OSCP vs OSED
Two exams that come up together — how they actually differ, and who each one is for.
Not really competitors. OSCP is the recognised entry to offensive security — broad penetration testing across networks and web. OSED is deep, narrow Windows exploit development: assembly, ROP, and defeating DEP and ASLR. Both cost $1,749. Get OSCP first for a pentest career; pursue OSED only if you specifically want exploit-development or vulnerability-research work.
- OSCP
- advanced, $1,749 course + exam bundle (or $2,749/yr Learn One)
- OSED
- expert, $1,749 course + exam bundle (or $2,749/yr Learn One)
- Harder
- OSED
| OSCP | OSED | |
|---|---|---|
| Vendor | OffSec | OffSec |
| Level | advanced | expert |
| Duration | 23h 45m + 24h report | 47h 45m + 24h report |
| Format | fully practical, proctored; 70/100 to pass | practical exploit development + report |
| Cost | $1,749 course + exam bundle (or $2,749/yr Learn One) | $1,749 course + exam bundle (or $2,749/yr Learn One) |
What each one is
OSCP — Offensive Security Certified Professional, the PEN-200 course — is the recognised entry point to OffSec and, for many employers, to the profession itself. It is broad, hands-on penetration testing: enumeration, exploiting a wide range of services, privilege escalation on Linux and Windows, and the basics of Active Directory.
OSED — OffSec Exploit Developer, the EXP-301 course — is one narrow, deep discipline: Windows user-mode exploit development. Reverse engineering, stack-based overflows, writing custom shellcode, and bypassing mitigations like DEP and ASLR with techniques such as ROP. It is one third of the OSCE3 certification.
The real difference
This is breadth versus depth, and the two sit on different career tracks. OSCP is a generalist credential — a pentester’s day touches many hosts and many techniques, and you rarely work below the level of a finished, working exploit. OSED drops you into assembly and the memory of a single process for the entire course.
One OSCE3 holder captures the split: it is perfectly possible to stay within application security or penetration testing without ever needing to read a line of assembly. OSED is for people who want to write the exploits, not just run them.
Cost and time
Both certifications carry the same $1,749 price for the course-and-exam package. The exams, though, reflect their different natures.
OSCP is a 23-hour-45-minute hands-on exam plus 24 hours to write the report, and you pass at 70 of 100 points. OSED is a longer 47-hour-45-minute exam plus the same 24-hour report window, with a lower 60-point pass mark — the lower bar reflects how demanding each individual task is. Both require a formal written report.
Which one to choose
For almost everyone, OSCP comes first. It is the certification employers actually ask for in penetration-testing and red-team roles, and it is the gateway into OffSec’s wider catalogue.
Pursue OSED only if you genuinely want exploit development, vulnerability research, or the low-level work that underpins malware and EDR analysis — or if you are deliberately completing OSCE3. It is a specialist investment, not a résumé upgrade over OSCP. Even after passing OSED, there is a lot of ground to cover before you can write modern exploits unaided.
The two do not substitute for each other. One says you can break into networks; the other says you can build the exploits that get you there.
What people who sat these say
perfectly possible to stay within the application security or penetration testing domains without ever needing to read a line of assembly code
there is still a lot of ground to cover before you can start applying your knowledge to writing modern exploits
Full detail on each: OSCP · OSED. For where both sit in a longer plan, see the roadmap.