CEH

Overview

Certified Ethical Hacker (CEH) is a cybersecurity certification from EC-Council, a certification body headquartered in the United States that operates worldwide. CEH certifies that a candidate can find and report security weaknesses in computer systems and networks using the same tools and techniques as malicious attackers, but legally and with permission — a practice known as penetration testing or ethical hacking. The certification is country-neutral and is taken by candidates globally. For 2026, the current version is CEH v13, which EC-Council describes as its first version to weave artificial-intelligence tools into the hacking workflow, on top of the programme's existing coverage of more than 550 attack techniques across 20 learning modules.

Who can apply

EC-Council offers two separate paths to sit the CEH knowledge exam:

• Official training: completing an EC-Council training course through iClass (EC-Council's own online platform), an Authorized Training Center, or an Academia Partner college or university. This path carries no prior-experience requirement and is open to any skill level.

• Experience-based application: candidates who skip official training can apply directly if they have at least 2 years of information-security work experience, by submitting an eligibility application with supporting proof of that experience.

EC-Council sets no other formal prerequisite, though it recommends roughly 2 years of IT-security background even for candidates who come through official training. The optional CEH Practical exam has no eligibility requirement of its own, but EC-Council recommends completing the CEH course before attempting it.

Exam pattern

CEH is made up of two separate exams. Passing the knowledge exam earns the CEH certification; passing both exams earns the CEH Master designation.

CEH (knowledge exam)

CEH Practical (optional)

Marking and results

EC-Council does not use one fixed pass mark for the knowledge exam. Candidates sit one of several exam forms of differing difficulty, and each form is calibrated to its own cut score, generally falling between 60% and 85%. A candidate's result is pass or fail against the cut score set for the specific form they received, so the exact passing percentage can differ from one candidate's exam session to another's.

Fees

Fees are in US dollars (USD) and are subject to change; EC-Council's store is the current authority on price.

• Candidates who complete official training buy a training package that includes the exam voucher.

• Candidates on the experience-based path pay a non-refundable eligibility-application fee of $100 before they can buy an exam voucher.

• The standalone CEH knowledge-exam voucher is priced at $1,199 when the exam is booked through Pearson VUE, or$950 when booked at an EC-Council exam centre (RPS).

• The optional CEH Practical exam costs $550.

• CEH Master is a designation, not a separate purchase — it carries no fee of its own.

How to apply

1. Choose a path: enrol in an official EC-Council training course, or prepare an eligibility application showing at least 2 years of information-security experience.

2. Candidates on the experience-based path submit the eligibility application with the $100 fee; EC-Council reviews it before approving the exam purchase.

3. Once approved, or after completing official training, buy a knowledge-exam voucher from EC-Council's store and schedule the exam through Pearson VUE or an EC-Council exam centre.

4. The CEH Practical exam voucher is bought and scheduled separately, after passing the knowledge exam.

After the exam

A CEH certification is valid for 3 years from the date it is earned. To keep it active, the holder must earn 120 EC-Council Continuing Education (ECE) credits across that 3-year cycle and pay an annual membership fee, published at $80 a year, through EC-Council's member portal. Meeting both the credit requirement and the membership payments extends the certification for a further 3 years. ECE credits can be earned through activities such as attending conferences and webinars, completing further EC-Council training, or publishing security research.

Preparation tips

EC-Council's own course material, delivered through iClass, Authorized Training Centers or Academia Partners, is built against the same exam blueprint and module list the knowledge exam draws questions from, and includes hands-on labs using comparable tools. Candidates on the experience-based path, who skip official training, should still study the published module list closely, since the exam covers all 20 modules rather than a subset.