Pentest certifications 2026: CPTS, OSCP, PNPT, eJPT
Four certifications appear in almost every penetration tester, ethical hacker and red team operator job listing in 2026: CPTS, OSCP, PNPT and eJPT. They are not earned the same way, they do not prove the same thing, and they do not cost the same amount.
This lesson compares them coldly with real 2026 numbers, and lays out a coherent order of attempts for someone starting from zero who wants to reach senior level.
Why a certification, not just courses
A certification is an industry-recognized exam that attests to a level of skill at a given point in time. Three properties matter to an employer:
- It is independent of the candidate: a third party (HTB, Offensive Security, TCM Security, INE) certifies, not the school.
- It is dated: the 2025 version of a certification is not exactly the same as the 2020 one, so the employer knows what was tested.
- It is practical in pentest: unlike in other domains, in pentest serious certifications require you to compromise real machines during the exam.
Concretely, a job listing that says "CPTS or OSCP required, PNPT or eJPT a plus" filters candidates. Without a certification, your resume rarely passes the initial screen for a junior role — unless you already have solid professional references.
CPTS — Certified Penetration Testing Specialist (HackTheBox)
Vendor: HackTheBox.
Format: 100 % practical exam, 10 self-paced days from anywhere, no live proctoring. You get access to a simulated corporate network with several Windows and Linux machines. You must compromise at least 6 out of 12 machines and submit a professional PDF report.
Official preparation: the HTB Academy Penetration Tester Path, 28 modules, roughly 150 to 300 hours of study depending on starting level.
Price 2026: about €210 for the exam voucher alone (the HTB Academy training is sold separately, ~€490 for the Silver Annual that contains the CPTS Path modules).
Timeframe after purchase: up to one year to start the exam after buying the voucher. Once started, the 10 days run continuously.
Unofficial pass rate: around 35 to 45 % on the first attempt, high for a practical certification. A retake costs about €100.
Grading: each machine is worth a certain number of points, you need to reach a global threshold and submit a technically solid report. An excellent compromise rate without the report is not enough.
Industry recognition: strong and growing since 2022. The certification has caught up with OSCP recognition in major tech capitals (Paris, London, Berlin, Toronto, Montreal) and even overtaken it in some pockets (Amsterdam, Barcelona).
Verdict: the best 2026 certification for a junior-to-mid pentester. Producing an excellent report forces you to learn to write, not just to exploit.
OSCP — Offensive Security Certified Professional
Vendor: Offensive Security (OffSec).
Format: 100 % practical exam, 24 hours of test + 24 hours of report writing, with live webcam proctoring. You get access to 5 machines to compromise (3 dedicated machines + a 2-machine minimum Active Directory network), you need 70 points out of 100.
Official preparation: the PEN-200 course from Offensive Security, dense curriculum with videos, PDFs, and — most importantly — access to a training lab of dozens of machines for 3 months.
Price 2026: starting at €1,649 for the PEN-200 + 90-day Lab + voucher pack (often rising to €2,100 for 180 days or €2,500 for 365 days). By far the most expensive pentest certification.
Timeframe after purchase: lab and voucher access run for the duration purchased (90, 180 or 365 days), after which everything expires.
Unofficial pass rate: around 30 % on the first attempt. A retake costs about €250 for a new voucher.
Grading: 70 points minimum, with a possible 10-point bonus if you submit the training lab exercise report. The final exam report must be professional and reproducible.
Industry recognition: historically the strongest since 2010. Even today, one out of two senior job listings still mentions "OSCP required" rather than CPTS. This dominance is eroding but real in 2026.
Verdict: the reference senior certification, but becomes optional next to CPTS for a budget-constrained junior profile.
PNPT — Practical Network Penetration Tester (TCM Security)
Vendor: TCM Security (founded by Heath Adams, the Cyber Mentor).
Format: 100 % practical exam, 5 days to compromise a simulated Active Directory network from scratch (with real OSINT phase on the open Internet), then 2 days to write the report and defend it, with a 15-minute oral defense in front of an examiner. It is the only 2026 pentest certification with an oral component.
Official preparation: the TCM Academy pack Practical Ethical Hacking + Windows Privilege Escalation + Linux Privilege Escalation + Open-source Intelligence (OSINT) + External Pentest Playbook, about 60 hours of video.
Price 2026: about $399 for the courses + voucher pack, or $200 for the voucher alone. One of the best price/quality ratios on the market.
Timeframe after purchase: up to 6 months to start the exam. Once started, the 7 days run.
Unofficial pass rate: around 50 to 60 %, the highest of the four. Free retake if you fail the first attempt thanks to detailed feedback.
Grading: full compromise of the AD network and professional report and oral defense. No intermediate scoring.
Industry recognition: growing since 2022, especially in the US. Somewhat less known in French-speaking Europe but rising fast. Excellent signal for roles that require real OSINT and Active Directory skills.
Verdict: the certification that most resembles a real client pentest, with open OSINT and oral report. Ideal as a complement to CPTS.
eJPT — eLearnSecurity Junior Penetration Tester (INE)
Vendor: INE (which acquired eLearnSecurity in 2020).
Format: 100 % practical exam, 48 hours to answer a 35-question MCQ based on a lab you must have compromised. No report to write, no live proctoring.
Official preparation: INE's Junior Penetration Tester path, about 100 hours of videos and labs.
Price 2026: about $200 for the voucher alone, or included in INE's Fundamentals subscription (~$40/month).
Timeframe after purchase: 6 months to take the exam. Once started, the 48 hours run.
Unofficial pass rate: around 75 to 85 %, the highest in the sector.
Grading: 35 MCQ questions, 78 % correct answers to pass.
Industry recognition: modest but real for a first junior role. Many internships and apprenticeships list it as a prerequisite.
Verdict: the entry door to the certification world. Not enough for a senior role, but excellent to prove motivation and baseline level.
Comparison table
| Criterion | eJPT | CPTS | PNPT | OSCP |
|---|---|---|---|---|
| Vendor | INE | HackTheBox | TCM Security | Offensive Security |
| Target level | Junior beginner | Junior to intermediate | Intermediate to senior | Intermediate to senior |
| Format | MCQ on lab | Practical + report | Practical + report + oral | Practical + report |
| Exam duration | 48 h | 10 days | 7 days | 24 h + 24 h report |
| Proctoring | No | No | Oral only | Yes, continuous webcam |
| Voucher price | ~$200 | ~$230 | ~$200 | starting €1,649 |
| Official course | INE sub included | ~€490/year (Silver) | ~$399 (bundle) | Included in price |
| Pass rate | 75–85 % | 35–45 % | 50–60 % | ~30 % |
| Industry recognition | Modest | Strong, rising | Modest, rising | Strong, historic |
| OSINT part | No | No | Yes, real Internet | No |
| Active Directory | No | Yes (2 modules) | Yes (exam core) | Yes (mini network) |
| Ideal if... | First role | University curriculum | Real client pentest | Senior role mandates it |
Recommended order of attempts
For a pentester starting from zero, the sequence that optimizes both budget and career progression is:
- eJPT (months 3 to 4) — low-cost entry door to validate your baseline and enrich your resume quickly.
- CPTS (months 6 to 10) — the real investment, aligned with this course and the HTB Academy path you are already following.
- PNPT (months 12 to 15) — signals to a recruiter that you can run a full client pentest with real OSINT and an oral report.
- OSCP (months 18+) — when you target a senior role where OSCP is still explicitly listed in the posting.
This sequence is not rigid. A student in initial training who follows this course can aim for CPTS only, then let job listings guide the next step.
Do you really need all four?
No. Most senior pentesters have two or three certifications, not four. The question to ask:
- You aim for a first junior role? eJPT alone is enough to land an internship or apprenticeship.
- You aim for a first real pentest full-time role? CPTS or OSCP is the real threshold.
- You aim for a senior consultant role with client-facing work? PNPT adds a valuable signal alongside CPTS or OSCP.
Stacking four certifications on a junior resume paradoxically signals collecting, not practicing. Two well-chosen ones beat four lined up.
How this course prepares for certifications
This course faithfully follows the HTB Academy Penetration Tester Path, so it prepares directly for the CPTS. The week-by-week mapping is detailed in lesson 0.3.
At the end of fifteen weeks you will have:
- Compromised twenty to thirty machines in our Docker labs, with the full method from reconnaissance to report writing.
- Written a graded professional final report (module 12) in the format expected at the CPTS exam.
- Handled the 8 tools that come back most at the exam: Nmap, Metasploit, Burp Suite, sqlmap, Hydra, Hashcat, BloodHound, Impacket.
What will remain:
- The 28 HTB Academy modules of the Penetration Tester path (~200 hours of home training).
- 10 to 20 HTB Labs machines to finish preparation.
- Three to five 24 h mock exams you impose on yourself on Insane machines.
Plan for 6 more months of training after this course to be ready for CPTS with a first-attempt pass rate above 60 %. Any less and you will be at the 40 % average.
What to remember
- Four certifications matter in 2026: eJPT, CPTS, PNPT, OSCP.
- For a French-speaking curriculum in 2026, CPTS is the best compromise of recognition, price and format.
- The recommended order is eJPT → CPTS → PNPT → OSCP, but two well-chosen ones are usually enough.
- This course prepares directly for the CPTS by following the HTB Academy Penetration Tester Path.
- Plan for 6 more months of training after this course to maximize your exam chances.
Next step
Move to lesson 0.3 — 15-week roadmap to see the weekly calendar of this course, its mapping to the 28 HTB Academy modules, and the progression Gantt chart.