Short answer
- Penetration testers often start in IT or security roles. The closest BLS occupation is information security analysts, who typically need a bachelor’s degree and whose experience often comes from roles such as network and computer systems administrator (BLS).
- Foundation certification: CompTIA Security+, $439 (CompTIA).
- Penetration testing certifications: CompTIA PenTest+ $439 (CompTIA); OffSec OSCP with the PEN-200 course $1,749 (OffSec); GIAC GPEN $999 (GIAC).
- Validity differs: PenTest+ and OSCP+ expire after three years, GPEN after four; the original OSCP doesn’t expire.
- Pay: the median for information security analysts was $129,180 in May 2025, with 21% projected growth to 2035.
There is no license for penetration testers and no single required certification. Certifications still carry weight: the BLS notes that “many employers prefer to hire candidates who have information security certification.” This guide lays out a realistic path, from IT basics to hands-on penetration testing credentials, with the prices the issuers publish. We checked CompTIA, OffSec, GIAC, EC-Council and the Bureau of Labor Statistics (BLS) on September 21 and 22, 2026.
The path in four stages
| Stage | What you do | Typical credential | Issuer’s price |
|---|---|---|---|
| 1. IT foundation | networking, operating systems, scripting; often a first job in support or administration | CompTIA Network+ (optional) | $399 |
| 2. Security foundation | security concepts, first security tasks | CompTIA Security+ | $439 |
| 3. Penetration testing | hands-on testing, reports | CompTIA PenTest+ or OffSec OSCP or GIAC GPEN | $439 / $1,749 / $999 |
| 4. Specialization | web apps, red teaming, advanced exploitation | further OffSec or GIAC certifications | varies |
Sources: CompTIA Network+, CompTIA Security+, CompTIA PenTest+, OffSec pricing, GIAC pricing.
CompTIA recommends 3 to 4 years in a penetration tester job role for PenTest+, plus Network+ and Security+ knowledge. OffSec says the OSCP has “no formal prerequisites,” but recommends solid TCP/IP networking, Windows and Linux administration, and Bash or Python scripting (OffSec PEN-200). So for most candidates, stage 3 comes after time in stages 1 and 2.
The penetration testing certifications compared
| CompTIA PenTest+ | OffSec OSCP / OSCP+ | GIAC GPEN | EC-Council CEH | |
|---|---|---|---|---|
| Exam | PT0-003, up to 90 questions, 165 minutes | 24-hour proctored practical exam | 82 questions, 3 hours, 73% to pass | see EC-Council |
| Price | $439 voucher; $579 with a retake | $1,749 with the PEN-200 course (90 days, one attempt); $1,699 exam only; $2,749 a year for Learn One (two attempts) | $999 per attempt; $899 retake | $950 remote or $1,199 at Pearson VUE, plus $100 eligibility fee for self-study |
| Valid for | 3 years | OSCP+: 3 years; OSCP: no expiry | 4 years | 1 year, renewed with annual fees |
| Renewal | 60 CEUs + $150 per 3 years | recertification exam, another qualifying OffSec exam, or continuing education | 36 credits over 4 years + $499 | $80 a year + 120 credits per 3 years |
Sources: CompTIA PenTest+, CompTIA CE fees, OffSec pricing, OffSec PEN-200, OffSec on OSCP+, GIAC GPEN, GIAC pricing, GIAC renewal, EC-Council exam voucher, EC-Council Pearson VUE voucher, EC-Council eligibility, EC-Council CE fees.
Three details that change the math:
- OSCP vs. OSCP+. Since November 1, 2024, passing the OSCP exam earns two certifications: the OSCP, which “does not expire,” and the OSCP+, which expires three years after issue (OffSec).
- PenTest+ renews your other CompTIA certifications. CompTIA says PenTest+ also renews lower-level certifications such as Security+, Network+ and A+ (CompTIA). If you already hold Security+, earning PenTest+ renews it as well.
- Retakes add up. A failed GPEN attempt costs $899 to retake. With OffSec, the Learn One subscription includes two exam attempts, while the $1,749 bundle includes one.
What it costs to get to a penetration testing credential
| Path | Certifications | Exam and course fees |
|---|---|---|
| CompTIA only | Security+ and PenTest+ | $878 |
| CompTIA plus OffSec | Security+ and OSCP (with PEN-200) | $2,188 |
| CompTIA plus GIAC | Security+ and GPEN | $1,438 |
Our own totals from the issuers’ US list prices above, one attempt each, without renewals and without third-party training. GIAC’s $999 covers the certification attempt.
For Security+ itself, including retake insurance and the three ways to renew, see our Security+ exam cost guide and our Security+ certification guide.
Pay, education and outlook
The BLS doesn’t have a separate category for penetration testers. The closest is information security analysts:
| BLS figure | Information security analysts |
|---|---|
| Median annual pay, May 2025 | $129,180 |
| Typical entry-level education | bachelor’s degree |
| Work experience in a related occupation | less than 5 years |
| Jobs, 2025 | 192,900 |
| Projected growth, 2025 to 2035 | 21% (much faster than average) |
| Openings per year | about 14,100 |
Source: BLS information security analysts.
The BLS also notes that “some workers enter the occupation with a high school diploma and relevant industry training and certifications,” and that “many employers prefer to hire candidates who have information security certification.”
For government work, the Department of Defense lists “Penetration Tester” as a functional title under work role 541, Vulnerability Assessment Analyst (DoD Cyber Workforce, PDF). Which certifications qualify for that role is set in the DoD 8140 qualification matrix; check the current version with the hiring agency.
Skills you practice before any exam
Certification exams test skills you build elsewhere first:
- Networking: TCP/IP, common protocols, how traffic moves through a network.
- Operating systems: Windows and Linux administration, including Active Directory.
- Scripting: Bash or Python, the two OffSec recommends.
- Web applications: how authentication, sessions and common vulnerabilities work.
- Writing: a penetration test ends in a report that explains what you found and how to fix it.
Only test systems you have written permission to test. Practice labs and intentionally vulnerable machines exist for exactly that reason.
Frequently asked questions
Do I need a degree to become a penetration tester?
Not always. The BLS says information security analysts typically need a bachelor’s degree, but some enter “with a high school diploma and relevant industry training and certifications.”
Which certification should I get first for penetration testing?
Security+ usually comes first: CompTIA recommends Security+ knowledge for PenTest+. For penetration testing itself, PenTest+ ($439) is the lowest-cost option listed here; the OSCP ($1,749 with the course) tests you in a 24-hour practical exam.
Does the OSCP expire?
The OSCP itself doesn’t. Since November 1, 2024 you also receive the OSCP+, which expires after three years unless you renew it.
How much does the OSCP cost?
$1,749 with the PEN-200 course, 90 days of lab access and one exam attempt; $1,699 for the exam alone; or $2,749 a year for Learn One with two attempts.
How long does it take to become a penetration tester?
It depends on your starting point. CompTIA recommends 3 to 4 years in a penetration testing role for PenTest+, and the BLS lists less than five years of related experience for information security analysts. The BLS adds that many information security analysts come from IT departments, often as network and computer systems administrators.
How we checked these facts. Certification prices come from the issuers’ own pages (CompTIA US prices shown for the North America market, OffSec, GIAC, EC-Council store), checked on September 21 and 22, 2026; pay and outlook from the BLS Occupational Outlook Handbook (updated August 27, 2026). Certificate Quest is not affiliated with any of these organizations and earns nothing from links on this page.