Every time the CEH comes up on this site or on Reddit, the same fight breaks out. One camp says it's a paper cert that teaches nothing. The other says it got them hired.
Both camps are describing real experiences. The difference is why each person took it.
Here's my position after watching a lot of people spend a lot of money on this: the CEH is a bad purchase for most engineers and an excellent purchase for a specific three. Figure out which you are before you spend $1,199.
The numbers first
- Cost: roughly $1,199 for the voucher through standard channels; around $950 for EC-Council's own remote proctoring. Plus a $100 eligibility application fee if you don't go the official-training route.
- Format: 125 multiple-choice questions, 4 hours.
- Passing score: 60–85%, varying by exam form difficulty. Yes, really — the cut score depends on which form you get.
- First-attempt pass rate: roughly 30% by most community estimates, which is lower than the exam's reputation suggests.
- CEH Practical: a separate 6-hour hands-on exam, separate fee. Passing both gets you CEH Master.
That $1,199 is the number to sit with. It's more than the AWS Solutions Architect Professional. It's more than a CISSP attempt. It's roughly four Azure associate exams.
Reason 1: Your employer's HR system requires it
This is the honest, unglamorous, best reason.
CEH is on the US DoD 8140/8570 approved baseline list. If you work for a defense contractor, a federal agency, or a company that sells into that space, the cert may be a literal contractual requirement for your role. No amount of "but OSCP is a better exam" changes what's written in the contract.
Same story in a lot of government and government-adjacent employers outside the US, and in some large enterprises whose security job families were written a decade ago and still name CEH by name.
If this is you, take it. Your employer is almost certainly paying, the requirement is real, and the debate is irrelevant.
Reason 2: You need to get past keyword filters, right now
Search "penetration tester" on any job board and count how many postings name CEH. It's a lot — more than name OSCP, because the postings are written by recruiters working from templates, not by the security engineers who'll interview you.
If you're trying to move from IT ops or helpdesk into a security role and your résumé keeps vanishing into applicant tracking systems, CEH is a functioning keyword. It gets you to a human. That's a real, measurable outcome and it's worth money to someone stuck at the filter stage.
Be clear-eyed about what happens next: the human who interviews you will ask technical questions the CEH did not prepare you for. The cert opens the door. It doesn't walk you through it.
Reason 3: You need broad vocabulary coverage fast
The CEH's actual pedagogical value is breadth. Reconnaissance, scanning, enumeration, system hacking, malware, sniffing, social engineering, DoS, session hijacking, web app attacks, SQL injection, wireless, mobile, IoT/OT, cloud, cryptography. Twenty modules of "here is a category of attack and the tools associated with it."
For a SOC analyst, a GRC person, an auditor, or a sysadmin who needs to talk about offensive security credibly without doing it daily, that map is genuinely useful. You come out knowing what the words mean and roughly how the pieces fit.
That is a legitimate outcome. It is not the same as being able to compromise a network, and anyone who tells you otherwise is selling something.
When it's a bad purchase
You want to actually do offensive security. Then the money goes to OSCP, PNPT, or a good hands-on lab subscription. The CEH's multiple-choice format cannot test whether you can pop a box, and the industry knows it. Pentest hiring managers weight hands-on certs heavily and CEH lightly.
You're paying out of pocket with a tight budget. $1,199 buys a lot of alternatives — a year of a hands-on lab platform, several cloud security certs, a solid course plus an exam with a hundredth of the price tag.
You think it's a substitute for fundamentals. Networking, operating systems, and scripting are the actual prerequisites for a security career. A CEH on top of a shaky foundation impresses no one for long.
If you're taking it: how to actually pass
The 30% first-attempt rate isn't because the material is hard. It's because people underestimate a broad memorization exam.
Tools and their purpose. The exam is heavy on "which tool does X." Nmap, Nessus, Wireshark, Metasploit, Burp, Hydra, John, Hashcat, Aircrack-ng, Maltego, Nikto, sqlmap, and a long tail of others. Make a two-column list — tool, primary use — and drill it. This alone is a large slice of the exam.
Nmap flags specifically. -sS, -sT, -sU, -sV, -O, -A, -Pn, timing templates. Know what each does and what the scan looks like on the wire. Guaranteed points.
Port numbers. Boring, memorizable, tested. 20/21, 22, 23, 25, 53, 80, 88, 110, 135, 137-139, 143, 161, 389, 443, 445, 636, 1433, 3306, 3389, 5432. Just learn them.
Attack phases in order. Reconnaissance → Scanning → Gaining Access → Maintaining Access → Clearing Tracks. Questions ask which phase a described activity belongs to. Free points.
Crypto basics. Symmetric vs. asymmetric, key lengths, hashing algorithms and their output sizes, what PKI components do. Not deep math — vocabulary.
The exam's writing style is its own obstacle. Questions can be oddly phrased, occasionally ambiguous, and sometimes reference tool versions that feel dated. The counter is volume: see enough questions and the style stops surprising you. I'd drill free CEH practice questions nightly for the last two weeks rather than re-reading the courseware, because the courseware doesn't prepare you for the phrasing.
For the tool-identification questions in particular, ai.examcert.app is useful because you can ask why a given tool is the answer rather than just memorizing the pairing — and understanding the reason means you'll get the variants right too.
My actual advice
Ask yourself one question: is someone else paying, or is a requirement forcing it?
If yes — take it, prepare properly, pass on the first attempt because the retake economics are brutal.
If no, and you want to do offensive security for a living — spend the $1,199 somewhere with a hands-on component. You'll learn more and, in the rooms that matter, it'll count for more.
Either way, sit a diagnostic before you commit. A timed set of CEH practice questions costs nothing and will tell you whether you're four weeks out or four months out. On a $1,199 exam with a 30% first-attempt pass rate, that's the highest-value hour you'll spend.
Top comments (0)