SecProve
ExpertVendor-neutralOffSec· issued from US

OSEE

Offensive Security Exploitation Expert

Offensive Security Exploitation Expert

Official page at OffSec↔ Compare with another cert
Exam fee
$5,499
Ongoing
$0/yr AMF
Study time
400–800 hrs
Delivery
Online proctored
Validity
3 yrs (renewal cycle)

› Quality score

29.5 / 40

Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.

Blueprint rigor
How well-defined and rigorous the exam blueprint is.
EXP-401 syllabus is granular: shellcode, kernel, advanced Windows internals.
8.5/10
Practical evidence
Hands-on labs / written reports vs pure MCQ.
71h45m fully practical exam against Advanced Windows Exploitation targets — the hardest hands-on cert in the catalogue.
9.5/10
Currency & upkeep
How aggressively content is kept current with the field.
Refresh cadence is irregular; last meaningful update lags the field.
5.5/10
Market recognition
How often this signal actually moves a hiring decision.
Niche but revered in exploit-dev / kernel-research circles; ceiling on commercial pentesting recognition. [Holders: 200, 2024-12]
6.0/10

› Market signals

public, citable inputs to the recognition score
Holders worldwide
200
as of 2024-12 · source

Hardest OffSec exam — fewer than 250 holders.

› Built for these roles

Senior Security EngineerPenetration Tester (experienced)Incident Responder (Lead)Security ArchitectSOC Lead / Red Team Lead

› Exam format

Practical: 71 hours 45 min hands-on exam (Advanced Windows Exploitation) + report. Proctored. Hardest OffSec exam.

Passing score
Lab points-based (typically 60+/100 with report)
Retake policy
Fee: $249 per attempt
Wait: 0d between attempts

Retake voucher $249 separately. No wait period beyond exam scheduling availability.

› Recertification

Valid indefinitely. No renewal required.

› NICE Framework work roles

The NIST NICE work-role IDs this cert maps to. NICCS lookup.

PD-WRL-007
Recognition
Global
Exam languages
en

› Core domains covered

The 3 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.

A9Penetration Testing & Red Teaming

Methodology (OSSTMM, PTES), web/network/mobile pentesting, social engineering, purple teaming.

A21Malware Analysis & Reverse Engineering

Static/dynamic analysis, sandbox analysis, assembly/disassembly, packer analysis, YARA rules, malware family classification.

A4Application Security

OWASP Top 10, secure SDLC, SAST/DAST/IAST, API security, code review, DevSecOps.

› Prerequisites

Experience

No formal prerequisites. EXP-401 course (live training, approx. 5,499 USD). Expertise in exploit dev and reverse engineering required.

› Progression

requiredrecommended

Where this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.

Required prereqs (0)

No vendor-gated prereqs.

Recommended priors (1)
OSEDOffSec
OSEE
OffSec
Required by (0)

No certs require this one.

Recommended next (0)

No follow-on certs reference this one yet.

› Study materials

Curated starting points. Not exhaustive — vet each against your learning style and the current exam version.

Practice tests
  • OffSec Proving Grounds Practice
Free / community

› Version & lifecycle

Current version
EXP-401 (2023)
Released
2023-09

OffSec's most demanding exam. Often pursued after OSED.

› Salary signal

Senior vulnerability researcher / advanced exploit developer, US, 7+ years. Very rare credential.

$160K–$260K
median $200K

Robert Half Salary Guide + community salary surveys · 2024 · US base only · p25–p75 range

› How it compares

vs
OSED

OSED is user-mode Windows exploit dev; OSEE is the deepest single-domain advanced exam, kernel + bypass focus.

↔ Compare side-by-side
vs
GXPN

OSEE is laser-focused Windows exploit dev; GXPN is broader pentest + exploit-writing methodology.

↔ Compare side-by-side

› Careers that commonly pursue this cert

Malware Reverse Engineer

Dissect malicious software to understand capabilities, extract indicators, and produce attribution. A specialist role that powers threat intelligence, detection engineering, and advanced IR.

See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.

Highlight on the domain mapBrowse all certifications