Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Everything you need to know about EC-Council's advanced penetration testing certification as of 2026, covering the 100% practical 24-hour exam, the LPT (Master) tie-in at 90%, the eight blueprint domains, the 14 course modules, eligibility, cost, renewal, and how CPENT compares to CEH and CompTIA PenTest+. A complete reference guide for anyone considering CPENT or trying to understand what it covers.
CPENT is EC-Council's advanced, fully practical penetration testing certification, introduced in 2020 to replace the earlier ECSA program and now delivered as CPENT AI.
It is built for people who already test for a living and want to prove they can handle an enterprise network that fights back. The exam does not ask multiple-choice questions. It drops you onto a live range and expects you to get past firewalls and intrusion detection, pivot across segmented networks, write your own exploits, and test web, API, IoT and OT targets, then write it all up in a report.
The credential is ANAB-accredited under ISO/IEC 17024, mapped under NICE 2.0 and aligned with CREST, and it carries a built-in top band: score 90% on the same exam and EC-Council also awards the LPT (Master) designation. CPENT is issued and maintained by EC-Council, the international certification body behind CEH.
Define objectives, rules of engagement and legal boundaries before testing.
Collect OSINT and map the attack surface across the network zones.
Get past perimeter defenses and exploit web, API, Windows and Linux targets.
Escalate privilege and pivot into hidden, filtered segments of the network.
Write the findings so technical and non-technical readers can act on them.
Four things that set CPENT apart from the broad, knowledge-based certifications earlier in an offensive security path.
EC-Council maps CPENT under the NICE 2.0 workforce framework, aligns it with CREST, and lists it as NCSC Certified Training. The program is ANAB-accredited under ISO/IEC 17024, the same standard that covers CEH and the rest of EC-Council's core catalog.
No multiple-choice questions. The whole exam is a hands-on engagement on a live cyber range, finished with a professional report. You pass by doing the work, not by recognizing an answer.
Double pivoting into hidden segments, binary exploitation, IoT firmware, and OT/SCADA testing. The range is layered and filtered, so you have to read the network to get through it.
CPENT has a top band built into it. Score at or above your exam form's cut score, a minimum of 70%, and you earn CPENT. Score 90% or above on the same 24-hour exam and EC-Council also awards the Licensed Penetration Tester, LPT (Master), with no separate test to sit.
EC-Council describes LPT (Master) as its elite penetration testing designation, reserved for candidates who clear that 90% bar under live proctoring. It is still awarded through CPENT as of 2026.
Everything you need to know about the certification, the practical exam, and how to maintain CPENT as of 2026.
There is only one exam. What you earn from it depends on your score. CPENT is the certification most candidates aim for, and LPT (Master) is the top band for the few who clear 90%.
The core credential. Earned by scoring at or above your exam form's cut score, a minimum of 70%, on the 24-hour practical exam and submitting an approved report. This is where most certified testers land.
EC-Council's elite penetration testing designation. Awarded automatically to candidates who score 90% or above on the same CPENT exam, with no extra test. A rare result, which is the point of the designation.
One 24-hour engagement decides both. You do not choose which credential to pursue up front. You attempt CPENT, and a 90% result adds LPT (Master) on top. Both are valid for three years and renew through the same ECE policy.
CPENT is a late-stage credential. It sits near the top of an offensive security path, after you already have the fundamentals and a broad ethical hacking or pen testing certification, and it leads into leadership and defensive breadth.
Build the baseline
Prove it under pressure
Two questions to answer before you commit: can you take the exam, and should you take CPENT specifically. Here's a straight answer to both.
There are no predefined eligibility criteria.
EC-Council sets no formal eligibility bar, so you can purchase the CPENT Exam and Range package and attempt it. To do that without official training, EC-Council recommends at least two years of information security experience or the CEH certification or equivalent knowledge. This is not a credential to challenge cold.
The common route for most candidates.
Complete official EC-Council training through an Accredited Training Center, the iLearn self-study option or the iWeek live online option. Training Camp's CPENT boot camp uses EC-Council's authorized courseware, includes the exam voucher and cyber range access, and prepares you for the 24-hour engagement before you schedule it.
EC-Council positions CPENT for offensive security and vulnerability assessment and penetration testing (VAPT) careers. These are the roles it is written for:
Runs authorized attacks against networks, systems and applications and reports what an adversary could reach. The whole CPENT exam is this job compressed into 24 hours against hardened targets.
Scopes engagements, sets rules of engagement, runs the test and writes it up for a paying client. Two of the eight CPENT domains are scoping, engagement and reporting, which is the half of consulting that tools do not cover.
Chains footholds, pivots across segmented networks and evades defenses to test detection and response. CPENT requires double pivoting and defense evasion that most pen testing exams never ask for.
Tests web applications and APIs for injection, broken authentication, JSON Web Token flaws and business logic bugs. The heaviest CPENT domain at 14% of the exam is web and API testing.
Assesses internal and external networks, gets past firewalls and IDS, and moves from a foothold into protected subnets. CPENT is built around layered, filtered networks rather than flat ones.
Finds, verifies and exploits vulnerabilities, then rates and documents them. CPENT ties the finding to a working exploit and a report, which is what separates a VAPT engineer from a scanner operator.
CPENT is the advanced end of a pen testing path that usually starts with one of these. Here's how the three line up.
| CPENT | CEH | CompTIA PenTest+ | |
|---|---|---|---|
| Issuer | EC-Council | EC-Council | CompTIA |
| Exam Format | 100% practical, 24-hour range (or 2 x 12 hrs) | 125 multiple-choice over 4 hours | Up to 90 items, 165 min, MC plus performance-based |
| Level | Advanced | Intermediate | Intermediate |
| Focus | Full-scope exploitation across layered networks | Broad ethical hacking methodology and tools | Hands-on penetration testing scenarios |
| Passing Score | 70% earns CPENT, 90% earns LPT (Master) | 60% to 85% (varies by exam form) | 750 on a 100 to 900 scale |
| Renewal | 120 ECE/CPE credits over 3 years | 120 ECE credits over 3 years | 60 CEUs over 3 years |
| DoD 8140 Approved | No | Yes | Yes |
| Best For | Working testers proving advanced practical skill | Career entry and broad credential recognition | Hands-on exam takers on the CompTIA stack |
CEH and PenTest+ facts are taken from the Training Camp guides for CEH and PenTest+. Many testers hold CEH or PenTest+ first and take CPENT as the step up.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our official EC-Council CPENT boot camp covers the full curriculum over five days, live online or in person, using EC-Council's authorized courseware, with hands-on labs, cyber range access, your $999 exam voucher, and a free retake included. You schedule your 24-hour range exam after class.
Pen testing fundamentals, tooling, career strategy and the certifications that lead into CPENT.
The plain version of what a pen test is, how an engagement actually runs, the types of tests, the tools testers reach for, and what changed in the practice in 2026. A good grounding before you take on an advanced practical exam like CPENT.
A full walkthrough of the PenTest+ PT0-003 exam: the five domains and their weights, the performance-based questions, the cost, and a study approach. Useful if you are weighing PenTest+ against CPENT or planning to take both.
Why passing an audit is not the same as passing a pen test, what each one actually measures, and when a company needs which. Context for understanding where CPENT-level testing fits in an organization's security program.
An honest look at how far CEH gets you toward a pen testing role, what hiring managers actually test for, and where hands-on credentials carry more weight. CEH is the usual lead-in to an advanced cert like CPENT.
A rundown of the Nmap scan types, the privileges each one needs, and when stealth matters. Reading what a filtered network tells you is a core CPENT skill, and it starts with choosing the right scan.
What backdoors are, how attackers plant and use them, real examples, and how defenders find them. Background for the persistence and maintaining-access work that runs through the CPENT exploitation domains.
A guide to the main bug bounty platforms, what they pay, and how the work builds real offensive experience. One of the cheaper ways to practice the kind of skills CPENT tests before you sit the exam.
The CPENT V2 Exam Blueprint organizes the exam into eight domains. The badge shows each domain's share of the exam, and the color shows which part of the engagement it belongs to. Click any domain for what it covers.
The principles and objectives of penetration testing, the methodologies and frameworks behind it (including MITRE ATT&CK), the role of AI in testing, and how testing fits into compliance with laws, acts and standards. Also the pre-engagement work: responding to RFPs, drafting rules of engagement, legal and regulatory considerations, and managing scope creep.
Open-source intelligence on a target domain, organization and employees, OSINT automation tools, and mapping the attack surface. Carries social engineering penetration testing through to documented findings: off-site and on-site techniques, and the countermeasure recommendations that go in the report.
The heaviest domain. Web application footprinting, vulnerability scanning, SQL and other injection, session and input validation flaws, business logic and client-side issues on the web side. API testing covers reconnaissance, authentication and authorization flaws, JSON Web Tokens, rate limiting, GraphQL and session management.
Evaluating and getting past the controls at the edge of a network: firewall security implementations, intrusion detection systems, and the security of routers and switches. Locating a firewall, enumerating its access control list, and bypassing it, plus the techniques used to evade an IDS.
Windows reconnaissance, initial access, enumeration and privilege escalation, then the same for Linux. Active Directory architecture, reconnaissance, enumeration and exploitation, the role of AI in AD testing, and advanced lateral movement and pivoting and tunneling to maintain access.
Analyzing Linux and Windows binaries, buffer overflow attacks and exploitation methods, and the concepts, methodologies and tools for application fuzzing. This is where candidates write and debug their own exploit code rather than run prepackaged tools.
The fundamentals of IoT pen testing, information gathering and attack surface mapping, analyzing device firmware, in-depth analysis of IoT software, and assessing the security of IoT networks and protocols. Post-exploitation and persistence techniques, through to the IoT pen testing report.
The purpose, structure and essential components of a penetration testing report, the phases of writing one, and the skills to deliver it so both technical and non-technical readers can act on it. Also the post-testing actions an organization should take after the engagement.
The official CPENT course is organized as 14 modules that follow the attack lifecycle, from scoping and OSINT through exploitation, pivoting and IoT to the final report. Each badge shows the phase the module belongs to.
Principles and objectives of pen testing, the methodologies and frameworks that structure it, the MITRE ATT&CK framework, the role of AI, and compliance-driven testing.
Pre-engagement activities, responding to RFPs, drafting rules of engagement and the test plan, legal and regulatory considerations, and managing scope creep.
OSINT on a target domain, organization and employees, automation tools, and mapping the attack surface before any packets are sent.
Off-site and on-site social engineering, phishing and phone-based techniques, and documenting findings with countermeasure recommendations.
Footprinting, vulnerability scanning, SQL injection and other injection, authentication and session flaws, business logic and client-side issues.
API reconnaissance, broken authentication and object-level permissions, JSON Web Token issues, rate limiting attacks, and GraphQL testing.
Locating and testing firewalls, enumerating access control lists and bypassing them, and the techniques used to evade an IDS and test routers and switches.
Windows reconnaissance and vulnerability assessment, gaining initial access, buffer overflow exploitation, privilege escalation and post-exploitation.
AD architecture and components, reconnaissance and enumeration, exploiting identified AD vulnerabilities, and the role of AI in AD testing strategies.
Linux penetration testing methodology, reconnaissance and vulnerability scanning, gaining initial access, and Linux privilege escalation techniques.
Analyzing Linux and Windows binaries, buffer overflow attacks, and the concepts, methodologies and tools for application fuzzing.
Advanced lateral movement, pass-the-hash and Kerberos attacks, and the pivoting and tunneling techniques that reach hidden network segments.
IoT attack surface mapping, firmware acquisition and analysis, IoT software and protocol security testing, and post-exploitation on IoT devices.
The structure and components of a pen testing report, the phases of writing one, delivering it effectively, and the post-testing actions for organizations.
Domains, weights and modules reflect EC-Council's CPENT V2 Exam Blueprint and the current CPENT AI program as of October 2026. Confirm the current outline on cert.eccouncil.org before you test.
The questions candidates ask most often when researching the Certified Penetration Testing Professional certification.
CPENT is EC-Council's advanced, fully practical penetration testing certification, introduced in 2020 to replace the earlier ECSA program and now delivered as CPENT AI. It validates the skills to test enterprise networks that fight back: getting past firewalls and intrusion detection, pivoting across segmented networks, writing your own exploits, and testing web, API, IoT and OT targets. The exam is a hands-on engagement rather than a multiple-choice test.
The CPENT exam is 100 percent practical. It is a 24-hour performance-based challenge on a live cyber range, proctored online and remotely, and candidates choose either one 24-hour session or two 12-hour sessions. After the range time, you submit a professional penetration testing report within seven days. There are no multiple-choice questions.
EC-Council uses multiple exam forms, each with its own cut score based on question difficulty, so the pass mark can range from 60 percent to 85 percent. Score at or above your form's cut score (a minimum of 70 percent) and you earn CPENT. Score 90 percent or above on the same exam and EC-Council also awards you the Licensed Penetration Tester, LPT (Master), credential, with no separate exam. One exam, two possible outcomes.
Yes. As of 2026 the LPT (Master) credential is still awarded through the CPENT exam. It is not a separate test. Candidates who score 90 percent or above on the 24-hour CPENT exam, and whose report is approved, receive both CPENT and LPT (Master) in their Aspen account. LPT (Master) is valid for one year and renews annually, and it falls under the same EC-Council Continuing Education policy as CPENT.
EC-Council sets no predefined eligibility criteria to attempt the CPENT exam, so you can purchase the exam and range directly. To challenge it without official training, EC-Council recommends at least two years of information security experience or the CEH certification or equivalent knowledge. Candidates who complete official EC-Council training, such as Training Camp's CPENT boot camp, are prepared for the exam and receive the voucher with the course.
As of October 2026, the CPENT Exam and Range package is $999 USD from the EC-Council store, which includes 90 days of practice range access and the live range exam. Training delivered through an Accredited Training Center, the iLearn self-study option or the iWeek live online option is priced separately and usually bundles the exam voucher. Retakes are purchased separately by request to EC-Council.
The CPENT V2 Exam Blueprint has eight domains: Penetration Testing Methodologies, Scoping, and Engagement at 13 percent, Information Gathering and Attack Surface Mapping at 13 percent, Web Application and API Penetration Testing at 14 percent, Perimeter Defense Evasion Techniques at 12 percent, Endpoint Exploitation, Privilege Escalation, and Lateral Movement at 13 percent, Reverse Engineering and Binary Exploitation at 11 percent, IoT Penetration Testing at 11 percent, and Reporting and Post Testing Actions at 13 percent. Web and API testing is the heaviest.
CPENT is valid for three years. To stay certified you earn 120 EC-Council Continuing Education (ECE) credits within the three-year cycle and pay the annual Continuing Education fee, which is $250 USD per year. If you hold both CPENT and LPT (Master), you pay the Continuing Education fee once, not for each credential.
CPENT is not currently listed among EC-Council's DoD 8140 approved certifications. As of 2026 EC-Council lists CEH, CEH Practical, CHFI, CCISO and CND for DoD 8140 work roles, not CPENT. If you need an EC-Council credential that maps to the DoD 8140 framework, CEH is the one to check. Always confirm the current listing on the DoD 8140 Approved Qualifications Matrix at cyber.mil before relying on any credential for a federal or contractor role.
CEH is EC-Council's broad ethical hacking credential, tested through 125 multiple-choice questions over four hours, and it is the usual lead-in to CPENT. CompTIA PenTest+ (PT0-003) mixes multiple-choice and performance-based items over 165 minutes and is scored on a 100 to 900 scale. CPENT is the most demanding of the three: a 24-hour fully practical engagement with no multiple choice, aimed at people who already test for a living. CEH and PenTest+ are approved under DoD 8140, CPENT is not.
CPENT is written for offensive security and vulnerability assessment and penetration testing (VAPT) careers: penetration tester, penetration testing consultant, red team operator, web and API penetration tester, network penetration testing engineer, and VAPT engineer. The exam's mix of scoping, exploitation, pivoting and reporting maps to what these roles do day to day, which is why employers treat it as a senior credential rather than an entry point.
Yes. EC-Council has achieved ANAB (ANSI National Accreditation Board) accreditation for CPENT to meet the ISO/IEC 17024 standard for personnel certification bodies, the same accreditation that covers CEH, CND, CHFI, ECIH and CCISO. EC-Council also maps the program under NICE 2.0, aligns it with CREST, and lists it as NCSC Certified Training.
For people who already do offensive security work and want to prove they can handle hard, multi-disciplinary engagements, yes. CPENT is a credible test of real skill because the exam makes you do the work under a clock rather than recognize an answer, and the LPT (Master) tie-in gives a top band to aim for. It is not a first certification. If you are newer to the field, CEH or CompTIA PenTest+ is the better place to start, and CPENT is the step after that.
Whether you're weighing the certification, working out funding, or planning training for a team, tell us where you are and we'll help you map out the right path.