark.

The conversion is the part you can't see. OffSec sets it per exam set so that 400 represents the same standard everywhere, which is why raw points alone no longer tell you if you passed.

What changes and what stays the same

Almost everything you've been practicing for stays the same. OffSec says the exam content, objectives, format, duration, grading requirements and proctoring are untouched. Graders still review your report the same way. When we rechecked OffSec's scaled scoring FAQ and exam guide on November 3, 2026, the rules described here were unchanged.

The cutoff is the time your exam starts: December 1, 2026 at 08:00 GMT.

Two details people will miss:

• Rescheduling moves you onto the new system. If your exam was booked before the cutoff and you push it past December 1 at 08:00 GMT, it gets scaled scoring. You can't pick a method separately from your date.
• Retakes follow the date too. A retake that starts after the cutoff uses scaled scoring, even if your first attempt was scored out of 70. Retake fees and waiting periods haven't changed.

OSCP+ is the only OffSec certification switching to scaled scoring for now. Certifications already earned aren't affected.

Should you take the exam before or after December 1?

Book the date you're ready for. Don't book a date just to land on one scoring system.

OffSec says it doesn't recommend one method over the other, and the reason makes sense once you see how equating works. The whole point is that 400 means the same level of skill on every exam set. The SAT and bar exams use the same idea to keep different test forms fair.

Where the choice does matter is how you like to work under pressure:

• Before the cutoff, you know the finish line. Hit 70 confirmed points and you can stop hacking and focus on the report. Some people find that calming.
• After the cutoff, there's no finish line you can see. That pushes you to keep working every machine until the clock runs out, which is how most people should approach the exam anyway.

If you're already booked for late November and feel ready, keep it. If you're booked for late November and you're not ready, don't rush in to beat a scoring change. A failed attempt costs you a retake fee and weeks of momentum. A scaling formula costs you nothing.

Our take: probably good news, but we'll wait and see

We're neutral on this one, and here's why.

The case for it. Not every OSCP+ exam set feels equally hard. We've coached students who kept drawing sets the community considers brutal, attempt after attempt. They knew the material well, yet a fixed 70-point bar on a harder set kept their pass months away. Equated scoring is built to fix exactly that, because a 400 is supposed to mean the same level of skill on every set.

One viewer also commented on our YouTube channel that they had failed, then got a notice that their result had changed to a pass. We can't verify individual cases, but it lines up with OffSec's statement that its quality reviews can occasionally change a candidate's result, and that it contacts those candidates directly.

The case for caution. Scaled scoring is also less transparent. You can no longer count your own points and know where you stand, and OffSec hasn't published how each set converts. It's fair to ask whether pass rates go up, down, or stay flat. We'll know once a few months of results come in, and we'll update this post when they do.

Until then, the advice stays the same: prepare to score as high as you can on any set.

How to change your exam-day strategy

Your study plan can stay as it is, and if you don't have one yet, our OSCP+ roadmap for 2027 lays one out. Your exam-day habits need an update. Under the old rule, plenty of candidates counted to 70, spent the last hours polishing screenshots, and went to sleep. That habit is now a risk, because 70 raw points might not be enough on your set.

OffSec's guidance for scaled-scoring exams boils down to four rules. Here's what each one means in practice:

1. Attempt every machine. Even a foothold on the last standalone is 10 raw points that could push your scaled score over 400.
2. Submit every flag in the control panel. A local.txt you found but never submitted doesn't count. Submit each one as you go.
3. Document to the exam guide's standard. Proof file contents and the target's IP address in the same screenshot, from an interactive shell. Missing proof means zero points for that machine, under either system.
4. Submit your report no matter what. OffSec specifically says to complete and upload the report regardless of how many points you think you have. Under scaled scoring, you can't know you've failed.

The Active Directory set matters even more now. It's still 40 raw points, the biggest block on the exam, and the assumed-breach start means you have credentials from minute one. Partial AD credit (10, then 10, then 20) also adds up: every machine you take in the chain helps your scaled score, even if you never reach the domain controller. Under the old 70-point rule, every pass scenario in OffSec's Exam FAQ includes AD points, and our post on passing the OSCP+ without Active Directory does the math on skipping the set. For a step-by-step approach, see our guide to the OSCP+ Active Directory set.

Practice the full 23 hours and 45 minutes at least once. If you can't keep working on hour 18, the new scoring will expose it. Our Active Directory chain labs give you OSCP-style AD sets to run end to end. For a sample hour-by-hour plan, see our OSCP+ exam tips.

If Active Directory is your weak spot, our Hacking Active Directory playlist builds it up from the basics, with BloodHound, Kerberoasting and lateral movement.

FAQ

What is the OSCP+ passing score after December 1, 2026?

A scaled score of 400 on a range of 100 to 500. Your raw points are converted using a conversion specific to your exam set, so there's no single raw-point target.

Do I still need 70 points to pass the OSCP?

Only if your exam starts before December 1, 2026 at 08:00 GMT. For later exams, 70 raw points may be more or less than you need, depending on your exam set.

Does the change apply to the OSCP or only to the OSCP Plus?

Both. There is one exam, and passing it earns the OSCP and the OSCP+ (OSCP Plus) together. Every attempt that starts on or after December 1, 2026 at 08:00 GMT uses scaled scoring.

Is the OSCP+ getting harder?

No. OffSec says the change only affects how results are calculated. The exam's difficulty and the standard needed to pass stay the same. The goal is that a 400 means the same thing on every exam set.

Does scaled scoring affect my existing OSCP or OSCP+?

No. Certifications already earned are not affected.

If I fail before December 1 and retake after, which scoring applies?

The date of each attempt decides. A retake that starts on or after the cutoff uses scaled scoring. Retake rules and waiting periods are in our OSCP cost breakdown.

Is 400 out of 500 the same as 80%?

No. The scale doesn't map to a percentage, and raw points don't convert at a fixed ratio. A 400 means you met the certification standard on your exam set, whatever raw total that took.

Is OSCP+ scaled scoring graded on a curve?

No. OffSec compares you to a fixed standard, so anyone who reaches a scaled score of 400 passes. There's no quota and no ranking against other candidates.

Get ready for the AD set

The scoring formula is out of your hands. Your Active Directory skills aren't, and the AD set is still the biggest block of points on the exam.

That's the part our course and AD chains are built for. SiiirCharles, one of our students, wrote: "Hacker Blueprint makes the OSCP journey so much smoother. His teaching style is absolutely phenomenal, he has a way of breaking down complex topics until they just click." (More reviews)

Try our 30+ hour course for OSCP prep with a free trial, or start with one of our free Active Directory chains.

Questions about your exam date? Ask in the Hacker Blueprint Discord.

Sources

• OffSec: OSCP+ Scoring Update (Oct 21, 2026, the cutoff and rescheduling rules, no later update as of Nov 3, 2026)
• OffSec: OSCP+ Equated Scaled Scoring FAQ (the 100 to 500 scale and passing score of 400, no grading on a curve, checked Nov 3, 2026)
• OffSec: OSCP+ Exam Guide (exam structure and raw point values, checked Nov 3, 2026)
• OffSec: OSCP+ Exam FAQ (the 70-point pass scenarios, checked Nov 3, 2026)
• Hacker Blueprint: The OSCP+ Just Changed (New Scoring System) (YouTube, Oct 28, 2026)