OffSec OSCP: Bundled Pricing, the 24-Hour Exam, and the OSCP+ Change

Pass this exam once and you now hold two credentials: one that expires in three years and one that never does. That oddity, introduced in November 2024, is the newest thing to understand about OSCP, but the older thing still matters more: OffSec has never sold this exam the way other vendors sell theirs, and the price of entry is the price of a course. Here is how the pricing actually works, what the 24-hour exam demands, and what the OSCP+ split means for renewal.

Who this cert is actually for

OSCP is the credential technical hiring managers in offensive security respect most at its tier, precisely because it cannot be passed from a question bank. The exam requires compromising real machines under proctored observation and then documenting the work professionally, so the people it fits are aspiring and working penetration testers who already have solid fundamentals: comfortable in a Linux shell, competent with Windows and TCP/IP networking, able to read and adapt a Bash or Python script. OffSec enforces no formal prerequisites, but PEN-200 is not a beginners’ course and the exam punishes gaps in fundamentals ruthlessly.

Hold off if you are still building those fundamentals; Security+ territory and a year of deliberate lab practice first will make the expensive course time count. If you want an offensive-security credential with a lower entry price and a conventional exam format, CompTIA PenTest+ covers the same conceptual ground for $439, though it buys less respect from technical interviewers. PenTest+ vs OSCP runs the full comparison. And if your trajectory is security leadership rather than hands-on exploitation, the study hours point toward ISC2 CISSP instead; OSCP’s value is almost entirely in proving you can do the work, not manage it.

What it costs all-in

OffSec’s pricing is course-first, and the numbers only make sense once you see that. The standard path is the PEN-200 Course and Certification bundle at $1,749: 90 days of course and lab access plus one exam attempt. OffSec ran a limited-time “Save $250 on select Course + Cert Bundles” promotion from July 2026 that brought PEN-200 to $1,499; as of October 6, 2026 it has ended and both the PEN-200 page and OffSec’s pricing page show the $1,749 list price again. OffSec discounts are rare and short, and the price watch records them when they appear. The subscription tier, Learn One, is $2,749 a year (auto-renewing) for a year of access to one course stream, the lab environment, and two exam attempts. OffSec’s individual pricing page now lists only Learn One, the Course + Cert Bundle, and the 100-level CyberCore; the old Learn Unlimited tier no longer appears, and team plans are sold separately.

A standalone exam-only purchase also exists: the OSCP+ Standalone Exam at $1,699, which includes two exam attempts within a 90-day period and no course materials. It is easy to misread. It is not the option for someone re-attempting after a failed try; OffSec prices that scenario separately and far cheaper, a $249 exam retake for candidates who have exhausted the attempts included in their purchase, which per OffSec’s help center must be scheduled and taken within 120 days. The $1,699 standalone exam instead targets candidates who prepared outside OffSec’s own materials, self-taught or trained elsewhere, and OSCP+ holders using a fresh pass to renew the plus designation. That is a real path, but most self-taught candidates underestimate how much of OSCP’s difficulty lives in PEN-200’s labs specifically rather than in the exam’s subject matter, so treat the standalone exam as a bet on your own preparation, not a discount. There is no cheap voucher path into a first attempt through the standard route, and budgeting for OSCP means budgeting at least $1,749, realistically with lab-time discipline to match, since 90 days of access rewards candidates who prepared their fundamentals before the clock started. Set that against every other credential on the ROI Index.

The exam itself

The exam is a 24-hour, remotely proctored, hands-on penetration test against a live environment, followed by a further 24 hours to write and submit a professional report documenting how each compromise was achieved. Scoring is out of 100 points: three standalone machines worth 60 points in total, and an Active Directory set (two clients and a domain controller) worth 40. Passing requires 70 points, and the report is not a formality; undocumented or poorly evidenced work does not earn the points the exploitation itself might have.

Bonus points deserve a plain statement, because most OSCP write-ups online are out of date on this. Under the old policy, candidates could earn 10 bonus points by completing course exercises and lab documentation. That ended November 1, 2024: no bonus points exist anymore, and the final score comes solely from exam performance. Any guide telling you to grind exercises for a scoring cushion is describing an exam that no longer works that way, which does not make the exercises worthless, only worthless as arithmetic. OffSec publishes no pass rate, so treat every “OSCP pass rate” figure you encounter as invented.

Renewal and the OSCP+ split

Since November 1, 2024, passing the exam awards two credentials at once: OSCP+ and OSCP. The difference between them is expiry, and only that. OSCP+ expires three years from issuance; the OSCP earned alongside it does not expire, and everyone who earned OSCP before the change keeps a non-expiring credential for life. OffSec’s stated intent is that OSCP+ signals current, recently validated skill while OSCP records that you passed the exam at some point.

Keeping OSCP+ current now has published mechanics and published prices. OffSec lists three paths: pass a recertification exam within six months of the plus expiry date, pass a qualifying higher OffSec exam (OSEP, OSWA, OSED, and others) before it expires, or complete OffSec’s CPE program. The CPE route, per OffSec’s help center, means 120 CPE credits over the three years plus an Annual Maintenance Fee of $145 for each year of the cycle; OffSec also sells an Annual Membership Program at $299 a year that bundles that fee with rotating labs, Proving Grounds Practice, and CPE-eligible content. The exam route costs whatever the exam costs at the time: OffSec markets the $1,699 OSCP+ Standalone Exam for exactly this renewal use.

The nine-year picture is therefore honest but unusual: the legacy OSCP costs nothing to hold forever, while a continuously valid OSCP+ costs either nine $145 maintenance fees ($1,305) on the CPE route or two more passed exams on the exam route. Whether that expense is worth it depends on whether employers in your market start distinguishing the plus from the legacy credential, something worth watching rather than assuming.

Nine-year cost of ownership: $1,749 to $3,054, the $1,749 Course and Certification bundle once if you keep only the lifetime OSCP, up to $3,054 if you also keep OSCP+ current through the CPE route at $145 a year for nine years, assuming a first-attempt pass and CPE credits earned through free or included activities. The exam route costs more: two further $1,699 standalone exams would put the total near $5,150. Certification renewal costs explained sets that against every other credential we track.

What it does for the occupation you are entering

OSCP maps to the information security analyst occupation (BLS code 15-1212), the same broad BLS category that covers penetration testers, since federal occupational data does not break offensive security out on its own. The panel on this page shows the current national median wage and headcount for that occupation; it describes the field, not a payout attached to this certificate. OSCP’s concrete function in hiring is different from most credentials on this site: rather than clearing HR keyword filters, it clears technical skepticism. A hiring manager who has held the certification knows what 24 proctored hours against unfamiliar machines demands, and that shared knowledge is the signal. What it converts to in compensation depends on the roles you land and the consulting or internal work you do with it, not on the credential itself.

Common mistakes

Assuming the standalone exam is the cheap re-attempt option. The $1,699 standalone purchase is not a discount for repeat candidates; it targets first-time, externally-prepared candidates who deliberately skip PEN-200’s course and lab access. Anyone re-attempting after exhausting a bundle or Learn One attempt should buy OffSec’s $249 exam retake instead, not the $1,699 standalone exam. And for first-timers, the $50 spread against the full bundle is not really a discount either: most self-taught candidates underestimate how much of OSCP’s difficulty lives in PEN-200’s labs specifically, so skipping the course without lab-equivalent preparation built elsewhere is a false economy.

Preparing from pre-2024 advice. The bonus-point strategy, older exam structures, and outdated machine formats still dominate search results and forum threads. Verify anything tactical against OffSec’s current exam guide before building a study plan around it, or you will optimize for a scoring system that was retired in November 2024.

Treating the report as an afterthought. Half the professional skill this credential certifies is documentation, and candidates fail with passing-level exploitation because the evidence trail was thin. Take screenshots and notes as you work, not at hour 23, and rehearse writing up practice machines the same way before exam day.