OSEP
OffSec Experienced Penetration Tester · OffSec
The OSEP validates advanced penetration testing against hardened environments: client-side attacks, antivirus and EDR evasion, Active Directory abuse, credential harvesting, persistence and lateral movement in mature networks. It is the natural follow-up to the OSCP for red teamers and part of the OSCE³ trio. Its strength is a realistic simulation of attacks against defended organisations; its limit is that it focuses on Windows environments and requires a lot of preparation time.
- Exam
- Proctored practical exam of 47 h 45 on a defended network: pass with 100 points or by reaching the final objective, then 24 h to submit the report.
- Exam price
- Sold with the trainingExam not sold alone: Course + Cert Bundle (90 days of PEN-300, one attempt) US$1,749, or Learn One subscription US$2,749 a year (two attempts). Retake: US$249.
- Required experience
- None formally. OffSec designs it as the step after the OSCP: solid pentest experience, Active Directory and some C# or PowerShell are expected.
- Validity and maintenance
- Valid for life: no expiry date and no maintenance fee. Counts towards the OSCE³ and can renew an OSCP+.
- Format
- Hands-on
Who is it for?
OSCP holders and experienced penetration testers moving into red teaming or adversary simulation against well-defended organisations.
Domains covered
- Client-side attacks and social engineering
- Antivirus and EDR evasion
- Privilege escalation and lateral movement
- Active Directory exploitation
- Advanced Windows tradecraft: credential harvesting and persistence
- Application exploitation (Java, JavaScript, web)
- Maintaining access and post-exploitation
Nestor’s take
Information checked on 2 October 2026 against the official site. Prices exclude tax and training, and may change.
The certification names mentioned are trademarks of their respective owners. KrakenShield is not affiliated with any certification body and does not reproduce any exam question.
