EC-Council CEH v13: Ethical Hacking Cert for Security Pros in 2026

CEH is the credential that defined the phrase “ethical hacking” for enterprise hiring managers.

Whether you think CEH is the best security certification or not, it is undeniably the most recognised entry point into the security testing space for employers who are not yet familiar with OSCP or OffSec's portfolio. Launched in 2003, EC-Council's Certified Ethical Hacker has been through thirteen major versions and is now held by over 500,000 professionals worldwide. It appears in more security job postings than any other offensive security credential, and it satisfies DoD 8570/8140 baseline requirements for CNDSP roles that OSCP does not formally cover. For candidates entering the security field from a networking or sysadmin background, CEH provides a structured map of the attacker mindset — covering every phase of a cyber attack from initial reconnaissance through post-exploitation — in a format that most hiring managers recognise on sight.

CEH v13, released in 2023, made two substantial changes to the curriculum. First, it added an entire AI module: candidates now study how threat actors use machine learning models to automate reconnaissance, generate convincing phishing content, and probe for vulnerabilities faster than traditional tools. Second, the OT and SCADA hacking module was expanded to reflect the increasing convergence of IT and operational technology in industrial environments. Both additions reflect where real-world attacks were heading when the curriculum was revised. The exam still tests all the traditional attack domains that have defined CEH since its early versions, but the AI additions make v13 the most current version of the content the exam has ever contained.

This guide covers the exam format, all 20 module domains, how CEH compares to CompTIA PenTest+ and OSCP, and the CEH Practical exam for candidates who want a performance-based component.

Exam format and logistics

CEH v13 is delivered as a 125-question multiple-choice exam with a 4-hour time limit. Questions are scenario-based — a situation is described and you select the most appropriate attack technique, tool, or countermeasure. The passing threshold is approximately 70%, though EC-Council uses a scaled scoring model where the exact number of correct answers required varies by the specific question pool drawn from its item bank. EC-Council does not publish the exact cut score, but 70% is the documented target.

The exam is delivered either through EC-Council's own testing platform (ECC Exam) or Pearson VUE. Both options offer in-person and online proctored formats. EC-Council requires candidates to demonstrate either two years of IT security work experience or completion of an official EC-Council training course (in-person, live online, or self-paced). Candidates who cannot meet the experience requirement must purchase training; this is how EC-Council bundles exam vouchers with courseware at lower effective rates than purchasing the voucher alone.

Maintaining CEH requires earning 120 Continuing Education (CE) credits over the three-year validity period plus maintaining an active EC-Council membership (~$80/year). CE credits are earned through training, conference attendance, writing articles, or earning additional EC-Council certifications. Candidates who let the cert lapse must retake the exam.

The 20 CEH v13 modules

The CEH curriculum maps the complete lifecycle of a cyber attack in sequence, from initial target selection through cover-up. Understanding this attack chain structure is as valuable as the individual module content — it gives security engineers a mental model for thinking like an adversary when designing defences.

CEH vs CompTIA PenTest+ vs OSCP: which path is right?

CEH gets you into the room for security analyst interviews. OSCP closes the deal for penetration tester roles. They are not direct competitors — they address different career stages and different employer requirements.

CEH Practical: the hands-on add-on

EC-Council introduced the CEH Practical exam as a response to the common criticism that passing CEH multiple-choice questions does not prove you can run an actual exploit. CEH Practical is a 6-hour, proctored, live lab exam administered via iLabs (EC-Council's virtual lab platform). Candidates are given a set of machines in a simulated corporate network and must answer 20 practical challenges by demonstrating actual exploitation: performing a network scan, identifying a vulnerability, running an exploit to gain access, and capturing a flag (a specific string or file that proves compromise).

CEH Practical costs approximately $550 in addition to the main exam fee. Passing both exams earns the “CEH Master” designation. For candidates applying to penetration tester roles at organisations that recognise EC-Council credentials, CEH Master is significantly more competitive than CEH alone because it addresses the hands-on skill gap that hiring managers who understand the space know exists with the multiple-choice exam.

For candidates who pass CEH and then want to progress to OSCP, the CEH Practical is reasonable preparation — it introduces the rhythm of time-limited live exploitation under exam conditions, which is the core challenge of the OSCP 24-hour lab exam. CEH Practical is not as difficult as OSCP (the lab challenges are more directed and the tools are more constrained), but it is a meaningful intermediate step.