How long does it take to study for OSCP?

OSCP study time has a real distribution, and where you fall depends entirely on what you bring to the starting line. The Offensive Security Certified Professional exam from OffSec is widely treated as the most demanding entry-level penetration testing certification because it is a 23-hour, 45-minute hands-on practical test followed by a 24-hour report-writing window. There is no multiple-choice component. You either compromise the target network and document it professionally, or you fail. According to OffSec (2024) the exam covers Linux and Windows privilege escalation, web application attacks, Active Directory exploitation, and lateral movement.

Timeline by starting profile. Candidates with one to two years of cybersecurity experience plus comfort with Linux, networking, and scripting typically need three to six months at 15 to 20 hours per week. Candidates moving from general cybersecurity into offensive work need six to nine months. Complete career changers with no security background need 9 to 18 months and should not start OSCP preparation directly. Most successful candidates report 200 to 400 cumulative hours of lab practice on top of PEN-200 course material review.

What the preparation actually requires. Complete the PEN-200 course material end-to-end and every numbered exercise. Compromise all PEN-200 lab machines. Supplement with Hack The Box using TJ Null's publicly maintained OSCP-like machine list as a study guide. Run through TryHackMe's offensive security and Red Team paths. Practice Active Directory exploitation through machines like Forest, Sauna, Active, and the Hack The Box Pro Labs (Dante, Offshore) for sustained multi-host engagements. Build a personal methodology document that you refine through every machine.

The report-writing component catches most candidates off guard. The exam requires a professional penetration test report submitted within 24 hours of the practical session ending. Practice writing reports throughout your lab work. Use the OffSec report template. Document each compromised machine with reproducible steps, evidence screenshots, and clear scope adherence. A technically successful candidate can still fail OSCP by submitting a poor report.

Cost breakdown. PEN-200 with 90-day lab access: $1,749 (OffSec, April 2026 pricing). PEN-200 with 365-day lab access: $2,499. Subscription option (Learn One): $2,599 per year including PEN-200 and other OffSec course access. Exam retake fee: $249. Optional Hack The Box VIP subscription: roughly $14 to $20 per month. Total realistic investment runs $2,000 to $3,500 for first attempt depending on lab access duration chosen.

Decision logic on when to start. Start OSCP preparation if you can pass the OffSec PEN-200 entry assessment, you have completed at least 30 Hack The Box machines independently, you have stable Linux command-line fluency, and you have basic Python scripting skills. Delay OSCP if you are still working through CompTIA Security+ or PenTest+, if you have not yet built a functional home lab, or if you have less than six months of cybersecurity operational time. The credential is achievable for many people but not for everyone at the same time.

OffSec does not publish first-attempt pass rates. Community estimates put the rate at roughly 40% to 60% for well-prepared candidates per recurring Reddit r/oscp threads and writeups. The retake mechanism allows two additional attempts within twelve months of the original purchase, which makes OSCP forgiving of one failure even if it is hard on the wallet. OSCP itself does not expire once earned, making it a one-time investment in credentialing.

Tradeoffs to acknowledge. OSCP is hard. It rewards persistence more than intelligence. The lab time required is genuinely 200 to 400 hours, not a marketing number. Candidates with families or full-time jobs need to plan study cycles that respect the time commitment. The credential's hiring weight justifies the investment for dedicated offensive security careers, but it does not justify the investment for SOC analysts, GRC analysts, or security engineers who do not need offensive credibility.

For related context, see the related career entries for penetration-tester and security-engineer, the certification entries for oscp, comptia-pentest-plus, and gpen, and the glossary entry for penetration-testing.