Skip to content
Knowledge base Updated: September 30, 2026

What is CEH? Definition, exam preparation, exam and career paths

Learn about the CEH - Certified Ethical Hacker - an internationally recognized certification of skills in ethical hacking and security testing of IT systems. Learn how to effectively prepare for the CEH exam, its requirements and the benefits of this certification.

Marcin Godula Marcin Godula

In an era of digital transformation and growing cyber threats, ethical hacking skills are becoming increasingly sought after. The CEH (Certified Ethical Hacker) certification is not only a prestigious credential of competence, but more importantly a path to understanding how cybercriminals think and act in order to more effectively protect organizations from attacks. In this comprehensive guide, we will dispel all doubts about the certification - from the first steps and requirements, to the preparation process, to real career opportunities in the dynamic world of cyber security.

Whether you’re just getting started in IT security or you’re an experienced professional looking for a new challenge, this article will provide you with practical knowledge on how to earn CEH certification and use it to build your career. If you are interested in building a career in security operations, consider exploring how a SOC as a Service team operates in practice. Not only will you learn about the formal requirements and structure of the exam, but you’ll also get specific preparation tips, estimated costs and real career prospects that this certification opens up for you.

Shortcuts

Who is a Certified Ethical Hacker (CEH)?

A Certified Ethical Hacker is a cybersecurity specialist who has the knowledge and skills to identify vulnerabilities in information systems, using the same tools and techniques as cyber criminals. The key difference, however, is that he or she acts in accordance with the law and professional ethics, with the goal of improving an organization’s security.

An ethical hacker is an expert who understands how cybercriminals think and act, but uses that knowledge to protect systems and networks. He or she is a person who is able to look at IT infrastructure from the perspective of a potential attacker, which allows him or her to effectively identify and eliminate threats.

Unlike cybercriminals, a certified ethical hacker always works within strict rules and with the consent of the owner of the systems under test. His work is documented and conducted in a methodical manner, with full respect for the law and the organization’s security policies.

📚 Read the complete guide: Cybersecurity: A complete guide to cybersecurity for boards and managers

What sets CEH certification apart from other cybersecurity certifications?

The CEH certification is distinguished primarily by its hands-on approach to security testing. Unlike many other certifications that focus mainly on theory, CEH places a strong emphasis on practical skills and real-world attack scenarios.

The CEH certification program is regularly updated to include the latest threats and techniques used by cybercriminals. This keeps certification holders abreast of the current cyber threat landscape and new attack methods.

The CEH certification is recognized by many government organizations and multinational corporations as the standard for ethical hacking. It is also listed in DoD 8570 as one of the key certifications for professionals working in the cyber security field.

It is worth noting that CEH is a vendor-neutral certification, meaning that it is not tied to a specific software or hardware manufacturer. As a result, specialists holding this certification can work with a variety of technologies and tools.

What are the prerequisites for CEH certification?

In order to sit for the CEH exam, candidates must meet certain requirements that prove they are prepared to be an ethical hacker. The basic requirement is to have a minimum of two years’ experience in the IT security field.

An alternative path is to complete a formal CEH training course provided by an accredited training center. In this case, the requirement for work experience can be waived, making this path attractive to those embarking on a career in cyber security.

Candidates must also sign a confidentiality agreement and a code of ethics, committing to high ethical standards in their future work. This is a key element that underscores the responsibility associated with having advanced knowledge of hacking techniques.

It is worth noting that candidates should have a solid foundation in computer networks, operating systems and programming. This baseline knowledge is essential for successfully absorbing the course material and passing the exam.

What does the CEH exam look like?

The CEH exam consists of 125 multiple-choice questions to be solved in 4 hours. The questions are carefully selected to test not only the candidate’s theoretical knowledge, but also his or her ability to practically apply the concepts learned.

The exam format requires candidates to demonstrate a deep understanding of various aspects of cyber security. Questions are often based on real-life scenarios, requiring the examinee to be able to think analytically and make decisions in the context of real-life situations.

There is no single pass mark. EC-Council runs several versions of the exam with different question pools and sets a separate cut score for each one — depending on the version you get, it ranges from 60% to 85% correct answers. The questions span different subject areas, which requires the candidate to prepare comprehensively.

The exam code is 312-50. EC-Council delivers it through its own ECC Exam Center, and its certification site also lists Pearson VUE testing centers. A candidate without official training agrees on the delivery method with EC-Council only after the eligibility application has been approved.

What areas of knowledge does CEH certification cover?

The CEH certification program covers a wide range of cyber security topics, from basic ethical hacking concepts to detailed system penetration techniques and advanced protection methods.

A key component of the program is an understanding of hacking methodology, which includes five main phases: reconnaissance, scanning, gaining access, maintaining access and obliterating traces. Each of these phases is discussed in detail, along with the relevant techniques and tools.

The program also includes detailed information on various types of attacks, including but not limited to: attacks on wireless networks, social engineering attacks, malware, attacks on web applications, and techniques for bypassing security systems. Candidates learn not only to recognize these threats, but also to counter them effectively.

Issues related to the legal and ethical aspects of penetration testing are also an important part of the program, including issues related to legal liability, documenting testing and reporting vulnerabilities found.

What does the current CEH v13 program cover?

EC-Council’s current program is CEH v13, marketed as CEH AI because some attack and defence techniques are shown with the use of artificial intelligence. According to the certifying body, the program has 20 modules, describes more than 550 attack techniques and includes 221 lab exercises.

The order of the modules follows the course of a security test:

  1. Target reconnaissance — introduction to ethical hacking, footprinting and reconnaissance, network scanning, enumeration, vulnerability analysis.
  2. Gaining access — system hacking, malware, traffic sniffing, social engineering, DoS, session hijacking, evading IDS, firewalls and honeypots.
  3. Applications and platforms — web servers and web applications, SQL injection, wireless networks, mobile platforms, IoT and OT, cloud computing.
  4. Cryptography — the final module, devoted to encryption and its weaknesses.

EC-Council’s training is split into four stages: learning (Learn), the exam (Certify), practice in a simulated organization (Engage) and competing in CTF challenges (Compete). The official course takes the form of a 5-day boot camp, usually followed straight away by the 4-hour knowledge exam.

A certificate confirms what one person knows, not the state of an organization’s defences. The latter is checked by a penetration test with an agreed scope and rules of engagement, ending in a report with proof of concept — the same stages the CEH modules describe, applied to the company’s own infrastructure.

How much does it cost to get CEH certification?

EC-Council does not publish a single exam price. As the certifying body itself explains, the exam voucher is often sold as a bundle with training from an accredited partner, so the amount depends on the region, the training format (online self-paced, online live, an in-person boot camp at an authorized center, a university program) and the partner. The actual price has to be checked in the chosen training center’s offer on the day you buy.

Only two fees are stated directly by EC-Council:

  • eligibility application fee — USD 100, non-refundable. It is paid by candidates who go for the exam without official training (on the basis of 2 years of information security experience); with official training it is included in the course price;
  • annual continuing education (CE) fee — USD 80, charged to holders of a certification under the ECE program, which extends the certification by another year.

A retake after a failed attempt is paid for, unless the official training package includes free retakes — EC-Council offers them in selected packages together with a voucher valid for one year. Before choosing a course, compare what exactly the package contains: the voucher, retakes and lab access.

How long does the CEH certificate remain valid and how to renew it?

A CEH certification stays valid for three years after it is awarded. After this period, it is necessary to renew it in order to keep the qualification up-to-date in the rapidly changing cyber security environment.

The certification renewal process requires the accumulation of a sufficient number of ECE (EC-Council Continuing Education) points, which can be obtained through various professional and educational activities. It is required to accumulate a minimum of 120 ECE points during the three-year validity period of the certificate.

ECE points come from many kinds of activity, for example attending industry conferences, publishing technical articles, conducting training courses, obtaining additional certifications or participating in webinars organized by the EC-Council. This flexibility allows you to tailor the recertification process to your individual career path.

An alternative method of renewing your certification is to retake the current version of the CEH exam. This option can be particularly attractive to those who want to verify their knowledge against the latest standards and risks.

What are the differences between CEH and CEH Practical?

CEH Practical complements the traditional CEH certification by focusing exclusively on the candidate’s practical skills. Unlike the standard CEH exam, which includes theoretical questions, CEH Practical requires the candidate to perform actual tasks in a laboratory environment.

During the CEH Practical exam, candidates must demonstrate their ability to use various hacking tools and techniques in a controlled environment. The exam lasts 6 hours and includes a series of challenges that reflect real-world attack scenarios.

Holding both certifications - CEH and CEH Practical - provides comprehensive confirmation of both theoretical knowledge and practical skills in ethical hacking. This is especially valued by employers who are looking for professionals ready to take on real-world tasks immediately.

CEH Practical requires a separate exam fee and is not required for the basic CEH certification. However, more and more organizations are recognizing the value of this additional certification of practical skills.

What is the best way to prepare for the CEH exam?

Successful preparation for the CEH exam requires a systematic approach and a well-planned study strategy. It is crucial to start preparing well in advance, usually a minimum of 3-6 months before the scheduled exam date.

The basis of preparation should be a thorough study of the official syllabus (CEH Blueprint), which details the scope of material covered in the exam. This allows you to effectively spread out your studies and make sure that no important area is missed.

It is very important to combine theoretical learning with practical experience. It is advisable to use virtual labs, which allow you to safely experiment with various hacking tools and techniques. It is also good practice to create your own test lab for practice.

Regularly practicing and solving sample exam questions allows you not only to test your knowledge level, but also to become accustomed to the exam format and question types. It’s a good idea to use various sources of test questions to have the broadest possible view of possible exam scenarios.

What training materials are available to CEH candidates?

EC-Council’s official training materials are an essential resource for candidates preparing for the CEH exam. They include a comprehensive textbook, presentations and access to the iLabs platform, which includes scenarios for practical exercises.

In addition to official materials, there are many additional resources available, such as books from other publishers, online courses on platforms such as Udemy or Pluralsight, and dedicated platforms for exam preparation. It’s worth using a variety of sources to get a broader perspective on the issues at hand.

The Internet also offers many free resources, such as technical blogs, YouTube channels and discussion forums, where you can find additional information and exchange experiences with other people preparing for the exam. However, you should always verify the validity and reliability of such sources.

Practical labs and testing environments are also an important part of preparation. Many companies offer access to virtual labs where you can safely practice hacking and security testing techniques.

What practical skills are acquired during CEH training?

During the CEH training course, participants learn a number of practical skills necessary for the work of an ethical hacker. The core skill is to perform comprehensive penetration testing, from the reconnaissance phase, through vulnerability identification, to exploitation and reporting.

Students learn to use professional tools used in security testing, such as Nmap, Wireshark, Metasploit and Burp Suite. Each of these tools requires not only knowledge of the interface, but more importantly, an understanding of their principles of operation and potential applications in various testing scenarios.

An important part of the training is learning socio-technical and social engineering techniques. Participants will learn methods of psychological manipulation used by cyber criminals and how to defend against such attacks. This knowledge is crucial, as the human factor is often the weakest link in a security system.

The training also covers practical aspects of cryptography and network security. Participants learn to identify and exploit weaknesses in cryptographic protocol implementations, test the security of wireless networks, and detect vulnerabilities in the configuration of network devices.

What are the career prospects after CEH certification?

Having a CEH certification opens up many career opportunities in the cybersecurity industry. The most obvious path is to work as a pentester or penetration test specialist, where you can directly put your acquired skills into practice.

CEH certification is also valued in information security management positions. Many holders of this certification work as Security Analysts, Security Engineers or Information Security Managers. Their knowledge of attack techniques is invaluable in designing and implementing effective security measures.

A growing area of employment for certified ethical hackers is the financial services and insurance sectors. Banks, insurance companies and other financial institutions especially value professionals who can effectively identify and eliminate threats to their information systems.

What is the career path for a CEH certificate holder?

A typical career path for a CEH certificate holder often begins with the position of Junior Penetration Tester or Security Analyst. Many professionals also advance into roles involving phishing simulations and sociotechnical testing, which leverage the social engineering skills learned during CEH training. At this stage, the specialist gains hands-on experience in penetration testing and systems security analysis.

After several years of experience, as knowledge deepens and additional certifications are obtained, it is possible to be promoted to Senior Security Consultant or Lead Penetration Tester. At this level, the specialist is often responsible for planning and coordinating complex security projects.

The next step in career development may be to move into management positions such as Security Manager or Chief Information Security Officer (CISO). In these positions, not only technical skills become crucial, but also management skills and strategic thinking about the organization’s security.

What does CEH certification provide in the context of working in cybersecurity?

CEH certification provides a solid theoretical and practical foundation in penetration testing and information systems security. This is especially important in the early stages of a career, when a specialist is building credibility in the job market. In the current cyber security landscape, where threats are becoming increasingly sophisticated, having a CEH certification demonstrates the ability to adapt to new challenges and knowledge of the latest attack and defense techniques.

Having a CEH certification often translates into a higher salary. Specialists with this certification can expect to earn significantly more than those without certification. This is due to employers’ recognition of the value of the certificate and the growing demand for qualified security professionals. In the EMEA region (Europe, Middle East and Africa), salaries for CEH holders depend on the country and experience.

CEH certification also gives access to an exclusive community of professionals. EC-Council offers certificate holders access to closed forums, webinars and educational materials to help with ongoing professional development and networking. This community is especially valuable for sharing experiences related to new threats and defense techniques that are emerging in the cyber security industry.

It is worth noting the global reach and recognition of CEH certification. It is accepted by government organizations and corporations around the world, including institutions such as the US Department of Defense, NATO and the European Commission. In an era of increasing cyber threats and data security regulations (such as GDPR in Europe and CCPA in California), CEH-certified professionals are particularly valuable to organizations seeking to strengthen their cyber security posture.

What tools and techniques are learned during CEH training?

The CEH training program covers a wide range of tools and techniques used in security testing. Participants will learn both tools for automated vulnerability scanning and more advanced instruments for targeted attacks. In the current version of the certification, special emphasis is placed on security testing tools for cloud applications and containerized systems, reflecting current trends in IT system architecture.

Special attention is given to tools for analyzing network traffic and monitoring system activity. Students learn to use programs such as Wireshark to capture and analyze network packets, which is key to detecting potential threats and anomalies in network traffic. The program also covers security testing tools for IoT networks and industrial systems (ICS/SCADA), which are becoming increasingly critical in the current cyber security landscape.

The training also discusses reverse engineering and malware analysis techniques. Participants learn methods for securely examining malicious code and the tools used for its static and dynamic analysis. Special emphasis is placed on the latest techniques used in ransomware and malware using artificial intelligence to help prepare for today’s threats.

The training program is regularly updated with new tools and techniques related to emerging threats, such as attacks on blockchain, exploitation of vulnerabilities in smart contracts or threats related to quantum computing. This allows participants to stay abreast of the latest trends in cyber security and prepare for future challenges in the field.

How long does it take to prepare for the CEH exam?

The time needed to prepare for the CEH exam depends on individual experience and intensity of study. For those with basic IT security knowledge, the recommended preparation period is 3 to 6 months of systematic study.

Official CEH training usually lasts 5 days and includes about 40 hours of instruction. However, simply completing the training is not sufficient to pass the exam - additional self-preparation and practice in the laboratory are required.

Regularity of study and practical exercises is crucial. It is recommended to devote a minimum of 10-15 hours per week to study, with at least half of this time devoted to practical exercises in the laboratory.

What should I do if I fail in the CEH exam?

If a candidate fails the CEH exam, the first retake requires no waiting period. Before the third, fourth and fifth attempts a 14-day break applies, and no more than five attempts are allowed within 12 months — the next one is possible only after a year. The time between attempts is best used to fill gaps in the areas that proved problematic.

After failing an exam, it’s a good idea to carefully analyze the areas where you made the most mistakes. EC-Council provides passers with an overall score report that can help identify weaknesses and guide further study.

Before taking the exam again, it is recommended to focus on practical exercises in the areas that caused the most difficulty. You should also consider taking advantage of additional training materials or mentoring from experienced professionals.

What are the most common challenges when preparing for CEH?

One of the biggest challenges when preparing for CEH is the wide range of material that must be mastered. It covers not only the technical aspects, but also the legal, procedural and ethical issues involved in conducting penetration testing.

The need to combine theory and practice is also a significant challenge. Simply understanding concepts is not enough - candidates must be able to apply their knowledge to practical scenarios, which requires a significant amount of time spent practicing in the lab.

For many people preparing for the CEH exam, it is also a challenge to find a balance between studying and other professional and personal responsibilities. That’s why it’s so important to properly plan the preparation process and be realistic about the amount of time we can devote to studying.

Frequently Asked Questions (FAQ)

How much does the CEH certification cost?

EC-Council does not publish one exam price: the voucher is usually bundled with training from an accredited partner, and the amount varies by region, training format and partner. The fees EC-Council states directly are a non-refundable USD 100 eligibility application fee (for candidates without official training; included in the price of official training) and an annual USD 80 continuing education fee once certified. Retakes are paid for unless the training package includes free ones.

Is CEH better than OSCP?

CEH and OSCP serve different purposes. CEH provides broad theoretical and practical knowledge of ethical hacking with a multiple-choice exam format, making it ideal for beginners and security analysts. OSCP is more hands-on and technical, requiring candidates to exploit systems in a live lab, making it preferred for dedicated penetration testers.

Is the CEH certification worth it?

Yes, CEH is worth it for cybersecurity professionals seeking career advancement. It is globally recognized by governments and corporations, listed in DoD 8570, and holders typically earn significantly more than non-certified peers. It also provides access to an exclusive professional community.

What is the CEH exam format?

The CEH knowledge exam (code 312-50) consists of 125 multiple-choice questions to be completed in 4 hours. Questions are based on real-life scenarios covering various cybersecurity domains. The pass mark depends on the exam version: EC-Council sets a separate cut score for each question pool, between 60% and 85%. The exam is delivered through EC-Council’s ECC Exam Center; the certification site also lists Pearson VUE testing centers.

What is the average salary for CEH-certified professionals?

In the EMEA region, salaries of CEH-certified professionals depend on country and experience. In the US, salaries tend to be higher. CEH holders typically earn significantly more than their non-certified counterparts in similar roles.

What certifications does the CEH track include?

The track has three levels. The CEH certification is awarded after passing the knowledge exam (125 multiple-choice questions, 4 hours). CEH Practical is a separate, optional practical exam: 6 hours and 20 challenges solved on a live network of virtual machines and applications. Passing both exams earns the CEH Master title. According to EC-Council, both exams are ANAB-accredited (ISO/IEC 17024) and approved by the US Department of Defense under DoD 8140.

Learn key terms related to this article in our cybersecurity glossary:

  • Network Security — Network security is a set of practices, technologies, and strategies aimed at…
  • Wireless Network Security — Wireless network security refers to the measures and practices used to protect…
  • Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
  • Encryption — Encryption is the process of converting data from a human-readable format to…
  • IT Infrastructure Penetration Testing — IT infrastructure penetration testing is a controlled and ethical process of…

Learn More

Explore related articles in our knowledge base:

Explore Our Services

Need cybersecurity support? Check out:

Tags:

Cybersecurity Penetration Testing Network Vulnerabilities Encryption

Share:

Talk to an expert

Have questions about this topic? Get in touch with our specialist.

Sales Representative
Grzegorz Gnych

Grzegorz Gnych

Sales Representative

+48 664 003 003grzegorz.gnych@nflo.pl
Response within 24 hours
Free consultation
Individual approach

Providing your phone number will speed up contact.

Want to Reduce IT Risk and Costs?

Book a free consultation - we respond within 24h

Response in 24h Free quote No obligations
Book a Call +48 22 487 86 36

Or download free guide:

E-book: Digital Resilience Strategy 2026