OSEP certification: exam, cost and PEN-300 syllabus
OSEP is the OffSec Experienced Penetration Tester cert, earned through the PEN-300 course. The exam is a proctored, hands-on test of 47 hours and 45 minutes plus 24 hours for the report; you pass with 100 points or by reaching the final objective. The exam is not sold on its own: the course-and-exam bundle starts at US$1,749, and OSEP does not expire.
- Certification
- OffSec Experienced Penetration Tester (OSEP), issued by OffSecOffSec PEN-300 page, checked 10 October 2026
- Training
- PEN-300: Advanced Evasion Techniques and Breaching Defenses (self-paced)OffSec PEN-300 page, checked 10 October 2026
- Cost
- From US$1,749 (course + one exam attempt, 90 days); Learn One US$2,749/yearOffSec PEN-300 page, checked 10 October 2026
- Exam length
- 47 hours 45 minutes, plus 24 hours to submit the reportOffSec OSEP Exam Guide, checked 10 October 2026
- Passing requirement
- 100 points (10 per flag) or the final objectiveOffSec OSEP Exam Guide and Exam FAQ, checked 10 October 2026
- Format
- Proctored, hands-on lab exam; open book, but no AI chatbots or LLMsOffSec OSEP Exam Guide and Exam FAQ, checked 10 October 2026
- Prerequisites
- None formal; OffSec recommends PEN-200/OSCP or equivalent skillsOffSec PEN-300 FAQ, checked 10 October 2026
- Results
- Within 10 business days of submitting the reportOffSec OSEP Exam Guide, checked 10 October 2026
- Validity
- Does not expire; no annual maintenance feeOffSec AMF FAQ, checked 10 October 2026
Know if you're ready for OSEP — before you book.
Certsqill measures your OSEP readiness across every official exam domain — one 0–100 score from coverage, accuracy and consistency that tells you whether to book, keep studying, or sit.
Why people switch to Certsqill
Everything you need to walk in ready
Know where you stand, understand every mistake, and study in your language — one payment, no subscription.
Your OSEP Readiness Score, not a guess
One number from three signals — coverage, accuracy, and consistency — tells you whether to book the exam or keep studying.
Understand every OSEP mistake
When you miss a question, it explains why — using your own answer history to catch the patterns you keep repeating. Included, no subscription.
Explanations in your language, questions stay exam-accurate
Get every explanation in your language while the questions stay in exam-accurate English. Technical terms stay in English — the way the exam writes them.
Everything you need to pass
Why you can trust these OSEP questions
What is the OSEP certification?
OSEP stands for OffSec Experienced Penetration Tester. It is the certification attached to OffSec’s PEN-300 course, Advanced Evasion Techniques and Breaching Defenses, and OffSec pitches it at people who already hold OSCP and at experienced offensive security professionals.
OffSec’s PEN-300 FAQ describes the course as covering more advanced topics of breaching internal network defences through client-side attacks, evading antivirus and defeating application allow-listing, with a focus on chaining attacks together — for example, compromising an Active Directory forest.
OSEP is also one of the three certifications behind OffSec’s OSCE³. OffSec states that earning OSED, OSEP and OSWE automatically grants the OSCE³ certification.
Source: OffSec Help Center — OSCE³ FAQ. Checked 10 October 2026.
How much does the OSEP certification cost?
You cannot buy the OSEP exam on its own. OffSec states that only the OSCP+ exam can currently be purchased without its training, so OSEP always comes with PEN-300.
OffSec lists three individual options. The Course + Cert Exam Bundle starts at US$1,749 and includes 90 days of access to the course and labs plus a single exam attempt. Learn One costs US$2,749 per year and includes one year of course and lab access with two exam attempts. Learn Unlimited costs US$6,099 per year and includes the whole OffSec Learning Library with unlimited exam attempts for a year. Subscriptions renew automatically unless cancelled.
OffSec’s help pages do not print a separate retake price; extra attempts are bought through the Learning Library. Budget for that if you choose the single-attempt bundle.
Source: OffSec — PEN-300: Advanced Evasion Techniques and Breaching Defenses. Checked 10 October 2026.
OSEP exam format: 47 hours 45 minutes, hands-on
The OSEP exam is a practical test in a lab network, not a multiple-choice exam. You get 47 hours and 45 minutes to work through it and then another 24 hours to upload your documentation. All OSEP exams are proctored.
To pass, you either reach the objective named in your exam control panel or collect at least 100 points. The OSEP Exam FAQ states that each flag is worth 10 points, and the Exam Guide awards points for partial and complete administrative control of each target machine.
The report is part of the result. It must document all attacks, including every step, command, piece of code and console output; weak documentation can cost points. OffSec sends results within ten business days of receiving the report.
Source: OffSec Help Center — OSEP Exam Guide. Checked 10 October 2026.
OSEP exam rules: open book, tools and AI
OffSec calls OSEP an open book exam: you may use your notes and online resources — except AI chatbots and LLMs with direct prompt access, which the Exam Guide strictly prohibits. Everything has to be done on the machine running the proctoring software.
Commercial tools are banned, with Metasploit Pro, Cobalt Strike, Core Impact and Burp Suite Pro named explicitly. Open-source and community tools, including Metasploit Community, are allowed.
One reassuring line from the FAQ: bypasses taught in the course and practised in the labs will also work in the exam. The course material is the intended toolset.
Source: OffSec Help Center — OSEP Exam FAQ. Checked 10 October 2026.
OSEP syllabus: what PEN-300 covers
OffSec’s PEN-300 syllabus lists 18 modules. It builds on PEN-200 and moves from code execution through evasion to lateral movement and Active Directory, ending with modules that combine the techniques into full attack chains.
- Operating System and Programming Theory
- Client-Side Code Execution with Office
- Client-Side Code Execution with Jscript
- Process Injection and Migration
- Introduction to Antivirus Evasion
- Advanced Antivirus Evasion
- Application Whitelisting
- Bypassing Network Filters
- Linux Post Exploitation
- Windows Post Exploitation
- Kiosk Breakouts
- Windows Credentials
- Windows Lateral Movement
- Linux Lateral Movement
- Microsoft SQL Attacks
- Active Directory Exploitation
- Combining the Pieces
- Trying Harder
Source: OffSec — PEN-300 syllabus (PDF). Checked 10 October 2026.
OSEP prerequisites: do you need OSCP first?
No formal prerequisite exists. OffSec recommends that you have taken PEN-200 and passed OSCP, or have equivalent knowledge and skills.
The skills OffSec lists are a good self-check: comfort with Linux, enumerating targets, scripting in Bash, Python and PowerShell, and basic Active Directory attacks. Familiarity with C# is described as a plus.
Source: OffSec Help Center — Advanced Evasion Techniques and Breaching Defenses FAQ. Checked 10 October 2026.
OSEP exam prep and training
PEN-300 is self-paced and is the official OSEP training. Work every module, then use the labs to practise chaining the techniques, since passing can also mean reaching the final objective of the exam network.
Write as you go. The only report PEN-300 requires is the exam report, but the exam report is graded, so keeping clean notes, commands and screenshots during lab work is preparation in itself.
Avoid leaked material. OffSec treats sharing, leaking or using exam materials, reports or solutions as an academic policy violation; confirmed cases mean no certification, revocation of certifications already issued and a permanent ban from OffSec courses.
Source: OffSec Help Center — Cheating on a certification exam. Checked 10 October 2026.
OSEP retake policy
If you fail, a cooling-off period applies to that specific exam: 4 weeks after the first failed attempt, 8 weeks after the second and 12 weeks from the third onward. Failed attempts count in total, even across new subscriptions. A newly bought retake is valid for 120 days from purchase.
Exam sets are assigned at random, so OffSec gives no guarantee you will see the same set again on a retake.
Source: OffSec Help Center — Exam retake policy. Checked 10 October 2026.
Does the OSEP certification expire?
No. OffSec states that once you earn an OffSec certification it remains valid indefinitely, with OSCP+ as the exception. The Annual Maintenance Fee of US$145 per year applies only to expiring certifications such as OSCP+, and OffSec lists OSEP among the certifications that do not expire and need no annual maintenance.
Source: OffSec Help Center — Annual Maintenance Fee (AMF) FAQ. Checked 10 October 2026.
OSEP salary and career value
OffSec does not publish salary data for OSEP holders, so this page gives no salary figure. The PEN-300 page describes the course as taking OSCPs and experienced offensive security professionals to the next level.
If you are weighing the cost, OSEP also counts towards OSCE³ together with OSED and OSWE.
Source: OffSec — PEN-300: Advanced Evasion Techniques and Breaching Defenses. Checked 10 October 2026.
OSEP practice questions
The OSEP exam itself is hands-on, so OSEP practice questions on Certsqill cannot replace lab work. What they can do is check your grasp of the concepts behind each PEN-300 module, with an explanation for every answer option and a readiness score per domain.
OSEP questions people ask
What is the OSEP certification?
The OffSec Experienced Penetration Tester cert, earned by passing the exam for OffSec’s PEN-300 course. Source: OffSec, checked 10 October 2026.
How much does OSEP cost?
The course + exam bundle starts at US$1,749 (90 days, one attempt); Learn One is US$2,749 per year with two attempts. Source: OffSec, checked 10 October 2026.
Can I buy the OSEP exam without the course?
No. OffSec states that only the OSCP+ exam can currently be bought without its training. Checked 10 October 2026.
How long is the OSEP exam?
47 hours and 45 minutes, plus 24 hours to upload the report. Source: OffSec OSEP Exam Guide, checked 10 October 2026.
What is the OSEP passing score?
100 points — each flag is worth 10 — or reaching the objective in your exam control panel. Source: OffSec, checked 10 October 2026.
Is the OSEP exam open book?
Yes: notes and online resources are allowed, but AI chatbots, LLMs and commercial tools such as Cobalt Strike are not. Source: OffSec, checked 10 October 2026.
Do I need OSCP before OSEP?
No. OffSec recommends PEN-200/OSCP or equivalent knowledge and skills. Source: OffSec PEN-300 FAQ, checked 10 October 2026.
Does OSEP expire?
No. OffSec lists OSEP among certifications that do not expire and need no annual maintenance. Source: OffSec AMF FAQ, checked 10 October 2026.
What is the OSEP retake waiting period?
4 weeks after the first fail, 8 after the second, 12 from the third onward. Source: OffSec retake policy, checked 10 October 2026.
