CertQuests
Is the OSCP still worth it in 2026?
Yes, the OSCP (now OSCP+ for new candidates) is still worth it in 2026 for anyone targeting an offensive security seat. It costs $1,749 for the Learn One bundle (PEN-200 course + 90-day lab + one exam attempt), takes 300–500 hours to prepare, and appears as required or preferred on more than 70% of US “Junior Pentester” and “Penetration Tester” postings. For candidates moving from SOC L1, sysadmin, or helpdesk seats, the salary jump is typically $25,000–$45,000/year — the cert pays for itself in the first 9 months of the new role.
The two scenarios where it’s not worth it: you already hold OSEP / OSWE / OSED (the OSCP is fully implied by anything one tier above) or you’re committed to a defensive-only path where CySA+, GCIH, or GCFA outranks the OSCP at every screening gate.
The numbers that matter
Before any opinion: here are the facts as of Q2 2026.
- Cost: $1,749 USD for the OffSec Learn One bundle (PEN-200 self-paced course + 90 days of lab access + one exam attempt + one retake voucher). Learn Year (12 months of lab + two exam attempts + access to PEN-100 / PEN-103 prep tracks) lists at $2,599. The standalone exam retake is $249.
- Exam format: 24-hour live practical against six target machines — three chained Active Directory boxes worth 40 points as a single set, plus three standalone boxes worth 20 points each. 70 points required to pass (the 10-point reporting bonus is gone as of 2024). A 24-hour reporting window follows the exam window. As of November 2024, passing earns the OSCP+ designation with 3-year validity.
- Pass rate: ~30% first attempt, ~60% second attempt, ~70% among candidates who complete at least one full Proving Grounds Practice rotation (rooting every box without a hint) before booking. Numbers are community-reported — OffSec does not publish official rates.
- Job posting reach: OSCP / OSCP+ appears in more “Junior Pentester,” “Penetration Tester,” and “Red Team Operator” postings than any other single offensive security cert in the US — consistently listed as required or strongly preferred across LinkedIn, Indeed, and ClearedJobs as of Q2 2026.
- Salary data: The Bureau of Labor Statistics puts the 2024 median wage for information security analysts at $124,910/year. Pentest-specific seats — which almost universally require OSCP at the junior tier — consistently land at or above that median, with junior offers in the $90–130k range and mid-level seats at $115–155k.
The ROI math in plain terms
Total investment to clear the OSCP: $1,749 for the Learn One bundle, $0–$200 for supplementary materials (Proving Grounds Practice is included in Learn One; HackTheBox or TryHackMe VIP runs $14–25/month if you add either), and roughly 400 hours of study time. At a $30/hour SOC analyst / sysadmin opportunity cost, total investment is approximately $13,949.
Typical return: a $30,000–$45,000/year salary increase for a candidate moving from SOC L1 or sysadmin into a junior pentest seat — call the median $35,000/year. That’s $2,917 per month. The cert pays for itself in roughly 5 months at the median delta, and clears its full investment (including opportunity cost) inside the first year. Over three years, the cumulative salary advantage exceeds $105,000 — a return above 650% on the cash + opportunity cost combined.
Even at the conservative end — a $20,000 bump for a SOC analyst staying in the same metro — the payback period is under 14 months on full investment, and under 4 months on cash alone.
When the OSCP IS worth it
- SOC analyst, sysadmin, or helpdesk engineer pivoting offensive: this is the highest-ROI scenario. You bring the network and Windows intuition; OSCP adds the exploitation methodology hiring managers screen for at the junior pentest gate.
- Junior pentester with no cert who has been refused at ATS for 6+ months: the OSCP is the single line on a resume that flips the ATS filter from “no” to “phone screen” at most US managed security service providers and consulting firms.
- Red team analyst at a SOC-heavy shop wanting to move toward purple team / detection engineering. The methodology drill carries over into rule-writing for Sigma, KQL, and Splunk — you cannot author detection logic for a chain you have never executed.
- Government / DoD adjacent candidate in a metro where DoD 8140 applies. OSCP fully satisfies the CSWF Pentester category (DoD 8140 / 8570.01-M) and is now interchangeable with GPEN at most TS/SCI cleared shops.
- You are in PEN-200 already. Sunk-cost reasoning doesn’t apply: the lab time is the value. Even candidates who fail twice and pass on a third attempt overwhelmingly report the experience as career-positive in retrospective surveys.
When the OSCP is NOT worth it
- You already hold OSEP, OSWE, OSED, or OSCE3. Anything one tier above fully implies the OSCP; no employer needs to see both. The OffSec pipeline is OSCP → OSEP/OSWE/OSED → OSCE3; do not loop back.
- You’re committed to defensive-only. If your five-year plan is SOC analyst → SOC engineer → detection engineer → CISO, your $1,749 buys more career velocity inside CySA+, GCIH, GCFA, and a SANS detection-engineering track than inside the OSCP. Pentest methodology helps detection engineers, but the OSCP is overkill at the screening gate for a defensive seat.
- Bench-warmer pentest seat at a low-cost-of-living MSSP already paying $70k regardless of cert. If the salary lift in your specific metro is under $15k and you cannot relocate, the payback period stretches past 18 months — consider PNPT ($499) or eJPT ($249) first.
- Budget is hard-capped under $1,000. Take the PNPT ($499) first. It is gaining recognition at MSSPs, smaller consulting shops, and remote-friendly startups, and a passing PNPT report on your GitHub is enough to land a phone screen. Stack the OSCP on top once you can afford it.
- You hate scripting and refuse to fix BloodHound output by hand. The 2024 AD shift means you will sit on at least one box that requires reading PowerShell or LDAP query output and adapting it. Candidates who try to brute-force the AD chain with cached exploits do not pass.
What changed in 2024–2025 (and why it matters)
Three structural shifts changed the OSCP between 2023 and now.
The exam went Active-Directory-first in March 2024. The legacy 5-box / 25-point-per-box format was retired; the new exam is three chained AD boxes (40 points if you root all three; partial credit only on intermediate compromises) plus three standalone boxes (20 points each). You can clear the standalones and still fail if you don’t crack the AD chain. This is the single biggest shift for prep: BloodHound, Kerberoasting, AS-REP roasting, NTLM relay, and abusing constrained delegation are now mandatory reps, not bonus topics. Candidates from the pre-2024 era who memorised buffer overflow muscle memory and skipped AD are the ones currently failing.
Buffer overflow is gone. The Windows BoF module that anchored the 2017–2022 exam was retired in 2023. PEN-200 now covers binary exploitation only at a conceptual level. If you want hands-on BoF, that lives in PEN-300 (OSEP) and EXP-301 (OSED) — not OSCP.
OSCP+ replaced lifetime OSCP for new candidates in November 2024. Anyone passing PEN-200 after that date receives OSCP+ with 3-year validity. Recertification requires either re-taking the exam, earning a higher OffSec cert, or completing 120 OffSec CPEs through the Learn Year platform. Legacy lifetime OSCP holders are grandfathered, but ATS filters are quietly migrating to OSCP+ language — expect “OSCP or OSCP+” on most postings through 2026, then OSCP+ only by 2027.
Is the cert going stale?
No. The 2024 AD-first format and the OSCP+ recert window were a direct response to the criticism that the legacy OSCP was teaching 2010-era exploitation against 2024-era networks. Active Directory misconfigurations — Kerberos abuse, ADCS template flaws, certificate-based authentication chains — are the dominant attack surface in 2026 enterprise environments, and the exam now tests exactly that surface. The methodology stays valid even as specific exploits get patched: enumerate, identify the chain, pivot, document.
OffSec also expanded Proving Grounds Practice (a parallel lab to PEN-200) with 100+ machines, dropped the price of Learn One by $300 in 2024, and added free PEN-100 / PEN-103 prerequisite tracks that previously required separate purchase. The cert is actively maintained, not coasting on legacy reputation.
Bottom line
For anyone targeting an offensive security seat in 2026, the OSCP / OSCP+ remains the highest-conviction single spend in the offensive cert market. It’s the industry’s de facto ATS gate for junior pentester, red team analyst, and pentest consultant roles, the exam that proves you can chain real exploits under sleep-deprived pressure rather than recite OWASP Top 10, and the cert with the most documented salary-uplift data in offensive security. If you’re on the fence, check the open postings in your target metro: if more than half of “Junior Pentester” or “Penetration Tester” postings list OSCP, the answer is yes.
Start OSCP-style practice right now — no signup
CertQuests has engineer-written security practice questions with full explanations on every answer. Free, no account required.
Frequently asked questions
Is the OSCP worth it in 2026?
Yes, for almost anyone targeting a junior or mid-level offensive security role. The OSCP / OSCP+ is still the credential pentest hiring managers screen for above all others. The $1,749 Learn One bundle plus 300–500 hours of practical study typically yields a $25,000–$45,000/year salary increase for candidates moving from helpdesk, sysadmin, or SOC analyst seats into junior pentest or red team roles — payback under nine months.
What is the OSCP pass rate?
OffSec does not publish official pass rates, but community reporting across r/oscp, the OffSec Discord, and prep providers puts the first-attempt pass rate at roughly 30%. Second-attempt clears the 60–65% range, and candidates who consistently root every box on at least one full Proving Grounds Practice rotation before booking the real exam pass closer to 70%.
How long does it take to study for the OSCP?
Typical range is 300–500 hours across 6–9 months, alongside a full-time job. Candidates with no prior Linux command-line, networking, or scripting reps add another 80–150 hours of fundamentals. Most successful candidates report 4–6 months of focused lab time across PEN-200 and Proving Grounds before booking the exam.
How much does the OSCP increase salary?
Candidates moving from SOC L1, sysadmin, or helpdesk seats ($55k–$75k) typically enter junior pentester / red team analyst roles at $90k–$130k with OSCP. Mid-level pentest seats requiring OSCP land at $115k–$155k. The U.S. BLS information security analyst median was $124,910 in 2024 — pentest seats consistently meet or exceed that median.
What is OSCP+ and do I need it?
OSCP+ is OffSec’s renewed credential introduced in November 2024. New candidates passing the PEN-200 exam earn OSCP+ automatically, which carries a 3-year validity window. The legacy lifetime OSCP is still recognised, but employers are moving toward OSCP+ language in job postings because the 3-year recert proves currency on the Active Directory attack chain that now dominates the exam.
OSCP vs CEH vs PNPT — which should I take?
OSCP for hands-on pentesting roles, PNPT as a cheaper alternative if your budget is under $500, CEH only if a government / DoD contract specifically requires the DoD 8140 credential. CEH does not satisfy ATS filters at most private-sector pentest shops. PNPT ($499) is gaining recognition but still lags OSCP at most large enterprises and managed service providers; it is a strong stepping-stone.
Is the OSCP harder than expected?
Most candidates find the 24-hour exam harder than the lab. The 2024 shift to the Active Directory attack chain (three chained AD machines plus three standalone) raised the bar for candidates who treated PEN-200 as a CTF speedrun rather than a methodology drill. The exam tests recovery and pivoting under sleep deprivation; the candidates who pass plan a sleep schedule before the exam clock starts.
How we wrote this
No OffSec, bootcamp, or training-vendor revenue. Cost figures reflect the public OffSec store pricing on PEN-200 as of June 2026. Pass-rate estimates are community-reported (r/oscp, OffSec Discord, prep-provider blogs); OffSec does not publish official numbers. Salary anchors come from the BLS Occupational Outlook Handbook (information security analysts, 2024 median $124,910) cross-referenced against Penetration Tester / Junior Pentester postings on LinkedIn, Indeed, and ClearedJobs and self-reported offers on Levels.fyi as of Q2 2026. Investment math uses a $30/hour SOC analyst / sysadmin opportunity cost. Tell us what you’d update.
Last reviewed: June 23, 2026.