CEH (Certified Ethical Hacker): EC-Council Credential Guide

1. What Is CEH?

CEH stands for Certified Ethical Hacker, a professional certification awarded by EC-Council. It recognizes knowledge of identifying security weaknesses using attacker techniques within an authorized, lawful security assessment. Its perspective is vendor-neutral rather than tied to one security product. The intended audience includes security professionals, administrators, auditors, and people moving into vulnerability assessment or ethical hacking.

Candidates qualify through official training or an approved experience-based application, then pass a proctored knowledge examination. The standard CEH credential does not require passing a hands-on examination. CEH (Practical) is a separate certification; holding both leads to the CEH Master designation.

For hiring purposes, CEH should indicate assessed knowledge of attack methods and countermeasures. It should not be treated as proof that someone has independently delivered a penetration test, managed a sensitive client engagement, or demonstrated practical competence under examination.

2. CEH at a Glance

Full name: Certified Ethical Hacker.
Abbreviation: CEH, also stylized C|EH.
Credential type: Individual professional certification.
Awarding organization: EC-Council, the International Council of E-Commerce Consultants.

Official website: EC-Council Certified Ethical Hacker

First introduced: 2003.
Current status: Active. Current training is marketed as CEH v13, with AI-related content.
Professional focus: Ethical hacking, attack techniques, vulnerability assessment, and countermeasures.
Intended career stage: Developing and established IT security professionals.
Geographic scope: International, not a jurisdictional license.

Main eligibility requirement: Official training, or an approved application documenting two years of relevant security experience.
Assessment: One four-hour, 125-question multiple-choice examination.
Indicative initial cost: US$1,050 for the experience-based route using the US$950 remote examination, excluding preparation, taxes, and maintenance.
Maintenance: 120 continuing-education credits over three years and an annual US$80 fee.
Verification: EC-Council’s ASPEN verification facility, using the candidate’s name and certification number.

3. Who Awards and Oversees the Credential?

EC-Council owns and administers CEH. Its certification function manages eligibility, examinations, certification decisions, renewal, and candidate support. A scheme committee comprising information-security professionals oversees certification affairs. Training providers prepare candidates, but completing a provider’s course is not the same as receiving EC-Council certification.

The ANSI National Accreditation Board, or ANAB, accredits EC-Council’s CEH certification program under ISO/IEC 17024, the standard for bodies certifying individuals. ANAB’s directory records CEH accreditation from March 1, 2012, with the current accreditation valid through March 1, 2027. This accreditation concerns the certification system, not a guarantee of every holder’s job performance.

Examinations are available through EC-Council’s examination infrastructure and Pearson VUE. EC-Council, rather than the testing provider, determines certification requirements and maintains policies covering examination integrity, complaints, appeals, and disciplinary action.

4. When and Why Was the Credential Created?

EC-Council dates CEH’s creation to 2003. Its stated purpose was to establish a common knowledge standard for professionals applying hacking techniques defensively, while distinguishing authorized assessment from malicious activity. This explains the credential’s continuing combination of technical attack knowledge, countermeasures, and professional conduct.

Three subsequent milestones help explain the present credential:

• 2012: CEH received personnel-certification accreditation, strengthening the formal governance of its assessment and certification process.
• 2018: EC-Council introduced CEH (Practical), adding a separately assessed hands-on pathway alongside the knowledge credential.
• September 23, 2024: EC-Council launched CEH v13 with AI-related learning capabilities.

The important historical distinction is that richer training and additional practical credentials have not made every CEH holder a practical-examination graduate. Employers should identify the exact credential earned, rather than infer assessment requirements from the current training program’s branding.

5. Who Pursues the Credential, and Where Is It Used?

EC-Council identifies security officers, auditors, security professionals, and site administrators among CEH’s intended candidates. Its subject matter also relates to vulnerability-analysis and penetration-testing work, although those assignments can demand substantially more practical depth than the knowledge examination establishes.

Typical reasons to consider CEH include developing a structured understanding of attacker behavior, meeting an employer’s credential preference, or adding offensive-security knowledge to an infrastructure or defensive-security background. For career planning, distinguish a job advertisement that accepts CEH among several qualifications from one that specifically requires it.

Based on its coverage, relevant professional settings include:

• Financial services and online commerce: Evaluating weaknesses affecting accounts, customer-facing applications, and transaction systems.
• Technology and professional services: Supporting vulnerability reviews across applications, networks, and cloud environments.
• Healthcare and manufacturing: Understanding technical threats while recognizing that clinical and operational systems require additional safety and availability expertise.

These are applications of the syllabus, not evidence that every holder has experience in those industries.

When staffing a cyber risk assessment, use CEH as one signal for the technical vulnerability-analysis workstream. Separately evaluate whether the consultant can connect findings to business exposure, prioritize remediation, and communicate uncertainty.

CEH is not permission to test a system. EC-Council’s ethics requirements expressly require authorization and lawful boundaries for penetration testing.

6. What Knowledge and Skills Does It Cover?

The published CEH examination blueprint is version 5.0. Its nine domains can be organized into eight practical topic groups below, combining the foundational and cryptography domains for readability. Percentages are the blueprint’s published weights.

• Foundations and cryptography, 6% and 5%: Security concepts, ethical boundaries, controls, encryption, and key infrastructure support appropriate assessment choices.
• Reconnaissance, 17%: Discovering hosts, services, and exposed information supports understanding a target’s attack surface.
• System compromise and malware, 15%: Vulnerability analysis, access, privilege escalation, and malicious software explain how weaknesses become compromise.
• Network and perimeter attacks, 24%: Traffic interception, social engineering, service disruption, session attacks, and control evasion support attack-path analysis.
• Web security, 14%: Server, application, and database-injection weaknesses support evaluating exposed business applications.
• Wireless security, 5%: Wireless threats and protections support identifying weaknesses in network access.
• Mobile and connected systems, 10%: Mobile devices, Internet of Things, and operational technology introduce platform-specific exposures.
• Cloud security, 5%: Cloud, container, and serverless concepts support recognizing threats in hosted environments.

Applied capabilities

Illustrative assignments include examining exposed services before an application launch, distinguishing a scanner finding from a demonstrated vulnerability, and translating a technical weakness into a remediation recommendation. In manufacturing, the connected-systems content can help frame questions about operational technology, but should not be interpreted as qualification to conduct intrusive testing on production equipment.

Boundaries

These examples are professional applications of the subject matter, not tasks every CEH holder has performed. The multiple-choice examination does not directly assess a complete client report, production-safe execution, stakeholder communication, or end-to-end engagement delivery. CEH (Practical) provides separate evidence of performance in a controlled examination environment.

AI-related content appears in v13 training. Course coverage should not be confused with a separate AI-security specialization or an additional examination domain.

7. What Are the Eligibility Requirements?

CEH has two principal eligibility routes:

• Official-training route: Complete recognized EC-Council training through its official learning arrangements, an authorized training partner, or an approved academic institution.
• Experience-based route: Document at least two years of relevant information-security work and obtain approval through the exam-eligibility process. EC-Council contacts the application’s verifiers to substantiate the experience.

The official-training route matters when interpreting a holder’s background: CEH does not establish that every holder has two years of professional security experience. Conversely, the experience route does not require two years exclusively under the job title “penetration tester”; the issuer accepts experience within its listed security domains.

Neither route lists a university degree or another professional certification as a universal prerequisite. For applicants using experience, select verifiers who can explain relevant duties and dates, not merely confirm employment. Make sure they know a verification request is coming.

Independent videos or an unaffiliated preparation course may help learning, but do not substitute for official training when seeking the training-based eligibility exemption. Candidates relying on those resources still need an applicable eligibility route.

Minors require additional approval documentation, including parental or guardian consent and support from an eligible educational institution. Candidates must also accept the applicable certification and examination agreements. This is a credential-admission process, not a security clearance or a general assessment of suitability for sensitive client access.

8. How Do You Earn the Credential?

Step 1: Establish eligibility

Complete official training or submit the experience-based application. Keep the resulting approval or training-completion documentation. Eligibility permits the examination attempt; it does not itself confer certification.

Step 2: Obtain the correct voucher and schedule

For the experience-based route, application approval is valid for 90 days. Once purchased, the examination voucher normally provides 12 months to schedule and complete the examination. Follow the purchase instructions associated with the approved application because eligibility and voucher records are linked.

Choose the delivery channel before paying. EC-Council sells a remotely proctored option, while Pearson VUE provides another examination channel. Remote candidates should check technical requirements, identity-document requirements, available examination languages, and appointment rules in advance. A course offered in a particular language does not necessarily establish examination availability in that language.

Step 3: Take the knowledge examination

The CEH examination, code 312-50, contains 125 multiple-choice questions and allows four hours. It assesses knowledge rather than requiring a live penetration-testing engagement. EC-Council sets the passing threshold by examination form; its certification page publishes a range of 60% to 85%. There is no single universal “70% pass mark.” These thresholds are not candidate pass rates.

Follow the examination-specific rules on permitted materials and assistance. Agreeing to confidentiality and examination-integrity requirements is part of the process, and an apparent pass does not override a subsequent integrity review.

Step 4: Receive the award or arrange a retake

EC-Council’s handbook states that the digital certificate is normally issued within seven working days after successful examination completion. Final certification remains subject to the issuer’s requirements.

The first retake has no mandatory waiting period. After further failures, 14-day waiting periods apply. Candidates may make no more than five attempts in a 12-month period, with a further 12-month wait before a sixth attempt. Retakes are not automatically included in every purchase.

9. How Long Does It Take, and How Do Candidates Prepare?

Prerequisite-building time: The experience route requires qualifying work experience before application. Official training provides an alternative, so two years is not the minimum elapsed time for every candidate.

Preparation time: EC-Council describes a five-day, approximately 40-hour training format. That is course duration, not a reliable estimate of the time every candidate needs to become exam-ready. Someone unfamiliar with networking, operating systems, and web applications should plan additional foundational work.

Administrative time: EC-Council gives a typical eligibility-processing period of five to ten working days; delayed verifier responses can extend it.

Official preparation resources: These include courseware, guided laboratories, examination preparation, and practice environments. Exact access and inclusions depend on the package.

Preparation choices: Start with a domain-by-domain gap assessment. Combine reading with authorized laboratory practice and explanations of why an attack succeeds or a control fails. Avoid measuring readiness solely by memorized practice-question scores. A useful preparation exercise is to explain a vulnerability, its business consequence, and a proportionate fix without relying on a tool’s severity label.

10. How Much Does the Credential Cost?

As of September 25, 2026, the following US-dollar prices are published through EC-Council’s US-facing certification and store pages:

• Experience-based eligibility application: US$100, nonrefundable.
• Knowledge examination: US$950 for the remotely proctored option; US$1,199 for the Pearson VUE option.
• Remote retake voucher: US$500 for approved retake candidates, unless covered by their package.
• Official on-demand training: Advertised from US$1,699. Confirm the examination, laboratory, access-period, and retake inclusions before comparing offers.

An eligible self-study candidate passing on the first attempt therefore faces an application-and-examination outlay of US$1,050 remotely or US$1,299 through VUE. Those totals exclude preparation, taxes, travel, equipment, and continuing-education fees. They are not universal all-inclusive prices.

For candidates pursuing the additional practical assessment, the store lists a combined CEH and CEH (Practical) examination package at US$1,250. It excludes study materials and does not remove applicable eligibility requirements. That package is optional for earning standard CEH.

Budget separately for the annual US$80 maintenance fee, totaling US$240 over a three-year cycle, plus any paid development activities. Check cancellation, rescheduling, and voucher-extension terms before purchase.

11. How Do Holders Maintain the Credential?

CEH uses a three-year continuing-education cycle requiring 120 credits. EC-Council’s current material uses Continuing Professional Education, or CPE, terminology while also retaining references to its earlier EC-Council Continuing Education, or ECE, terminology. Holders must also pay the annual continuing-education fee. Paying the fee alone does not satisfy the learning requirement.

Eligible activities include relevant education, conferences, research, writing, and other recognized professional contributions. Maintain evidence supporting submitted activities. The policy directs holders to register credits earned during a calendar year by February 1 of the following year.

If requirements remain unmet at the end of the cycle, suspension can follow. The policy provides a 12-month reinstatement opportunity through completion of the required credits and payment of outstanding fees. Reinstatement does not restart a fresh three-year clock. Continued noncompliance can lead to revocation, after which passing the applicable examination again is required to regain certification.

Ethical conduct and accurate representation of certification status are continuing obligations. For procurement or hiring, distinguish an original award certificate from evidence that the credential remains valid today. Someone who earned CEH years ago but did not maintain it should not be evaluated as a current holder.

12. What Is Its Professional Value, and What Are Its Limitations?

CEH can be useful as a standardized knowledge signal and as a way to organize learning across a broad attack-and-defense syllabus. For an employer, it may reduce uncertainty about whether a candidate has encountered relevant terminology and concepts. It does not remove the need to evaluate how that knowledge is applied.

A concrete procurement example is Foxhole Technology’s GSA schedule dated June 21, 2024. It identifies CEH within ethical-hacker labor categories while separately specifying experience, education, communication, and technical capabilities. This is evidence of use in a particular contracting context, not a universal market requirement.

For US defense assignments, evaluate the applicable DoD 8140 work role and proficiency level rather than relying on older DoD 8570 charts. The current qualification framework distinguishes foundational qualification options from additional position-specific requirements. A certification mapping is not blanket qualification for every defense cybersecurity job.

For a prospective candidate, the strongest business case is usually a specific one: a target employer accepts the credential, an existing role benefits from the syllabus, or structured training addresses identifiable knowledge gaps. Compare the complete cost with the evidence your target role actually demands.

For hands-on penetration-testing recruitment, a practical assessment, a strong work sample, or supervised delivery experience may be more directly informative than another knowledge credential. Avoid assuming that an occupational salary figure is a CEH salary premium. Salary comparisons should separate experience, geography, role, clearance, and other qualifications before attributing an effect to certification.

13. What Should Employers and Clients Infer From It?

What the credential establishes

A verified current holder has met EC-Council’s applicable eligibility and knowledge-assessment requirements and remains subject to maintenance and conduct obligations. Because training can substitute for the experience-based admission route, CEH alone does not establish a uniform amount of work experience.

What still requires evaluation

Assess practical testing ability, production-safety judgment, industry familiarity, reporting, stakeholder management, and the scale of previous assignments separately. Treat CEH as an individual qualification, not accreditation or authorization of the holder’s consulting firm.

For staffing, it can support consideration for vulnerability-analysis, technical-assessment, or remediation-validation workstreams. Do not infer readiness to lead an entire red-team engagement or own enterprise cyber-risk decisions from the letters alone.

Evidence to request

Request a sanitized assessment report, an example of agreed testing boundaries, a finding showing validation and remediation, and a reference who can explain the person’s actual contribution. Do not request confidential client data or protected examination content.

Three questions to ask

1. Before testing a hospital’s internet-facing application, how would you establish authorization, scope, and stop conditions? A useful answer identifies authorized decision-makers, third-party dependencies, operational constraints, escalation contacts, and explicit limits.
2. A scanner reports a critical weakness on a business-critical server. How would you validate and prioritize it without unnecessary disruption? Look for discrimination between detection and proof, safe validation methods, exposure analysis, and attention to compensating controls.
3. How would you turn a confirmed technical finding into a remediation decision and demonstrate that the fix worked? Look for reproducible evidence, clear impact, practical remediation options, ownership, and a defensible retest.

14. How Does It Compare With Related Credentials?

CEH (Practical) and CEH Master: Related progression

CEH (Practical) is EC-Council’s separate hands-on certification, assessed through 20 challenges over six hours. It adds evidence of execution in a controlled environment. CEH Master is the designation awarded to people holding both CEH and CEH (Practical), not a third independently purchased certification. Applicants should check the practical credential’s own current eligibility rules rather than assume that CEH admission rules automatically settle them.

OffSec OSCP/OSCP+: Practical alternative

OffSec’s current OSCP+ assessment emphasizes hands-on exploitation and documentation. It allows 23 hours and 45 minutes for the practical examination, followed by a reporting period. The credential’s published assessment criteria do not mandate prior work experience. Compared with standard CEH, it supplies more direct evidence of performance in a constrained testing environment, although client delivery still requires separate evaluation.

CISSP: Broader complement

ISC2’s Certified Information Systems Security Professional addresses broader security architecture, operations, and management. Full certification normally requires five years of qualifying experience across at least two domains, with permitted waivers of up to one year, plus the examination and certification process. It can complement CEH for broader security responsibility, but is not a substitute for practical penetration-testing evidence.

Choose among these according to the work to be assessed: broad security responsibility, knowledge of attack methods, or demonstrated technical execution. More credentials do not automatically mean a better match.

15. How Can You Verify the Credential and Use Its Letters Correctly?

EC-Council provides a verification facility through ASPEN. Its public form requests the candidate’s name and certification number. Ask the holder for those details rather than relying only on a résumé, badge image, or training-completion certificate.

During verification, check:

• That the identity matches the person being evaluated.
• Whether the award is CEH, CEH (Practical), or another credential.
• The current validity and status, not simply the original award date.
• Whether a claimed CEH Master designation is supported by both underlying certifications.

A failed lookup is a reason to investigate, not automatic proof of misrepresentation. Recheck spelling and the certification number, then request clarification from EC-Council with the holder’s cooperation.

Use CEH to identify the credential actually awarded, including in a professional profile or signature. Candidates and course attendees should not present themselves as certified before EC-Council confirms their certification status. The issuer’s agreement also prohibits misleading representations of endorsement.

Logo permissions are distinct from ordinary factual descriptions of qualifications. EC-Council prohibits use of its certification logo when the credential is suspended, revoked, or expired without renewal. Its published guidelines require “retired” qualification when an authorized retired-status holder uses the logo.

16. Frequently Asked Questions

Can I earn CEH without two years of security experience?

Yes. Completing recognized official training provides an alternative eligibility route. The two-year experience requirement applies to candidates seeking approval without that training. Consequently, employers should ask about experience directly rather than assume it from CEH status.

Does CEH always include a practical examination?

No. Standard CEH is earned through the knowledge examination. CEH (Practical) is separately assessed. A training package may include both examinations, but package inclusion does not prove that its purchaser passed both or earned CEH Master.

Are CEH v13 and examination blueprint v5 the same version?

No. The numbers identify different things: v13 refers to the training program, while v5.0 identifies the published examination blueprint. Candidates should use the applicable blueprint to understand assessed domains rather than assume matching version numbers.

Must I retake CEH whenever new courseware appears?

A courseware update does not itself require every holder to retake the examination. Maintaining CEH follows the continuing-education and fee requirements. Candidates should distinguish a voluntary course upgrade from the obligations attached to keeping their existing credential current.

Does CEH authorize security testing internationally?

No. It is a professional credential, not universal permission to access systems. Each engagement requires appropriate authorization and compliance with applicable legal limits. The credential also does not replace any separate requirements affecting a service provider or its client engagement.

17. Official Resources and Recent Changes

Official resources available: EC-Council publishes candidate handbooks, examination blueprints, eligibility guidance, assessment policies, ethics rules, continuing-education requirements, and verification facilities. Use certification-policy documents for requirements and the training package description for purchased learning resources.

Material version changes: Examination blueprint v5.0 took effect on April 10, 2024. CEH v13 training launched on September 23, 2024, adding AI-related learning. These are separate changes; neither means that every existing CEH holder completed the newer training or a practical assessment.

Interpretive caution: Passing-score ranges are not pass rates. Training laboratories are not equivalent to a passed practical certification, and an original certificate does not establish current standing.

This profile is an independent Umbrex reference and is not issued or endorsed by the credential owner unless an explicit relationship is stated.