Updated recently
Last updated:
Quick Answer: How to become certified ethical hacker online: To become a certified ethical hacker online, pick one exam – CEH for the broad, widely recognised route or eJPT for practical penetration testing – then spend the time in labs, because both exams test what you have done rather than what you memorised. CEH needs two years of documented experience and costs around $1,200 with training.
Offensive Security Certification Routes
The ethical hacking credential market has a strange shape: the widely recognised exam has the higher entry requirement and the higher price, while the practical exam is cheaper, faster and harder to fake. Candidates who understand this tend to choose faster and do better.
Both routes depend on the same thing that separates the field from every other security specialisation – you have to have broken something. Reading about exploitation is not the same as having watched a service fall over because you changed one parameter.
| Certification | Experience requirement | Indicative cost | Exam format | Proves |
|---|---|---|---|---|
| eJPT | None | ~$250 | Practical, multiple choice and practical tasks | You can work a host and find a foothold |
| CompTIA PenTest+ | None, recommended experience | ~$400 | Multiple choice and practical | You understand the phases of a penetration test |
| CEH | 2 years IT or security experience | ~$1,199-$1,299 | Multiple choice, 90 questions | You know the methodology and can talk to a non-technical client |
| PNPT | None | ~$500 | Practical | You can complete a full test in a lab |
| OSCP | None formally, heavy prerequisites assumed | ~$1,600 | 24-hour practical exam with a report | You can pivot, escalate and write it up |
Prices vary by region, and several of these vendors bundle training with the exam, which is often the cheapest route because the bundle price is lower than the two purchased separately.
How to Become Certified Ethical Hacker Online: The Realistic Path
Start with a practical exam, not a theory one. CEH assumes two years of experience and rewards breadth – methodologies, tools, and the ability to explain a risk to someone who will fund the fix. If you do not have the experience, the practical exams are where the actual capability is tested and where the retake rate is lower.
Then budget for lab time rather than course time. A course teaches you the material; a lab is where you learn the mechanics. The pattern that works is to read, then break something in a deliberately vulnerable environment, then write up what you did, then break something slightly harder.
Finally, build the habit of writing. Every one of these credentials, and every junior offensive role, asks for a report. Candidates who can describe their methodology and their findings in writing are hired noticeably faster than candidates who can only talk about it.
# Scope a target properly and legally - only with written authorisation
nmap -sV -sC -p- --open -T4 10.10.10.5 -oN scan.txt
# Enumerate web content and look for the obvious
nikto -h http://10.10.10.5 -o nikto.txt
gobuster dir -u http://10.10.10.5 -w /usr/share/wordlists/dirb/common.txt -t 40
# Confirm the finding and capture proof
curl -s http://10.10.10.5/secret/ | head -20
searchsploit "example-software 1.2.3" Which Offensive Credential to Choose for US Hiring
It depends on where you are going. Government and contractor work, and anything that lists CEH in the contract, is effectively closed without it. Consultancies and managed security providers tend to care about the practical credentials and will ask you to demonstrate.
OSCP is the strongest single signal in the field for technical credibility, and it is also the hardest – a 24-hour practical exam with a professional report, and a pass rate that people regularly quote below 50%. That difficulty is the value, and it is also why it is not a first credential.
The pragmatic ordering for most people: a practical fundamentals exam, a lab portfolio, a job, then the senior credential once the experience justifies the cost.
Building a Home Lab on a Legitimate Budget
You need less than most people think. A single virtual machine running a deliberately vulnerable application, a snapshot of it so you can reset in seconds, and a second machine to attack it from is enough to learn the mechanics of exploitation. Kali, Metasploitable and OWASP Juice Shop are all free and are all more useful than a paid course for the practical part.
The discipline that matters is writing. After each exercise, write up what you did, what you expected, and what actually happened. Offensive security hiring managers read these write-ups as evidence of method, and the candidates who have them are consistently the ones who get the interviews.
The Ethics and Legal Reality of Penetration Testing
This is the part certification exams rarely emphasise and employers care about deeply. Testing a system you do not own without written authorisation is a crime in most jurisdictions, regardless of intent, and the professional frameworks – which is what the CEH tests – exist partly to make that boundary explicit.
For candidates this means the habit of always having a signed scope document before touching a target, and the habit of writing it into the report. Employers in offensive roles ask about scope and authorisation more often than they ask about exploits, because getting that wrong is what ends careers.
A Candidate Who Learned Only From Videos
A support engineer spent four months on an offensive security course and passed the practical exam in it, largely because the course included lab time he could complete step by step. He then applied for junior penetration testing roles.
The interviews exposed the gap. Asked to describe a previous engagement, he talked through the lab environment – which he had completed, but which the interviewer could recognise. Asked what he would do on a host with no obvious footholds, he described the lab steps.
He was not hired, and the feedback was fair: the credential showed he had done the exercises, not that he had worked. He spent two months in a deliberately vulnerable environment of his own, wrote it up, and in the next round the conversation went differently because he could describe a problem he had actually solved.
Why This Matters Outside the United States
Offensive security is a globally distributed profession – most ethical hacking engagements are remote, so this credential is usable from anywhere.
Offensive security is one of the most globally distributed professions – most engagements are remote and the tools are the same everywhere – which makes these credentials unusually usable from outside the United States. The practical exams in particular are priced and delivered internationally.
How to Read These Numbers
Prices are list prices at the time of writing and vary by region and by whether training is bundled. Several of these credentials are sold as a package, and the package is usually cheaper than the exam and the course bought separately.
The exam formats differ in ways that matter for preparation. The multiple-choice exams reward breadth and are more predictable; the practical exams reward lab time and are much less forgiving.
Key Terms Used Above
| Term | What it means in practice |
|---|---|
| Authorised scope | Written permission defining exactly which systems you may test and when. Non-negotiable, professionally and legally. |
| Penetration test | An authorised assessment of a system’s security, with a defined method and a written report. |
| Practical exam | An exam where you work on a live target under time pressure, as OSCP and eJPT do. |
| Methodology | The structured phases of a test – reconnaissance, scanning, exploitation, reporting – that the certifications test. |
| Write-up | The report of what you did and what you found. It is the artefact hiring managers actually read. |
Never practise on a system you do not own without written authorisation. It is a criminal offence in most jurisdictions regardless of intent, and it is the first thing these credentials are designed to prevent.
Related Reading
If you want the wider context, start with our guide to cybersecurity with no experience, then the full guide, then the full guide. Each of these covers a different part of the same decision.
Training Resources
For a structured path rather than scattered free material, the SkilBrill training programme covers the practical side of this topic with the same framing employers use. For a broader foundation, the related SkilBrill course covers the surrounding concepts so you are not learning this topic in isolation.
FAQ
How do I become a certified ethical hacker online?
Pick one exam – CEH for the broad, HR-recognised route, OSCP for the practical penetration-testing route – then do the lab work. Online courses alone do not pass either exam; you need hands-on time in deliberately vulnerable environments.
Do I need experience before the CEH exam?
CEH requires two years of documented IT or cybersecurity experience, or a qualifying degree or scholarship path. OSCP has no formal prerequisite but effectively assumes you can use Linux and read scripts.
Which certification is better, CEH or OSCP?
They prove different things. CEH is widely recognised by recruiters and government buyers; OSCP is respected by technical hiring managers because it requires demonstrated exploitation skill.
Can I pass without a lab environment?
It is possible but unlikely. Both exams include practical elements that need practice in labs, and the practical element is exactly what employers want evidence of.
