OffSec PEN-200 and the OSCP+ certification

What it is

PEN-200 is OffSec's self-paced penetration testing course, and passing its exam earns the OSCP (Offensive Security Certified Professional) and OSCP+ certifications. Penetration testers are hired by organisations to assess their systems under a written contract that defines exactly what may be tested and when. PEN-200 teaches that job's methodology in OffSec's own lab network: planning and scoping, information gathering, identifying and validating weaknesses, and documenting evidence so the client can fix what was found.

This is not a first course. It sits near the end of an offensive security learning path, after networking, Linux, scripting and a good deal of legal lab practice.

The exam

The exam is a 24-hour proctored, practical assessment inside OffSec's own lab environment, followed by a professional written report that you submit afterwards. There is no multiple choice section: you are graded on what you can demonstrate in the lab and on how clearly your report documents it. Report writing is a large part of the real job, and OffSec treats it that way; a strong technical attempt with a poor report can still fail.

OSCP versus OSCP+

Passing the exam now earns two certifications. Per OffSec's official course page, the OSCP+ designation "will expire three (3) years from issuance", while "the OSCP certification has no expiration date and continues to be valid indefinitely". You can keep the "+" by passing a recertification exam, earning another qualifying OffSec certification, or completing continuing education. If OSCP+ lapses, you still hold the OSCP.

Free versus paid

PEN-200 is not free. As of 2026-09 the official course page lists a Course + Cert Bundle at $1,749 (90 days of course and lab access and a single exam attempt), a Learn One subscription at $2,749 a year (one year of one course, its labs and two exam attempts), and an OSCP+ standalone exam at $1,699 for people who have prepared elsewhere. OffSec has changed these tiers before, so check the live page.

Prerequisites and stepping stones

OffSec expects comfort with networking, the Linux command line and some scripting. Many learners first build fundamentals on TryHackMe or HTB Academy, and some take a cheaper practical entry level certification such as INE's eJPT or TCM Security's PNPT to check they enjoy the work before paying for PEN-200.

Ethics and scope

Everything in PEN-200 happens in OffSec's own lab, built to be tested. Only test systems you own or are explicitly authorised to test: your own lab, a CTF, or an in-scope bug bounty programme. Real penetration testing always starts with written authorisation and an agreed scope, and a certification is never permission to test anything.

Common questions

Can I retake the exam? Yes, for a fee unless your plan includes more than one attempt; the Learn One plan includes two.

Is it worth the price for a student? Only once you are sure you want an offensive security career. For a first security job, Security+ or CySA+ plus hands-on defensive practice is usually a cheaper start.

Will it get me hired? No certification guarantees a job. OSCP is widely recognised in penetration testing hiring, but employers still look for fundamentals, communication skills and clear reports.