OSEP
Offensive Security Experienced Penetration Tester
The OffSec Experienced Penetration Tester (OSEP) is based on the PEN-300 course and addresses advanced techniques around antivirus evasion, Active Directory attacks, and living-off-the-land methods. The fully practical 48-hour exam (47:45 hrs exam + 24 hrs report) in a simulated enterprise environment is the key difference from knowledge-based certifications—it tests real attack capabilities. OSEP is considered credible proof of high-level offensive competence in red team circles, but requires solid OSCP knowledge. Together with OSED and OSWE, OSEP forms the OSCE³ trio.
› Quality score
Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.
› Market signals
public, citable inputs to the recognition score› Built for these roles
› Exam format
Practical: 47 hours 45 min. hands-on exam (evasion, AD attacks, advanced exploitation) + report. Proctored.
Retake voucher $249 separately. No wait period beyond exam scheduling availability.
› Recertification
Valid indefinitely. No renewal required.
› NICE Framework work roles
The NIST NICE work-role IDs this cert maps to. NICCS lookup.
› Core domains covered
The 3 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.
Methodology (OSSTMM, PTES), web/network/mobile pentesting, social engineering, purple teaming.
Firewalls, IDS/IPS, network segmentation, DNS security, SD-WAN, VPN, traffic analysis, wireless security.
AuthN/AuthZ, SSO, MFA, PAM, RBAC/ABAC, identity governance, FIDO2/passkeys, plus non-human identity: service accounts, workload identity, agent / plugin identities.
› Prerequisites
No formal prerequisites. PEN-300 course recommended. OSCP-level knowledge required.
› Progression
requiredrecommendedWhere this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.
No vendor-gated prereqs.
No certs require this one.
› Study materials
Curated starting points. Not exhaustive — vet each against your learning style and the current exam version.
- Sektor7 + Maldev Academy (paid alternatives)
- r/oscp (OSEP threads)
› Version & lifecycle
› Salary signal
Red team operator / advanced pentester, US, 5+ years.
Robert Half Salary Guide + Glassdoor 'Red Team Operator' aggregations · 2024 · US base only · p25–p75 range
› How it compares
OSEP is the next OffSec rung after OSCP — focuses on evasion + AD-heavy environments.
↔ Compare side-by-sideOSCE3 (OSWE+OSEP+OSED) is the senior OffSec triple-cert achievement; OSEP is one component.
↔ Compare side-by-side› Common exam traps to study
Cybersecurity cert exams reuse the same 25 distractor patterns over and over — category confusion, RTO vs RPO, IDS vs IPS, MD5 vs SHA-256, and more. Once you can name the trap, you stop falling for it. Each archetype page covers what it is, the specific pairs candidates confuse, and how to avoid it.
See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.