CEH

About the CEH

CEH is the cybersecurity industry's most polarizing certification. EC-Council's Certified Ethical Hacker covers the attacker mindset, reconnaissance, scanning, enumeration, and common exploitation tooling. It is DoD 8140 approved for offensive work roles and carries name recognition with federal and enterprise HR filters. Practitioners often criticize it for being theoretical next to OSCP, but for a government or compliance-driven buyer, the accreditation matters more than the technical depth. I recommend it when the employer explicitly requests it or when you need a mid-tier offensive cert that ships with classroom training.

Who should earn it

Candidates targeting federal, defense, or large-enterprise offensive roles where CEH is explicitly required. Also useful for SOC analysts wanting offensive fundamentals without the OSCP time investment.

Exam details

Provider

EC-Council

Exam code

312-50

Questions

125

Duration

4 hours

Passing score

60-85% depending on form

Exam fee

$1,199 (verify with EC-Council)

Renewal

Every 3 years via CPE

Experience level

Mid

DoD 8570/8140

Approved

Prerequisites

Two years of information security experience or completion of the EC-Council CEH training course.

Key domains

• Information Security and Ethical Hacking Overview
• Reconnaissance Techniques
• System Hacking Phases and Attack Techniques
• Network and Perimeter Hacking
• Web Application Hacking
• Wireless and Mobile Platform Hacking
• Cloud Computing and IoT Hacking
• Cryptography

Federal and DoD relevance

The CEH is approved under DoD Directive 8570.01-M (now 8140), so cybersecurity roles supporting US Department of Defense information systems can use it to satisfy the baseline certification requirement for their IAT, IAM, or CSSP workforce category. That matters for federal contractors, cleared facilities, and agencies where 8140 compliance is a hiring gate.

Salary impact

CEH carries a 5-10% salary premium in federal and commercial-enterprise settings that require it by contract. In startup or product-security contexts it carries less weight than PenTest+ or OSCP.

Most relevant roles