The OSCP is OffSec's hands-on penetration testing certification, earned by passing a proctored practical exam that runs 23 hours 45 minutes. You attack three standalone machines and an Active Directory set, need 70 of 100 points to pass, then submit a professional report. The standalone exam costs $1,699.
OSCP at a glance
| Detail | What the issuer says |
|---|---|
| Issuer | OffSec |
| Course | OffSec Certified Professional (OSCP / OSCP+) — PEN-200: Penetration Testing with Kali Linux |
| Exam format | Hands-on, 24-hour proctored practical exam in a private VPN lab: 3 standalone machines (60 points; initial access + privilege escalation) and 1 Active Directory set of 3 machines (40 points), followed by a professional penetration test report. |
| Scoring | No questions: 3 standalone machines and 1 Active Directory set of 3 machines, worth 100 points |
| Time | 23 hours 45 minutes, plus 24 hours afterward to upload the report |
| Passing score | 70 of 100 points |
| Prerequisites | No formal required courses. OffSec strongly recommends a solid understanding of TCP/IP networking, reasonable Windows and Linux administration experience, and familiarity with basic Bash and/or Python scripting. |
| Renewal | OSCP does not expire. OSCP+ (earned together with OSCP) expires 3 years from issuance; maintain it by passing a recertification exam within 6 months of expiry, passing another qualifying OffSec exam (OSEP, OSWA, OSED, OSEE), or completing OffSec's CPE program. |
OSCP vs. OSCP+
OSCP does not expire. OSCP+ (earned together with OSCP) expires 3 years from issuance; maintain it by passing a recertification exam within 6 months of expiry, passing another qualifying OffSec exam (OSEP, OSWA, OSED, OSEE), or completing OffSec's CPE program.
How much the OSCP costs
$1,699 one-time OSCP+ Standalone Exam (exam attempt without training materials). $1,749 one-time Course + Cert Bundle (90 days of one 200/300-level course, hands-on labs, one exam attempt). $2,749/year Learn One (one year of one 200/300-level course, labs, two exam attempts; auto-renews).
What the course covers
- Enumeration and information gathering, including vulnerability scanning and assessment
- Encryption and cryptography
- Web application and client-side attacks (XSS, command injection, directory traversal, file uploads, SQL injection); password attacks; antivirus evasion
- Windows and Linux privilege escalation, lateral movement, pivoting and tunneling
- Active Directory, attacking Active Directory authentication, lateral movement in AD
- Enumerating and attacking AWS cloud infrastructure
- Common tools: Nmap, Metasploit, Burp Suite, Hydra, Nessus, sqlmap, Shellter
- Professional penetration test reporting
Who the OSCP is for
The OSCP suits people who already know networking, Linux and Windows administration and some scripting, and want proof they can break into systems under time pressure. It is often a step after a knowledge exam such as CompTIA PenTest+ or CEH. Compare all the options in our penetration testing certifications guide.
Careers and pay
Information security analysts earned a median $129,180 in May 2025, and BLS projects the field to grow 21% from 2025 to 2035. BLS groups penetration testers with information security analysts and does not report pay by certification.
Frequently asked questions
How much does the OSCP cost?
$1,699 one-time OSCP+ Standalone Exam (exam attempt without training materials). $1,749 one-time Course + Cert Bundle (90 days of one 200/300-level course, hands-on labs, one exam attempt). $2,749/year Learn One (one year of one 200/300-level course, labs, two exam attempts; auto-renews).
How long is the OSCP exam?
23 hours 45 minutes, plus 24 hours afterward to upload the report. You need 70 of 100 points.
Does the OSCP expire?
OSCP does not expire. OSCP+ (earned together with OSCP) expires 3 years from issuance; maintain it by passing a recertification exam within 6 months of expiry, passing another qualifying OffSec exam (OSEP, OSWA, OSED, OSEE), or completing OffSec's CPE program.
Do I need experience for the OSCP?
No formal required courses. OffSec strongly recommends a solid understanding of TCP/IP networking, reasonable Windows and Linux administration experience, and familiarity with basic Bash and/or Python scripting.
Sources
Exam, price and renewal details come from each issuer's official pages, checked October 2026. Issuers change prices and exam versions, so confirm before you register.