1 November 2026 · 10 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
Penetration testing certifications and accreditations: what each one proves, how to verify it, and how to weigh it when you buy
A tester's OSCP, a firm's CREST membership and a methodology such as PTES are three different kinds of proof. Buyers routinely treat them as one. This guide separates the three layers, explains what each actually attests to, and shows how to check any claim in five minutes.
Three layers of proof, and why they get mixed up
When a procurement team asks whether a penetration testing provider is 'certified', the question hides three separate ones. Is the individual who will test our systems certified, and in what? Is the company accredited or inspected by an independent body? Does the work follow a recognised methodology? Each layer is attested by different organisations, verified in different registers, and proves something different. A firm can hold a company-level accreditation and still staff your engagement with a junior who has never passed a practical exam. A methodology name on a proposal proves nothing unless the report shows it was followed.
This guide takes the three layers in turn: what each credential actually tests, how long it stays valid, where to verify it and what it leaves unproven, ending with four buying rules. If you are selecting a provider right now, read it alongside our guide to choosing a penetration testing company, which covers references, insurance, reporting and retest.
Layer 1: individual tester certifications
These attest to a person, not a company. The ones that carry weight in 2026 share one feature: a hands-on exam against live systems, not a multiple-choice test.
OSCP (OffSec Certified Professional)
The de facto baseline for professional penetration testers: a 24-hour hands-on exam compromising several machines, including an Active Directory set, followed by 24 hours to write a report. OffSec issues verifiable digital badges. Since late 2024 OffSec also awards OSCP+, which expires after three years unless renewed; the original OSCP does not expire.
OSWE (OffSec Web Expert)
Advanced web application exploitation with source code access: finding and chaining vulnerabilities in white-box applications and writing a working exploit, in a 48-hour exam. The relevant credential when the scope is a complex web platform or an API rather than infrastructure.
OSEP and OSCE3
OSEP (OffSec Experienced Penetration Tester) covers evasion of modern defences and lateral movement in hardened enterprise networks, in a 48-hour practical exam. OSCE3 is not an exam but a designation for holders of OSWE, OSEP and OSED (exploit development): a tester who covers web, enterprise and binary exploitation.
GPEN and GXPN (GIAC)
GIAC Penetration Tester (GPEN) and GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) sit on SANS courses. Proctored, open-book exams with hands-on CyberLive components, renewed every four years. Strong on methodology and reporting discipline; common in US federal and regulated environments.
CRTO (Certified Red Team Operator)
Issued by Zero-Point Security, CRTO tests command-and-control tradecraft, Active Directory attack paths and defence evasion in a 48-hour lab exam. A red-team credential rather than a penetration testing one: relevant when buying adversary simulation or assumed-breach work.
CREST CRT and CCT
CREST Registered Penetration Tester (CRT) is the practitioner level with a practical exam; CREST Certified Tester (CCT) in Infrastructure or Application is the senior level, with a demanding practical assessment and a written component. Individual, renewed every three years, verifiable through CREST. Widely required in UK public-sector and financial-services procurement and increasingly named in EU tenders.
eJPT and eCPPT
INE Security's eLearnSecurity Junior Penetration Tester (eJPT) and Certified Professional Penetration Tester (eCPPT) are practical, entry- and intermediate-level certifications. Good signals for a junior on the team, not sufficient as the lead credential on an enterprise engagement.
CEH (Certified Ethical Hacker)
EC-Council's CEH is the most widely recognised name, which is why it appears in job adverts and tenders. The core exam is multiple-choice; a separate CEH Practical exists but is less often held. CEH demonstrates vocabulary and breadth, not exploitation skill. Treat it as a floor, not as evidence that someone can run your test.
Layer 2: company-level accreditations and inspections
These attest to the organisation: its processes, screening, insurance, methodology and quality control. They say nothing about who will sit at the keyboard.
CREST member company
CREST is an international not-for-profit accreditation body for the technical security industry. Member companies have their policies, processes and procedures assessed (methodology, data handling, personnel screening, insurance, complaints handling) and sign a code of conduct. Accreditation is per service line and per region, renewed annually, and listed in the public CREST register. Membership proves the firm's processes were examined; whether your testers hold CREST individual certifications is a separate question.
Keurmerk Pentesten (Netherlands)
The Keurmerk Pentesten is a Dutch quality mark for penetration testing providers, administered by the Centrum voor Criminaliteitspreventie en Veiligheid (CCV) and developed with the sector association Cyberveilig Nederland. It sets requirements on the provider's process (intake, scoping, written authorisation, reporting), on the qualifications and screening of its testers, on confidentiality and data handling, and on complaints and incident procedures. Compliance is assessed by an independent certification body operating under the scheme, with periodic re-inspection, and certified providers are listed in a public register on the CCV website. Like any company-level mark, it attests to minimum standards: it does not rank certified providers against each other, and a certified company still has to put named, qualified people on your engagement.
ISO/IEC 27001 certification of the provider
A testing firm that is itself ISO/IEC 27001 certified has an audited information security management system covering how it handles your scope documents, credentials, findings and reports: some of the most sensitive data you will ever share with a supplier. Check the certificate's scope statement; one that covers only the firm's office IT says little about the testing practice. Confirm the certification body is accredited (Raad voor Accreditatie in the Netherlands, UKAS in the UK, ANAB in the US).
DORA Article 27 and TIBER-EU tester requirements
For threat-led penetration testing (TLPT) under DORA, Article 27 requires testers of the highest suitability and reputability with expertise in threat intelligence, penetration testing and red teaming, certification by an accreditation body or adherence to formal codes of conduct, independent assurance on their own risk management, and professional indemnity insurance. The TIBER-EU procurement guidelines translate that into minimum experience, reference engagements and certified staff. It applies only to financial entities designated for TLPT.
Layer 3: methodology standards
A methodology is not a certification. Nobody is 'PTES certified'. But a provider that names the standard it follows, and whose report shows the phases, gives you a way to check completeness rather than take it on trust.
| Standard | Maintained by | What it covers | What to look for in the report |
|---|---|---|---|
| PTES (Penetration Testing Execution Standard) | Community-maintained, with technical guidelines | Seven phases: pre-engagement, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation, reporting | Each phase visible: written scope, threat model, exploitation evidence, post-exploitation impact |
| OWASP WSTG v4.2 (Web Security Testing Guide) | OWASP Foundation | Over 100 web application test cases: authentication, session management, authorisation, input validation, business logic, client-side, API | Test-case identifiers (WSTG-ATHN-03 style) per finding, or a coverage appendix listing the cases tested |
| OWASP MASVS v2 and MASTG | OWASP Foundation | The Mobile Application Security Verification Standard and its testing guide, for iOS and Android: storage, cryptography, network, platform interaction, resilience | MASVS control groups covered, platform-specific tests performed, backend API explicitly in or out of scope |
| NIST SP 800-115 | US National Institute of Standards and Technology (2008) | Technical guide to security testing: planning, discovery, attack and reporting phases, with emphasis on rules of engagement | A rules-of-engagement document, discovery results, attack-phase evidence; the common reference in US federal and FedRAMP work |
| OSSTMM v3 | ISECOM (2010) | Open Source Security Testing Methodology Manual: a metrics-driven method across human, physical, wireless, telecommunications and data network channels | Less common in 2026 commercial work; relevant where a quantitative attack-surface metric or physical and human channels are in scope |
How to verify a certification or accreditation claim
Every credential on this page can be verified in minutes. A provider that cannot produce the verification link has either lost it or never had it.
- OffSec (OSCP, OSWE, OSEP, OSCE3): ask for the digital badge link, which shows the holder's name, credential and issue date. A PDF certificate on its own is not verification.
- CREST individuals: CREST runs an online verification service for certified professionals; ask for the certificate number. CREST companies: the public member register lists each company, its accredited services and region.
- Keurmerk Pentesten: the register of certified providers is published on the CCV website; check the company name and validity period there, not a logo on a proposal.
- GIAC: holders are listed in the public GIAC certified-professional directory; ask for the analyst number.
- ISO/IEC 27001 of the provider: ask for the certificate, read the scope statement, and confirm the certification body's accreditation with the national accreditation body.
- Named testers: verify the people who will perform the work, not the company's best-known employee. The proposal should name the lead tester and each team member's certifications.
- Dates: CREST individual certifications and OSCP+ expire, GIAC renews every four years, company accreditations are reassessed periodically. An expired credential is one the holder stopped maintaining.
What a certification does not prove
A certification proves that an individual passed a defined exam on a defined day. It does not prove recent experience with your technology stack, the judgement to prioritise findings for your business, or the writing skill to produce a report that your engineers and your auditors can both use. OSCP tests infrastructure exploitation; it says little about a tester's ability to find a broken authorisation flow in a single-page application that talks to twenty microservices. OSWE tests exactly that, and says little about Active Directory.
A company accreditation proves that processes exist and were inspected, not that they were followed on your engagement or that the people who passed the inspection are the people assigned to you. A methodology name proves intent. The only evidence of a good test is a good report: reproducible findings, an attack narrative that shows how findings chain, severity that reflects your context, and remediation your team can execute. Ask for a redacted sample report before you ask for a certificate list.
How to weigh credentials when buying
Four rules that keep certifications in proportion.
1. Match the certification to the scope
Web platform or API: OSWE or equivalent demonstrated web exploitation experience. Internal network and Active Directory: OSCP as the baseline, OSEP or CRTO for hardened and monitored environments. Mobile: MASTG-aligned experience on both platforms matters more than any single certificate. Red teaming: CRTO, senior CREST simulated-attack credentials or TIBER-EU engagement experience.
2. Require named individuals
Insist that the proposal names the lead tester and lists the certifications of the people assigned. Reject 'our team holds OSCP, CREST and CEH' as a collective statement; it may describe three different people, none of whom will test your systems.
3. Use company marks as a filter, not a ranking
CREST membership, a national quality mark or the provider's own ISO 27001 certificate tells you a floor has been met and a complaints route exists. It does not tell you which of two accredited firms will find more in your environment. The sample report and relevant reference engagements decide that.
4. Check the regulatory fit first
If the test supports a specific regime, read its tester requirements before you shortlist: DORA Article 27 for TLPT; PCI DSS v4.0.1 Requirement 11.4 (qualified internal resource or qualified external third party, organisationally independent); Dutch public-sector tenders that name a quality mark; UK schemes that name CREST or CHECK; US federal work that expects NIST SP 800-115 alignment.
HackersHub's credentials
Every HackersHub penetration tester holds at least the OSCP. The team also includes OSWE holders for web and API work and CREST-certified testers, and we have delivered offensive security engagements for more than ten years from Amsterdam, Netherlands. Our methodology is aligned with PTES, the OWASP WSTG and MASTG, and NIST SP 800-115, with test-case coverage visible in the report. Every proposal names the lead tester and the certifications of the people assigned, with verification links on request.
The report itself is the evidence we would rather be judged on: an executive summary, CVSS-scored findings with reproducible evidence, an attack narrative and prioritised remediation, followed by a verification retest of medium and higher findings within 90 days. Michael van Mameren, Lead Penetration Tester (OSCP), reviews every report before it leaves.
Frequently asked questions
Related guides
- Penetration testing services by certified testers
- What is penetration testing? Definition, phases and methodology
- How to choose a penetration testing company
- What does a penetration tester do?
- Security audit vs penetration test
- Is penetration testing required by law?
- DORA penetration testing and TLPT tester requirements
- Penetration testing RFP checklist
Want to see the credentials behind the report?
Every proposal names the lead tester and lists the team's certifications with verification links. Scope a test and judge us on the sample report. Talk to an expert.