After months of grinding through challenge labs and finally sitting for the exam, Iâve officially passed the Offensive Security Experienced Penetration Tester (OSEP) certification. This wasnât originally on my roadmapâââa coworker recommended it after I cleared OSCP, and I was hesitant at first. But after seeing how much the course material impacted my day-to-day work, I decided to sit for the exam even though I had OffSec Enterprise without a voucher. Now that Iâm on the other side, I want to share an honest breakdown of what worked, whatâs missing, and whether this certification is right for you.
The Unpopular Opinion: I Donât Recommend It (But Hear Me Out)
Let me start with what might seem like a contradiction: OSEP is currently my favorite certification, and Iâve used what I learned in every single assessment since starting the course. The material is solid, practical, and immediately applicable to real-world pentesting. But I still donât recommend it.
Hereâs why: The OSEP is missing critical Active Directory attack vectors that are table stakes in 2025. No ADCS coverage. No SCCM. No WSUS abuse. These arenât niche techniquesâââtheyâre foundational AD exploitation paths that certifications like CRTP, CRTE, and especially HTBâs CAPE cover extensively. The course needs an update to reflect modern TTPs, and until that happens, I canât in good conscience tell someone to drop $1,500+ on it when superior alternatives exist.
That said, if your employer is footing the bill? Absolutely go for it. The OSEP is well-recognized in the industry, and the hands-on skills youâll develop are invaluable. Itâs 1/3 of the OSCEÂł, and the OffSec brand still opens doors. Just donât expect it to be comprehensive AD training.
What OSEP Gets Right
Despite my criticisms about missing content, the course excels in several areas:
1. Focused Learning Curve
Compared to OSCPâs sprawling scope, OSEP is refreshingly focused. The learning curve is manageable but still requires you to think critically about each challenge. Youâre not drowning in a sea of unrelated topicsâââeverything builds toward sophisticated exploitation in restricted environments.
2. The âSimple Thingsâ That Make All the Difference
This is where OSEP truly shines. The course teaches you practical tricks that seem small but compound into massive efficiency gains:
- Running
chownon files as root to change owner before usingscpto transfer them to your attack box
- Leveraging silver tickets to access Linux servers with GSSAPI enabled in SSH
- Process hollowing for AV/EDR evasion (this became a staple in my toolkit)
These arenât flashy techniques, but theyâre the kind of knowledge that separates efficient operators from those constantly fighting their tools.
3. Real-World Obstacles
Unlike OSCP where finding the right exploit often means youâre done, OSEP throws realistic hurdles at you even after initial compromise. You might have everything set up correctly, understand the vulnerability, and still get blocked by:
- Antivirus/ASR rules
- PowerShell Constrained Language Mode (CLM)
- Application whitelisting
- Other defensive measures
The first few challenge labs felt rough because of this. But this is exactly what makes the course valuableâââyouâre not just learning to exploit vulnerabilities, youâre learning to operate in hardened environments that mirror real enterprise networks.
The Challenge Lab Experience
I spent four months working through Challenge Labs 1â7. Full transparency: I was going through a rough breakup at the time, and this course became my escape. Iâd dedicate 10 hours a week to whatever challenge I was stuck on, working through it between assessments at EON Security.
After a three-month break, I came back in December 2025 and finished Challenge Lab 8. Hereâs my ranking of what matters most:
Must-Do Labs:
- Challenge Labs 7 & 8: These are the retired exam labs. If you can complete these without significant struggle, youâre ready. Period.
- Challenge Labs 5 & 6: Solid performance here indicates youâve got the fundamentals down.
The earlier labs (1â4) are important for building skills, but 5â8 are where you prove youâre exam-ready.
My Note-Taking Game Changer
From day one, I took detailed notes knowing Iâd need quick reference material during the exam. But hereâs what really made the difference: after completing all eight challenge labs, I consolidated everything into a zip file and fed it to my local LLM.
I had the AI reorganize all my notes by technique rather than chronologically. This created an intuitive reference system where I could instantly find examples of specific attacks and their implementations. During the exam, this meant I could quickly copy, paste, and adapt techniques to my specific situation instead of hunting through pages of notes.
Would I recommend this approach to other OSEP students? Absolutely. Iâve always wanted clean, organized notes, and AI helped me transform my messy study materials into a proper reference sheet for âall things hacking.â Itâs been invaluable not just for OSEP, but for every engagement since.
The Exam: 8 Hours and One Embarrassing Mistake
Unlike my OSCP attempt where I hit a wall and needed a nap to reset, I went into OSEP and powered through in one sitting. Total time: about 8 hours, though 2 of those were spent stuck on something absurdly simple that Iâm still slightly embarrassed about.
The Scheduling Hiccup: I made one critical mistake before even startingâââI scheduled my exam in Adak time while living in EST. Learn from my stupidity: double-check your timezone settings.
Time Management: The course material is sufficient preparation. If youâve completed the challenge labs and organized your notes effectively, you have everything you need. I didnât use any supplementary resources beyond the official course content.
Technical Takeaways for Real Engagements
I mentioned earlier that Iâve used OSEP material in every assessment since starting the course. Hereâs what that looks like in practice:
The techniques I referenced earlierâââthe âsimple thingsâ like file permission management before transfers and Kerberos ticket manipulation for lateral movementâââhave become standard parts of my workflow. Process hollowing techniques for AV evasion are now in my regular playbook.
One confession: Iâve become overly reliant on BloodHound. Itâs so efficient that Iâve lost my proficiency with manual LDAP queries. Going forward, Iâm planning to rebuild my ldapsearch skills and recreate the notes I lost after leaving my previous position. The OSEP reminded me that automation is powerful, but understanding the underlying queries makes you more effective when tools fail.
Background Matters
My experience as a red teamer and daily work as a penetration tester at EON Security definitely helped. But I want to give credit where itâs due: PwnedLabs courses significantly improved my initial access efficiency, which was clutch during the exam. The combination of practical pentesting experience and focused training from multiple sources creates a stronger foundation than any single certification can provide.
The Money Question: Is It Worth It?
The short answer: Only if your employer is paying.
OSEP is a fun certification that genuinely changed how I approach vulnerabilities and systems. The hands-on experience is excellent, and the OffSec brand is respected across the industry. If youâre a penetration tester, security researcher, or red teamer, having OSEP on your resume is beneficial.
But: At $1,500+, I cannot recommend spending your own money on this when HTBâs CAPE exists as a superior alternative covering modern AD attack vectors. CAPE includes ADCS exploitation and SCCM abuseâââcritical techniques that OSEP simply doesnât address. Until OffSec updates the course to reflect current TTPs, itâs not competitive with its alternatives from a pure content perspective.
The value proposition only makes sense if youâre getting the OffSec brand recognition for free (via employer sponsorship) while still gaining the practical skills.
Whatâs Next?
For me, OSEP served as an introduction to more sophisticated offensive security topics. Learning to bypass AV, ASR rules, and Constrained Language Mode was valuable, but I recognize the gaps in my knowledge. Iâm still missing crucial expertise in areas like:
- ADCS exploitation (planning to take Altered Securityâs CESP-ADCS)
- SCCM abuse (still researching the best practical training for this)
- Other modern AD attack vectors
Am I pursuing more OffSec certifications? Nope. Iâm done with OffSec for at least a year or two. Not because the training is badâââitâs quite goodâââbut because other providers are covering the material I need to level up in my career right now.
Final Thoughts
OSEP is a solid certification that will make you a better penetration tester. The hands-on labs are excellent, the techniques are immediately applicable, and having OffSec credentials on your resume still opens doors. The course taught me practical skills I use in every engagement.
But itâs not the comprehensive AD certification some people expect it to be. Itâs lacking coverage of modern attack vectors, and at current pricing, it doesnât compete well with alternatives like CAPE or the CRTP/CRTE path for someone paying out of pocket.
My recommendation to colleagues and blog readers: If your employer offers to pay for OSEP, take it. Youâll learn valuable skills and add a respected certification to your resume. But if youâre self-funding your education, look at CAPE first. And regardless of which path you choose, advocate for OffSec to update the OSEP to include ADCS, SCCM, and other modern AD exploitation techniques.
The offensive security field moves fast. Our training should keep pace.