Selkobase certification index

Penetration Tester Certification Path: A Reviewed Route from Offensive Security Foundations to Advanced Skills

Where hands-on practical exams differ from knowledge exams, and why it matters

Penetration testing is judged on what you can demonstrate, so the assessment style matters as much as the credential name. This reviewed route orders foundations, a core practical credential, specializations, and advanced adversary credentials, and shows which exams are practical, report-based, or knowledge-based.

Switch careersRole: Penetration TesterAll paths

Key takeaways

  1. 01

    The credentials differ sharply in assessment style: some are knowledge exams and others are long hands-on practical exams with a report, and employers weigh them differently.

  2. 02

    No credential here formally requires another, but several advanced OffSec credentials assume the skills of the core one.

  3. 03

    The knowledge-based and practical versions of the EC-Council hacker credential are different assessments, and only the practical one tests hands-on ability.

  4. 04

    Upkeep differs between providers, and the current OffSec core credential has a form that expires, so check renewal rules before you choose.

Who it is for

System and network administrators, developers, and security analysts who understand how systems and networks work and want to test them professionally and ethically.

The goal

Be able to plan and run authorized penetration tests, from reconnaissance to reporting, with hands-on evidence that employers can verify.

Maybe not for you

People who prefer defending systems should follow the cybersecurity analyst pathway, because this route is offensive.

Where to start

Where to start on the Penetration Tester path depending on your skills

Start with the foundations step if you are new to security. If you are comfortable with Linux, networking, and scripting, begin with the core penetration testing credential, and if you already test systems, move to the specialization or advanced step that fits your work.

Where are you starting?

Choose your background. We mark where to begin and fold away steps people with your experience usually skip.

The route

The route from offensive security foundations to advanced adversary skills

The route starts with offensive security foundations, builds a core penetration testing credential, and adds specializations in web, wireless, and cloud testing. Advanced adversary credentials are optional, and each step shows whether its exam is practical or knowledge-based.

  1. 1
    Step 1Pick any that fitNew to the field

    Learn offensive security foundations

    Get acquainted with ethical hacking concepts and with the Kali Linux toolset used for testing. Both are introductions rather than hands-on practical exams.

    Each option adds something different. Take the ones that match your work.

    2 options

    How to choose

    Ethical Hacking Essentials covers concepts and attack stages for newcomers. The Kali Linux credential is about the platform and its tools, so take it if you want to get comfortable with the tooling before a practical course.

    You can skip this step if

    Suggested skip if you already use common testing tools and understand how attacks unfold.

    After this step you can

    • Describe the stages of an attack and the aims of ethical hacking
    • Navigate the Kali Linux environment and its common tools
  2. 2
    Step 2Pick oneSome experience

    Prove core penetration testing skills

    Show that you can find and exploit weaknesses in networks and systems. Assessment style matters here: choose a credential that tests hands-on work if you want to prove practical skill.

    These are real alternatives for the same goal. Choose the one that fits.

    4 options

    How to choose

    OffSec's credential is a long practical exam with a written report and is widely used as a practical benchmark. GIAC Penetration Tester is a proctored exam that includes lab-style questions. The EC-Council hacker credential is knowledge-based, while its practical version tests hands-on skill. The options are not equivalent in hands-on depth.

    After this step you can

    • Enumerate, exploit, and escalate privileges across networks and systems
    • Report findings clearly enough for a client to act on them
  3. 3
    Step 3Pick any that fitExperienced

    Specialize in a testing area

    Add depth in one area of testing: web applications, wireless networks, or cloud environments. The options differ a great deal in difficulty and scope.

    Each option adds something different. Take the ones that match your work.

    4 options

    How to choose

    Web Expert is the most demanding option and focuses on source code review and web exploitation. GIAC Web Application Penetration Tester covers web testing in a proctored exam. The wireless credential is narrow and lighter, and the cloud penetration tester credential focuses on testing cloud environments.

    After this step you can

    • Test web applications and review code for exploitable weaknesses
    • Assess wireless or cloud environments for weaknesses
  4. 4
    Step 4Pick any that fitOptional

    Reach advanced adversary level

    Go beyond standard testing into evading defenses, writing exploits, or running broad end-to-end engagements. These are demanding credentials that follow substantial experience.

    Each option adds something different. Take the ones that match your work.

    4 options

    How to choose

    Experienced Penetration Tester covers evading defenses and OffSec recommends core skills first. Exploit Developer covers writing exploits for Windows. GIAC Exploit Researcher covers exploit research and advanced testing, and Certified Penetration Testing Professional is a broad practical across many environments.

    You can skip this step if

    Suggested skip unless your work includes advanced engagements or exploit development.

    After this step you can

    • Evade defenses and move through hardened environments
    • Develop and adapt exploits for real targets

Effort and upkeep

What this path asks of you

Steps

Steps

4

3 required

Certifications on the reference route

Certifications on the reference route

3

Study effort

Study effort

555-1010h

Exam fees

Exam fees

$3,797

Reference route estimates use the recommended option at each required step and come from the structured certification records. Prices and study time change and vary by region, so confirm with the provider. Last reviewed: Oct 22, 2026

Effort and upkeep

The foundations step is light. The core credential is the main hurdle and rewards extensive lab practice more than reading. Specialization credentials are narrower but still demanding, and the advanced credentials are long practical exams that follow substantial experience.

Keeping it current

Upkeep differs a lot. Some OffSec credentials do not expire, while the current form of its core credential does. GIAC and EC-Council credentials use continuing education and fees. Check renewal terms before you commit.

Where it leads

Where the Penetration Tester path leads in offensive security work

The route prepares you for penetration testing and security consulting and for specializations in web application testing, cloud testing, red teaming, or exploit development. The role page lists the skills and related certifications connected to the work.

You come out prepared for penetration tester and security consultant roles, with specializations such as web application testing, cloud testing, red teaming, or exploit development.

Explore the Penetration Tester role

More paths

Other paths worth comparing

  • Switch careers

    AI Governance Specialist pathway

    Add AI governance to a risk, privacy, audit, or security career

    From AI literacy through an AI governance credential and an established risk, audit, or security credential to advanced AI audit, risk, or security credentials.

    • 4 steps
    • 10 certifications
    Entry pointsNew to the fieldSome experienceExperienced
    AI Governance SpecialistView the path

  • Switch careers

    Data Engineer pathway

    Switch into data engineering on AWS, Fabric, Databricks, Snowflake, or Google Cloud

    From a data fundamentals credential through a platform data engineering associate and optional Spark skills to a professional-level data engineering credential.

    • 4 steps
    • 10 certifications
    Entry pointsNew to the fieldSome experienceExperienced
    Data EngineerView the path

  • Switch careers

    DevOps Engineer pathway

    Grow into DevOps: from Linux administration to automation at cloud scale

    From Linux fundamentals through administration, automation and containers, and a cloud associate to a cloud DevOps professional credential.

    • 5 steps
    • 16 certifications
    Entry pointsNew to the fieldSome experienceExperienced
    DevOps EngineerView the path

Reviewed and editorial. Paths suggest an order; they do not replace the provider's own requirements.

Pick the path that matches the role you are aiming for

Open the path closest to your goal, check where your current experience places you, and follow the links to the certifications behind each step. If no path fits yet, search certifications directly and compare level, provider, and assessment style.

Certification paths by career goal

Related paths

Certification paths by career goalPenetration Tester Role OverviewSearch Certifications by FiltersBrowse certifications by job roleAI Governance Specialist certification pathCisco Network Engineer certification pathCloud Engineer certification pathCloud Security Engineer certification pathCybersecurity Analyst certification pathData Engineer certification pathDevOps Engineer certification pathPenetration Tester certification path