OSCP vs CPTS: Which to Take First, Plus PNPT, CEH, CISSP and OSEP

    The OSCP+ (OSCP Plus) is one proctored day and the older name in job ads. The CPTS is a 10-day exam built around a commercial-grade report. Here's how they compare, checked November 2026, and where PNPT, CEH, CISSP, OSEP and PenTest+ fit.

    By Hacker Blueprint··15 min read

    The short answer

    Take the OSCP® first if your goal is getting past HR filters for pentest jobs, since it's the older, longer-established name. Take the CPTS first if you'd rather sit a much cheaper exam with a 10-day window and a commercial-grade report, and you're happy to finish Hack The Box's whole Penetration Tester path before you can book it.

    Both exams test the same core skills: enumeration, web application testing, privilege escalation and Active Directory, all written up in a report. Since November 1, 2024, passing OffSec's exam earns the OSCP+™ (OSCP Plus), which expires three years after it's issued, together with the OSCP, which never expires. Hack The Box says the CPTS has no expiration date.

    PNPT, CEH, CISSP, OSEP and PenTest+ each get a short section below. OSEP is OffSec's next step after the OSCP, and CISSP is a management certification for a different job. The eJPT and Security+ are covered in Do you need the eJPT or Security+ before the OSCP?

    We're Hacker Blueprint. Our instructor holds the OSCP, our academy has more than 600 students, and around 7,000 people have claimed our prep materials. Every exam fact below comes from the issuer's own page, checked on November 2, 2026.

    Video: one Active Directory methodology for both exams

    Our video "Active Directory Made Easy for OSCP, CPTS, CRTO & More" is a 43-minute walkthrough of one AD environment, from initial enumeration to SYSTEM. What carries across exams is the method: enumerate, map how accounts and machines relate, search widely for credentials, and enumerate again after every new account. BloodHound analysis starts at 7:19, manual file system exploration at 10:35 and privilege escalation at 25:56. It went up in January 2026.

    When students fail the AD part of the OSCP+, the reasons we see most often are pivoting, credentials kept in unusual places, skipping re-enumeration after a new foothold, and overconfidence that a topic won't come up. Those habits matter just as much over a 10-day CPTS engagement.

    OSCP vs CPTS side by side

    Detail OSCP+ CPTS
    Run by OffSec Hack The Box
    Exam window 23 hours 45 minutes, proctored 10 days, report included
    Report deadline 24 hours after the exam Inside the same 10 days
    Before you can sit it Nothing formal Finish HTB's Penetration Tester path
    Exam price $1,699 exam only, 2 attempts $210 voucher, 2 attempts
    Results Within 10 business days Within 20 business days
    Expiry OSCP+ 3 years, OSCP never No expiration date

    OSCP vs CPTS: exam format and scoring

    The OSCP+ is one sitting. You get 23 hours and 45 minutes, with a proctor watching, to attack three standalone machines and an Active Directory set of three. Each standalone machine is worth 20 points (10 for initial access, 10 for privilege escalation). The AD set is worth 40 and starts from a username and password OffSec gives you, "simulating a breach scenario." That adds up to 100 raw points. For exams that start on or after December 1, 2026 at 08:00 GMT, OffSec converts them into a scaled score from 100 to 500, and 400 passes (see our scaled scoring explainer). Metasploit is allowed on one target only and AI chatbots are banned, as our OSCP+ allowed tools guide explains.

    The CPTS runs over 10 days. Hack The Box describes it as black-box web, external and internal penetration testing against an Active Directory network, reached over VPN from its Pwnbox or your own VM. You work from a letter of engagement, there are no multiple-choice questions, and you submit flags and need a minimum points total.

    The practical difference is time. The OSCP+ checks that you can get in and document it inside one long day. The CPTS checks that you can be thorough across a whole network and write it up the way a client would expect.

    The report each exam requires

    Both exams can fail you on the report. OffSec calls its documentation requirements "very strict": missing screenshots or proof files mean reduced or zero points, and once you submit, the report is final. Our OSCP report template covers the format.

    Hack The Box makes the report a pass requirement in its own right. You submit a "commercial-grade" report with remediation advice, using the template HTB provides, and HTB says compromising the targets alone won't get you the certification. The report is due within the same 10 days you have for the lab, so every extra hour of testing is an hour less for writing. Miss that deadline and the voucher expires.

    How you qualify and what each costs

    OffSec sets no prerequisites. Its exam guide says the OSCP is "awarded without prerequisites to individuals who pass a performance test." It does recommend TCP/IP networking, Windows and Linux administration, and basic Bash or Python scripting.

    The OSCP+ exam alone costs $1,699, with two attempts within 90 days and no course materials. The Course + Cert Bundle is $1,749 for 90 days of PEN-200 with labs and one attempt. Learn One, with one course, its labs and two exam attempts, is usually $2,749 a year, and on November 2, 2026 OffSec was offering it at $2,199. Every OffSec fee is in our OSCP cost breakdown.

    Hack The Box's gate is its learning path. Before you can use a CPTS voucher, you must complete the Penetration Tester job-role path to 100%, every module and its skills assessment, and you can't skip it. The voucher is $210 and includes two attempts: fail the first and an instructor sends feedback, then you get a free retake, started within 14 days of that feedback. Submit the report even if you think you've failed, or you lose the retake. Vouchers expire one year after purchase.

    HTB also bundles vouchers into Academy plans. Since October 12, 2026, the Silver Annual plan costs $550 a year with two vouchers, one for the CJCA and one for a Specialist exam such as the CPTS. The CPTS exam costs far less than the OSCP+, so your bigger cost is the time and Academy access needed to finish the path.

    Expiry and how employers know each

    The OSCP never expires. The OSCP+ expires three years from issuance, and one way to keep the "+" is passing a qualifying OffSec exam such as the OSEP while it's still valid, plus the Annual Maintenance Fee. Our OSCP vs OSCP+ guide covers every route. The CPTS has no expiry date, so there's nothing to renew.

    On recognition, the honest factor is age. Hack The Box announced the CPTS in September 2022, so it has had far fewer years than the OSCP to work its way into job ads and HR keyword filters. Before you choose on reputation, search the job boards you'll apply through for both names, in your country. That five-minute check tells you more than any forum thread.

    Who each suits, and should you take both

    The OSCP+ suits you if the pentest roles you want screen for it, if you work well against a deadline, or if an employer will pay for an OffSec bundle. The CPTS suits you if budget matters, if you want a structured path from first module to exam, and if you want practice writing a client-style report. HTB pitches it at junior pentesters, analysts and IT security staff, and calls it intermediate level.

    Taking both makes sense because they overlap so much. If you start with the CPTS, its path builds your methodology and report habits, and the OSCP+ becomes mostly a test of speed. If you start with the OSCP+, the CPTS adds a longer engagement and a heavier report. If you're job hunting, take first the one your job board check says employers ask for.

    Active Directory sits at the center of both: OffSec's AD set is 40 of the 100 raw points, and the CPTS is an internal test against an AD network. Our OSCP Active Directory guide covers how to prepare.

    Our free Hacking Active Directory playlist covers AD for both exams, from BloodHound and Kerberoasting to certificate attacks and lateral movement.

    All seven certifications at a glance

    Here's how the OSCP+ sits next to the other names people compare it with, from each issuer's site in November 2026. Prices and expiry rules are in each section below.

    Cert Format Exam length Best for
    OSCP+ (OffSec) Hands-on, proctored, plus report 23h 45m, then 24h for the report Pentest job applications
    CPTS (Hack The Box) Hands-on, flags plus commercial-grade report 10 days in total Structured learners on a budget
    PNPT (TCM Security) Hands-on external and internal test, report, debrief 5 days, then 2 for the report Practicing a full engagement
    CEH (EC-Council) 125 multiple-choice questions, optional practical 4 hours (practical 6) Jobs and contracts that list it
    CISSP (ISC2) Adaptive, 100 to 150 items Up to 3 hours Security management roles
    OSEP (OffSec) Hands-on, proctored 48 hours The step after the OSCP
    PenTest+ (CompTIA) Up to 90 multiple-choice and performance-based 165 minutes Teams built on CompTIA certs

    OSCP vs PNPT

    TCM Security's PNPT (Practical Network Penetration Tester) assesses "an external and internal network penetration test at a professional level." You get five full days for the assessment and two more for a professional report, then a live 15-minute debrief with TCM's assessors, who are senior penetration testers.

    TCM sells it with training included, one exam attempt plus one free retake, and 12 months of access, and it says the PNPT does not expire. A further retake is listed at $100. Below it sits the PJPT, TCM's associate-level internal test focused on Active Directory.

    Compared with the OSCP+, the PNPT gives you more time and adds a spoken debrief, which is good practice for client calls. The OSCP+ is the one to pick when the job ads you're targeting name it.

    OSCP vs CEH

    EC-Council's CEH is on version 13, branded CEH AI. The main exam (312-50) is 125 multiple-choice questions in four hours, with a cut score from 60% to 85% depending on the question set. The optional CEH Practical is six hours and 20 challenges in EC-Council's iLabs cyber range, and passing both earns the CEH Master.

    To sit the exam, you either take official training or show two years of information security work experience and pay a non-refundable $100 application fee. The CEH lasts three years, and you keep it with 120 continuing education credits per cycle and an $80 annual fee. Prices vary by region and training partner.

    EC-Council says the CEH is recognized by the US Department of Defense and GCHQ, and that recognition is the main reason to take it. If a job or contract lists the CEH, get it. To prove you can compromise machines yourself, the OSCP+ or another practical exam on this list does that more directly.

    OSCP vs CISSP

    The CISSP is built for a different job. ISC2 aims it at "experienced security practitioners, managers and executives," in roles like CISO and security architect, across eight domains of security management and design. The exam uses computerized adaptive testing: 100 to 150 items in up to three hours. Standard registration is $749 in the Americas, and a new exam outline takes effect on April 15, 2027.

    To be certified, you need five years of cumulative full-time work experience in at least two of the eight domains. A relevant degree, or a credential from ISC2's approved list, can cover one of those years. Security+ is on that list, and the OSCP isn't. Without the experience, you can pass and become an Associate of ISC2, then earn the experience within six years. Keeping the CISSP costs a $135 annual maintenance fee and 120 CPE credits every three years, at least 90 of them in Group A.

    That experience rule puts the CISSP later in a career, as you move toward leading teams. If you already hold it, OffSec says its fully released courses may qualify for up to 40 ISC2 CPE credits.

    OSCP vs OSEP

    The OSEP (OffSec Experienced Penetration Tester) is OffSec's next step after the OSCP+, earned through its 300-level course, PEN-300. OffSec says it expects students "to have completed PEN-200 and passed OSCP+ or to possess equivalent knowledge and experience," though PEN-200 isn't a formal prerequisite. The exam is 48 hours and proctored, and the course covers advanced penetration testing, including evading detection.

    The OSEP doesn't expire, and it's one of the three certifications that make up OSCE³, with OSWE and OSED. Passing the OSEP while your OSCP+ is still valid, plus paying the Annual Maintenance Fee, extends the "+" by three years from the day you pass. If you take the OSEP within three years of your OSCP+, it doubles as your renewal.

    OSCP vs PenTest+

    CompTIA's PenTest+ is on V3 (exam PT0-003), launched December 17, 2024. It has up to 90 multiple-choice and performance-based questions in 165 minutes, and the pass mark is 750 on a scale of 100 to 900. CompTIA recommends three to four years in a penetration tester role, with Network+ and Security+ or equivalent knowledge. Draft V4 objectives are already posted with no launch date, and CompTIA estimates V3 will retire in 2027.

    PenTest+ is valid for three years through CompTIA's continuing education program, and passing it also renews A+, Network+, Security+ and CySA+ if you hold them. CompTIA's store shows the price for your country.

    It suits teams that already build on CompTIA certifications. Its performance-based questions test practical skills in short tasks, while the OSCP+ tests them across a full day on live machines. If pentesting is your goal, add PenTest+ when an employer asks for it.

    Which pentesting certification to take first

    Pick by what you need the certification to do:

    • You want pentest interviews and HR keeps filtering you out. Take the OSCP+ first, after checking that the job ads you're targeting ask for it.
    • Budget is tight and you like a structured path. Take the CPTS first. It also makes a solid base for the OSCP+ later.
    • You want to rehearse a full engagement, debrief included. Take the PNPT.
    • A job or contract names a certification. Take that one: the CEH, PenTest+ or, for management roles, the CISSP.
    • You already hold the OSCP+. The OSEP is the next step, and it renews the "+".
    • You're new to IT. Start with the free beginner paths in our academy, then follow our OSCP+ roadmap. If you want a smaller exam first, our post on taking the eJPT before the OSCP covers when it's worth it.

    For the money side of the OSCP+ decision, read Is the OSCP worth it?, and for what the exam feels like, How hard is the OSCP?

    FAQ

    Is CPTS harder than OSCP?

    They're hard in different ways. The OSCP+ packs the work into 23 hours and 45 minutes with a proctor watching. The CPTS gives you 10 days but covers a whole network and requires a commercial-grade report.

    Should I take the CPTS or the OSCP first?

    Take the OSCP+ first if the job ads you're targeting ask for it. Take the CPTS first if budget matters more and you want Hack The Box's structured path, which builds a good base for the OSCP+.

    Does the CPTS expire?

    No. Hack The Box says the CPTS has no expiration date. The OSCP never expires either, and the OSCP+ that comes with it expires three years from issuance.

    Is the OSCP better than the CEH?

    For hands-on pentesting, yes: the OSCP+ is a practical exam, and the main CEH exam is 125 multiple-choice questions. Take the CEH when a job or contract asks for it.

    Is the OSEP harder than the OSCP?

    OffSec places the OSEP a level above, at 300, and expects you to have passed the OSCP+ or have equivalent experience. Its exam lasts 48 hours.

    Which pentesting certification should I get first?

    With no IT background, build Linux, networking and Windows basics first. Then choose between the OSCP+ and the CPTS based on the job ads you're targeting and your budget.

    Build the skills both exams test

    Most of the preparation is shared, whichever exam you book. Our OSCP+ roadmap sets out a study order, our free AD chains start from domain credentials the way the OSCP+ AD set does, and our methodology notes for OSCP prep keep your checklist in one place for any exam. Hacker Blueprint isn't affiliated with OffSec, and our material contains no OffSec course, lab or exam content. Students have passed CRTO, CPTS, eJPT, PNPT, PJPT, CEH, and others using this material.

    HiroYoshi AnonWho, one of our students, wrote: "Since joining this amazing community, I've been able to achieve both my PJPT and PNPT certifications. The structured guidance, support, and especially the CherryTree notes provided by Hacker Blueprint gave me a strong foundation for building my methodology and refining my approach to penetration testing." (More reviews)

    Try our 30+ hour course for OSCP prep with a free trial, or start with one of our free Active Directory chains.

    Still deciding between the OSCP and the CPTS? Ask in the Hacker Blueprint Discord.

    Sources

    Keep reading

    Hacker Blueprint

    Hands-on certification prep, trusted by certified hackers around the world.

    Want new labs and discount codes first?

    We'll email you when a new lab drops or a sale goes live.

    Your email is safe with us. We don't spam.

    © 2026 Hacker Blueprint. All rights reserved.

    Built for hackers, by hackers.

    OSCP® and OSCP+™ are trademarks of OffSec. Hacker Blueprint is an independent training provider and is not affiliated with, endorsed by, or sponsored by OffSec. All content is our own original material and contains no OffSec course, lab, or exam content. Individual results vary: passing any exam depends on your own study and practice. * Lifetime access and lifetime updates run for as long as Hacker Blueprint operates, with no renewal and no extra charge.