OSCPOffensive Security Certified Professional

How OSCP renewal actually works

OffSec offers two recertification paths: (1) Pass the current OSCP exam again (the 24-hour practical + 24-hour report), or (2) Pass a higher OffSec certification (OSWE, OSED, OSEP, or OSCE3). The OSCP+ designation is granted to anyone who passes ANY OffSec certification on a rolling 3-year window — the recertification model rewards continued OffSec course progression.

Unlike CompTIA / ISACA / ISC², OFFSEC does NOT offer a CPE/CEU-style maintenance path. The only way to extend OSCP is by exam. This is intentional — OffSec's brand depends on its credentials representing demonstrated current ability, not accumulated learning hours.

The OSCP+ designation explained

OSCP+ is a status indicator on top of OSCP, introduced when OffSec moved to the renewal model. The base OSCP credential remains; OSCP+ is granted automatically when you complete any OffSec course exam (OSCP, OSWA, OSWP, OSED, OSEP, OSWE, OSDA, OSEE) within the previous 3 years.

Lifetime OSCP holders certified before 2024 are NOT required to renew — their OSCP stays valid forever. But they CAN opt into OSCP+ by taking any other OffSec exam, which signals to employers + customers that they're current.

Practical implication: the OSCP+ designation is roughly equivalent to "actively practicing the OSCP skill set in the last 3 years." Employers in 2025+ increasingly distinguish lifetime-OSCP from OSCP+, especially for offensive consulting roles.

What the renewal exam covers (and why it's different from the original)

The OSCP renewal exam is the same 24-hour practical + report as the original OSCP. OffSec hasn't released a "renewal exam" with reduced scope — it's the full exam. This makes OSCP renewal substantially harder than CompTIA or ISC² renewal models, which accept activity logging or shorter recertification exams.

However, the OSCP exam itself has been updated significantly since the original 2007 version. The current exam (post-2023 update) emphasizes Active Directory exploitation as a major segment, includes a heavier emphasis on report-writing quality (the report portion now affects pass/fail more substantially), and excludes some older techniques that were OSCP-staple in the 2010s. Plan a 4–8 week refresher even if you've been practicing offensively, focusing on Active Directory + the current PEN-200 syllabus.

The exam is $1599 (course + exam attempt bundle) or $249 (exam-only retake). Course + exam includes 90 days of PEN-200 lab access; the exam-only retake assumes you already have the skill set current.

Common pitfalls (and how to avoid them)

Pitfall 1: Assuming OSCP is still lifetime. Lifetime OSCP holders certified before 2024 retain it forever, but new OSCPs from 2024+ have 3-year validity. Many junior practitioners certified in 2024 still believe they hold lifetime status — check your OffSec profile for the explicit validity date.

Pitfall 2: Underestimating the 24-hour report. OSCP report quality has become more pass/fail-relevant in the post-2023 exam. Reports rejected for unclear steps or missing screenshots fail the otherwise-passed practical. Reserve 4–6 hours of the 24-hour exam window specifically for report writing; many candidates over-allocate practical time.

Pitfall 3: Banking on lab time. The 24-hour exam doesn't allow lab access during the report-writing portion. Take detailed notes + screenshots DURING the practical so you're not re-solving problems during report-writing.