Skip to content
Getting Digital
Contact
All certifications

EC-Council certifications

EC-Council, the International Council of E-Commerce Consultants, runs the Certified Ethical Hacker alongside CND, CHFI, CPENT and further security certifications. The CEH exam is multiple choice and is complemented by the hands-on CEH Practical; eligibility comes through official training or two years of documented security work plus an application. A CEH lasts three years, maintained with continuing-education credits plus an annual charge. Exams are in English. The CEH is the credential described below, and it is read in two opposite ways by the two groups who meet it.

Exam delivery: Pearson VUE or the EC-Council Exam Centre (remote proctored); an exam voucher from EC-Council or bundled with accredited training

Recruiters and public-sector hiring frameworks know the letters: the CEH survives the keyword filter that reads an application before a person does, and in government and defence contracting, where approved-credential lists decide who may be proposed for a role, it appears on the lists. Working penetration testers rate it low, and the reason is the format. Offensive security is judged by what a tester achieves under time pressure against a system that resists, while 312-50 asks the candidate to recognise tools, attack phases and countermeasures in 125 multiple-choice questions over four hours, spanning twenty modules. A candidate can pass it without having gained a foothold on anything. Both readings describe the same certificate correctly, because they answer different questions: the recruiter asks whether a hiring process will admit the candidate, the tester asks whether the work will get done. The CEH is evidence of access to a process, not evidence of skill, and the decision to buy it turns on which of the two the candidate lacks.

Who it serves

The CEH is the right purchase where a specific employer, contract clause or public-sector role list demands it, because at that point no substitute exists. It suits defensive and advisory roles: analysts in a security operations centre, auditors, risk and compliance staff all benefit from knowing an attacker's vocabulary and sequence, and nobody in those roles is expected to run the attack. It also makes sense when an employer pays for the official training and the days that come with it. It is the wrong first credential for a self-funded route into penetration testing. Interviewers for that work weigh a different kind of evidence, an examination that sets real machines against the candidate over a full working day and then asks for a professional report; PenTest+ sits in between, mixing performance tasks into a booked paper and examining the planning and reporting a client pays for. EC-Council's own answer to the criticism is the CEH Practical: six hours, twenty challenges staged in its range, and the two halves together yield the CEH Master designation. The Practical is the part that speaks to ability, and it is the part most candidates leave out.

A lapse means revocation

Maintaining the credential means logging 120 continuing-education credits with EC-Council over three years and paying a membership charge every year, and the annual charge is the one holders forget because it arrives long after the exam. Miss either obligation and the certificate is not shown as out of date; it is revoked, and the way back is another exam. Several other bodies let an expired certificate stand on a CV as a dated fact. The exam fee, the eligibility application fee and the annual charge are on the CEH page with their read dates.

Professional

Frequently asked

Will the CEH get me a penetration testing job?
On its own, rarely. It gets an application read, and in public-sector or contractor hiring it is sometimes the box that has to be ticked before anything else is considered. The technical interview that follows asks how the candidate would approach a target and what they did last time, and a multiple-choice pass supplies no answer to that.
Must I take EC-Council's training to sit the exam?
No. There are two routes to eligibility: EC-Council's own course, which grants it automatically, or an application evidencing two years in information-security roles, which carries a non-refundable fee. The self-study route costs far less overall, because official training bundles carry most of the cost of this credential. The CEH page lists both routes with their fees.
Is the knowledge exam worth taking without the Practical?
Where the requirement names the CEH, yes: it is usually satisfied by the multiple-choice credential alone. Where the aim is to prove capability, no. Budget for both parts from the start, because the hands-on half is what a technical reader looks for, and holding the pair earns the Master designation.

Official certification portal: cert.eccouncil.org

Other vendors

Last reviewed 26 September 2026 · Getting Digital