Blog
Jan 4, 2016
What it means to be an OSCP
When a student earns an Offensive Security certification such as the OSCP, it is a testament to the personal investment they have made as part of a commitment to excellence. Like getting a degree from a university, no matter what happens in your life from that point forward, the fact is your earned that certification and it is yours to keep. Saying this, there are some hard truths behind the path to OSCP.
3 min read

When a student earns an OffSec certification such as the OSCP, it is a testament to the personal investment they have made as part of a commitment to their knowledge and career. Like getting a degree from a university, no matter what happens in your life from that point forward, the fact is you earned that certification and it is yours to keep.
The OffSec Certified Professional
Saying this, there are some hard truths behind the path to OSCP. OffSec courses are not easy as they demand a lot from the student, require a significant investment of time, and intentionally create an environment to challenge the student to apply the knowledge they have gained. They require proof that students not only understand the concepts but can actually put them to work under pressure in a timed environment. The stress of this assessment process is a core aspect of it, simulating the circumstances experienced by a professional penetration tester in the field.
Learning real world practical skills
Our goal is to ensure that students learn something practical in training, not just memorize a bunch of random command lines for arbitrary tools in an effort to get 70% or better on a multiple choice test. This requires significant time commitment in our labs, repeated practice of the material from the lab guide, and developing real solutions to real problems in real scenarios.
Recertification, CPE’s & Certification maintenance fees
Some certification bodies require students to pay an annual maintenance fee. Other companies require students to submit continuing education credits to maintain their certification, essentially making their students a market for resellers to push their CPE products toward. Both of these approaches are great sources of ongoing income, but when the incentive is to generate as many certified individuals as possible to force these services upon, it undermines the goals of the certification by making it easily achievable. This in turn, diminishes the quality of the certified individuals and damages the field as a whole.
OffSec says “Try Harder”
At OffSec, we don’t engage in either of these practices mentioned above, and don’t intend to in the future. Our students are not a product to be sold off to other companies or to be leveraged for as much money as possible. We are committed to providing quality training with meaningful certifications that are respected in the industry. We want our students to achieve something they can be proud of.
OSCP Certified? Tell us your story!
Now that we’ve told you what we think of OSCPs, we would like to hear your opinion too. If the OSCP certification has changed your career, way of thought, or even your life, we’d love to hear about it. For those of you who have obtained the OSCP and have an interesting story you would like to share (and allow us to publish), we invite you to send it to us by email to community (at) offsec dot com by the 20th of Jan, 2016. Our favorite entry will earn its author a brand New OnePlus One NetHunter device, including shipping. Go ahead, take control of your future and be ready to Try Harder.
Stay in the know: Become an OffSec Insider
Get the latest updates about resources, events & promotions from OffSec!
Latest from OffSec

Research & Tutorials
CVE-2024-2928: MLflow Local File Inclusion via URI Fragment Manipulation
Read about an LFI vulnerability disclosed in MLflow which allowed unauthenticated remote attackers to read arbitrary files by exploiting URI fragments containing directory traversal sequences.
May 15, 2025
3 min read

Research & Tutorials
CVE-2025-23211: Tandoor Recipes Jinja2 SSTI to Remote Code Execution
A critical SSTI vulnerability was discovered in the open-source meal planning application Tandoor Recipes leading to a full system compromise.
May 8, 2025
2 min read

Research & Tutorials
CVE-2025-29927: Next.js Middleware Authorization Bypass
In this CVE blog, we explore a vulnerability in Next.js stemming from the improper trust of the x-middleware-subrequest header.
May 1, 2025
3 min read