CREST vs OSCP for penetration testers

CREST vs OSCP for penetration testers: when to choose each

If you are a regulated body or a private firm choosing a testing provider, the first thing to separate is the level at which each credential works. CREST accreditation and certifications are the names that CBEST, CHECK and many procurement processes ask for, because CREST is a not-for-profit company that accredits member firms and certifies individuals, and the Bank of England names it as the accreditation and certification body for CBEST. OSCP and OSCP+ work at a different level. They show that an individual passed a 24-hour proctored exam on standalone machines and an Active Directory set, but they do not accredit a company. Ask for CREST when the requirement is about the firm and its scheme. Ask for OSCP or OSCP+ when you want evidence that a named tester can exploit hands-on.

In practice, require CREST where a scheme or regulator names it, and check the scheme's own rules for who must be credentialed. CREST's About us page describes its accreditation and certification remit, so start there and confirm the current status of any firm you shortlist. PCI SSC's Penetration Testing Guidance treats OSCP, GIAC certifications, CREST penetration testing certifications and CHECK as indications of skill, but states that PCI SSC does not validate or endorse them and that certifications alone do not establish experience. Read that as a reason to ask for evidence of past work, not as a pass mark. Where the buyer has no named scheme, it is reasonable to ask for OSCP or OSCP+ holders on the team as an added skills signal.

A practical approach is to ask for both where the stakes justify it: a CREST-accredited firm for the engagement itself, and named testers whose individual credentials you can verify. Confirm which OSCP designation a tester holds, because OffSec states that the OSCP+ designation expires three years after issuance while the original OSCP does not expire, and that the plus can be kept through a recertification exam, another qualifying OffSec exam or its CPE program. Also confirm whether the CREST certificate in the proposal is current and matches the role on the team. Written scope, rules of engagement and named staff should appear in the quote, so that credentials are checked against the people who will actually run the test.

How CREST accreditation and OSCP differ on what they prove

This table sets CREST company accreditation, CREST individual certifications and the OSCP and OSCP+ credentials side by side on subject, what each proves, exam format, expiry and where regulators or buyers name them. Read it first to separate what a firm holds from what a tester holds, then check the renewal and evidence rows against your own procurement requirements.

Attribute	CREST company accreditation and certifications	OffSec OSCP and OSCP+
Subject assessed	CREST accredits member companies, and certifies individuals in disciplines including security testing and red teaming	Certifies an individual tester who passes the OffSec exam
What it proves	A firm's organizational capability, and for individuals, a CREST-assessed certified skill set	That the individual passed a hands-on exam covering initial access, privilege escalation and an Active Directory breach scenario
Exam format	Individual certifications are assessed through CREST's own processes, so confirm the current format directly with CREST	24-hour proctored exam with three standalone machines and an Active Directory set across three machines
Expiry and renewal	Confirm the validity period and renewal terms for each CREST individual certificate with CREST before relying on them	OSCP+ expires three years after issuance, while the original OSCP does not expire; the plus can be kept by recertifying, passing another qualifying OffSec exam or using the CPE program
Where regulators or buyers name it	Named by the Bank of England as the accreditation and certification body for CBEST, and used in UK public sector testing through CHECK	Listed by PCI SSC as an indication of tester skill, without PCI SSC validating or endorsing it
Ongoing professional development	CHECK title holders must hold a valid technical certificate such as CRT or CCT, re-passed every three years, plus 75 hours of CPD over a three-year cycle	Maintained through the OSCP+ renewal routes listed above, which does not specify a CPD hour count in the supplied facts
What it does not prove	Does not, on its own, show that a specific engagement will be run well or that a firm's report quality meets your standard	Does not establish experience alone, according to PCI SSC's guidance on tester certifications
Ask the provider for	Current CREST company accreditation status, named staff certificates and CHECK team titles where relevant	Certificate holder names, OSCP or OSCP+ issue dates and expiry status, and evidence of recent hands-on work

Which scheme fits your buying scenario

UK financial services firms running threat intelligence-led assessments under CBEST should look at the scheme itself first. The Bank of England names CREST as the accreditation and certification body for CBEST, so the provider and the individuals on the engagement are assessed through CREST's framework rather than through a single personal certificate. Ask the buyer's supervisor and the Bank of England's implementation guide which requirements apply to your engagement before you write the tender.

Company accreditation: Confirm the provider holds the CREST accreditation that the CBEST process requires for the discipline in scope, and ask for the current certificate.
Named team roles: Ask which individuals hold CREST certifications for red teaming or threat intelligence, and check each one against the CREST register.
Team lead experience: Request evidence of prior threat-led work, not only exam results, since certifications alone do not establish experience.
Threat intelligence input: Confirm who produces the intelligence scenarios and whether that person holds the relevant CREST threat intelligence certification.
Exam certifications as supporting evidence: An OSCP or OSCP+ can show hands-on skill for named testers, but it does not replace CREST accreditation for a CBEST engagement.

Before signing, confirm with your supervisor and the provider's CREST accreditation status in writing.

What each credential shows and misses

Each credential answers a different question: whether one person can exploit systems, whether a firm runs its processes to a standard, or whether a tester's skills are current. None of them tells a buyer how well a specific engagement was scoped, run and reported, so the checks that follow the credential matter as much as the credential itself.

OSCP proves individual exploitation skill

The OSCP exam is a 24-hour proctored test with three standalone machines, graded on initial access and privilege escalation, plus an Active Directory set that simulates a breach across three machines. A pass shows that one person could compromise hosts and move through a domain under exam conditions. It says little about report quality, client communication, scoping or handling live production systems. Ask for the candidate's sample report and their recent engagement scope, not just the badge.

OSCP+ renewal proves currency, not growth

OffSec states that the OSCP+ designation expires three years after issuance, while the original OSCP does not expire. The plus can be kept through a recertification exam, another qualifying OffSec exam, or the CPE program. A current OSCP+ therefore shows recent activity against OffSec's criteria, but a holder who renewed through CPE credits has not necessarily sat a new hands-on exam. Confirm which route a candidate used and when the designation expires.

CREST accreditation proves company processes

CREST is a UK not-for-profit that accredits member companies. Accreditation assesses the organization's processes, quality management and the staff it places on work, so it speaks to the firm rather than to any single tester. It does not certify that every consultant on a project holds an individual credential or that every engagement meets the same standard. Ask which CREST accreditation the firm holds, which disciplines it covers, and who will actually run your test.

CREST individual certificates prove assessed knowledge

CREST certifies individuals in disciplines such as security testing, red teaming and threat intelligence. Individual certificates show that a person passed a CREST-run assessment in a named discipline. They are the route into schemes such as CHECK, where a title holder must also keep a valid technical certificate and complete continuing professional development. Check the discipline on the certificate, its validity date and whether it matches the work you are buying.

PCI SSC says certifications do not prove experience

PCI SSC's Penetration Testing Guidance lists OSCP, GIAC certifications such as GPEN and GWAPT, CREST penetration testing certifications and CHECK as indications of tester skill. It also states that PCI SSC does not validate or endorse them and that certifications alone do not establish experience. For a PCI DSS assessment, a buyer should ask for evidence of hands-on work on comparable environments, not only the list of credentials held by the team.

No credential proves an engagement was sound

No individual or company credential shows how a specific test was scoped, what rules of engagement applied, whether the testers stayed within agreed limits, or whether findings were validated and retested. These are properties of the engagement itself. Ask for a written scope, the rules of engagement, a sample report with retest evidence, and the names of the people who will do the work, then check those against the credentials offered.

How the OSCP exam and CREST accreditation are structured

The OSCP and CREST routes measure different things, so start by checking what each one actually tests and how long it stays valid. The OSCP exam is a 24-hour proctored exam with three standalone machines, graded on initial access and privilege escalation, plus an Active Directory set that simulates a breach across three machines. Passing it earns the OSCP and the OSCP+ designation. OffSec states that the OSCP+ expires three years after issuance, while the original OSCP does not expire. The plus can be kept through a recertification exam, another qualifying OffSec exam, or the CPE program. Before you accept a candidate's credential, confirm which designation they hold and its issue date, since a three-year expiry changes what a provider can prove today.

The PEN-200 course, *Penetration Testing with Kali Linux*, is preparation for the OSCP+ exam, not a requirement for it. OffSec lists the course at 321 hours of content across more than 20 modules, but the exam can be bought on its own. That matters for procurement: a tester who passed the exam without the course may have a different training history from one who completed both, and a quote or staffing list should say which. Ask providers whether their testers took the course, bought the exam only, or came through another route. CREST works at two levels. CREST (International), a UK not-for-profit company, accredits member companies and certifies individuals in disciplines including security testing, red teaming and threat intelligence. For CHECK work, the individual layer is stricter. CREST states that CHECK title holders must also hold a valid technical certificate, such as CRT for Team Members or CCT INF or CCT APP for Team Leaders, re-passed every three years, plus 75 hours of CPD over a three-year cycle. Confirm the company's accreditation status and each named tester's certificate and expiry date before the engagement starts.

What you receive from an accredited firm versus a certified individual

This table compares what a buyer should request from a CREST-accredited firm and from a single OSCP-certified tester, covering report content, retest, method evidence and sign-off. Treat each cell as a term to confirm in writing, since neither credential guarantees a specific deliverable, and check manual exploitation evidence against PCI SSC guidance.

Item	Accredited firm (CREST member company)	Certified individual (OSCP or OSCP+)
Report content	Ask for a written report template that records scope, methods, exploitation steps and evidence for each finding, agreed before testing starts	Ask for the same report elements, but confirm who writes and reviews it, since the individual may work alone without a second reviewer
Evidence of manual exploitation	Ask how manual exploitation is evidenced per finding, given PCI SSC describes penetration testing as essentially a manual process and says running an automated tool alone does not satisfy it	Ask for step-by-step proof of exploitation and privilege escalation, which the OSCP exam itself grades on, but confirm the same standard applies to your engagement
Retest	Ask whether a retest of remediated findings is included in the fixed scope, and what window and evidence the firm provides	Ask whether the individual will retest findings and how results are documented, since retest is often not covered by the certification
Method and standards alignment	Ask which methodology the firm follows (for example, PTES or OWASP WSTG) and how it maps findings to that method	Ask which methodology the tester uses and whether it is written down for your assessor to review
Team and supervision	Ask who is on the team, how team members are supervised, and whether certified staff hold the titles your scheme requires	Ask whether the tester has a supervisor or peer reviewer, since one person's certification does not show quality control
Sign-off and accountability	Ask who signs the report, who is liable under the contract, and how disputed findings are resolved	Ask who is accountable for the report content and whether the individual can sign for the firm or only as a contractor
Certificate validity	Ask for current accreditation evidence and the firm's own quality controls, not only past credentials	Ask for the OSCP or OSCP+ status and expiry date, since OSCP+ expires three years after issuance and the original OSCP does not

What drives the cost and effort of each route

Each route carries different payers, one-time purchases and recurring obligations. The cards below separate who pays for what, which costs repeat, and what to request in a quote so the comparison rests on the same terms.

Who pays for individual certification

An OSCP attempt is typically bought by the individual, while a CREST certification may be paid by the employer that sponsors the candidate. The payer determines who controls the schedule and whether a retake is funded. Ask the provider or your HR team who bears exam fees, retake fees and course costs before comparing headline figures. Confirm current pricing directly with OffSec and CREST, since neither figure is set in this comparison.

One-time purchases: exam and course

The OSCP exam is a 24-hour proctored exam, and OffSec's PEN-200 course prepares candidates for the OSCP+ exam, though the exam can be bought on its own. A course adds study time and fees on top of the exam, so the total depends on whether the candidate already has the skills. Ask whether course access, lab time and exam attempts are bundled or priced separately.

Recurring costs: expiry and renewal

OffSec states that the OSCP+ designation expires three years after issuance, while the original OSCP does not expire. Keeping the plus requires a recertification exam, another qualifying OffSec exam or its CPE program. Budget these as recurring costs in any multi-year plan, and confirm which route your team will use when the designation falls due.

Recurring costs: CPD and technical re-passes

CHECK status requires a valid technical certificate such as CRT for Team Members or CCT INF or CCT APP for Team Leaders, re-passed every three years, plus 75 hours of CPD over a three-year cycle. These obligations fall on the individual and on the firm that employs them. Ask a provider how much CPD time and exam re-sitting is funded internally and whether it counts against billable hours.

Accreditation effort for firms

CREST accredits member companies, and firms seeking OWASP Verification Standard accreditation must show they can run ASVS web and MASVS mobile assessments at Levels 1 and 2. Accreditation consumes staff time for evidence, process documentation and assessor availability, and that effort recurs as the firm keeps its status. Ask for the accreditation scope a firm holds and who maintains the evidence.

What to request in a quote

A comparable quote lists the named testers, their certifications and expiry dates, the accreditation the firm holds, the CPD and re-pass commitments, and any replacement rules if a tester leaves mid-engagement. Also ask who pays for retests and whether the price covers report reviews. Without these terms, two quotes cannot be compared on the same basis.

Questions buyers ask before choosing a testing provider

Is CREST or OSCP required for a CBEST assessment?

Neither certificate is a general requirement for CBEST on its own, so confirm the current requirements with the scheme owner before you shortlist providers. The Bank of England names CREST as the accreditation and certification body for CBEST, which means CREST's accredited companies and certified individuals are the reference point for that scheme. An individual OSCP holder does not make a firm eligible for a CBEST engagement. Ask the provider which accreditation covers the firm, which individuals will run the work, and how the scheme's threat intelligence and red team requirements are met. The CBEST implementation guide is the natural next read for the scheme's own expectations.

Does an OSCP holder meet CHECK requirements?

No. CHECK is run through CREST's membership and individual title framework, so an OSCP on its own does not establish CHECK status. CREST states that CHECK title holders must also hold a valid technical certificate such as CRT for Team Members or CCT INF or CCT APP for Team Leaders, re-passed every three years, plus 75 hours of CPD over a three-year cycle. Whether a given public body or contract requires CHECK, and at which title, is a question for the buyer and the NCSC scheme rules. Ask any provider to show its CHECK membership status and the named individuals' current titles, rather than accepting a certificate name as a substitute.

Is an OSCP enough for a PCI DSS penetration test?

An OSCP can be one indicator of tester skill, but it does not by itself satisfy a PCI DSS penetration test. PCI SSC's Penetration Testing Guidance lists OSCP alongside GIAC certifications such as GPEN and GWAPT, CREST penetration testing certifications and CHECK as indications of skill. The same guidance states that PCI SSC does not validate or endorse these certifications and that certifications alone do not establish experience. It also describes penetration testing as essentially a manual process, so ask how much of the work is hands-on exploitation, how the methodology covers each application role and how the report maps to the requirement. Confirm the requirement wording and any assessor obligations with your Qualified Security Assessor or acquirer.

How does OSCP+ expiry work?

The original OSCP does not expire, while the OSCP+ designation expires three years after issuance. OffSec states that the plus can be kept through a recertification exam, another qualifying OffSec exam or its CPE program. Passing the 24-hour proctored exam earns both designations, so a candidate with a recent pass may hold OSCP+ for a limited period. For procurement, check the issue date and the current status on the holder's OffSec record, and ask whether the individual's OSCP+ is still valid on the day the work starts. An expired plus does not remove the original OSCP, but many buyers will ask for the current designation, so state which one your contract requires.

What does the buyer have to provide for a penetration test?

The buyer provides the decisions and access that the tester cannot invent, and the quality of these inputs drives both cost and results. The main items are:

A written scope listing hosts, applications, networks, cloud accounts and any exclusions.
Test accounts for each application role if the work is authenticated, provisioned and removed under a documented process.
Rules of engagement covering testing windows, emergency contacts, data handling and what happens if a system fails.
Named contacts for escalation and for approving any production testing.

NIST SP 800-115 includes a rules of engagement template in Appendix B that many teams adapt. Ask the provider to confirm which of these items are included in its quote and which are the buyer's responsibility.

Can we train our own staff to the OSCP standard?

Yes, an organization can train its own staff, but that is a separate decision from whether a provider is accredited. OffSec's PEN-200 course, Penetration Testing with Kali Linux, prepares candidates for the OSCP+ exam and is listed at 321 hours of content across more than 20 modules, and the exam can also be bought on its own. Budget for the course or exam fees, lab time, the time staff spend away from their normal work and the ongoing cost of keeping skills current. An internal team also needs its own independence for schemes that require independent testers. Confirm the exam and course terms directly with OffSec before planning a budget.

What should we confirm with the scheme owner before signing?

Confirm the requirement directly with the owner of the scheme that applies to your organization, because the answer depends on your regulator, sector and contract. For CBEST, the Bank of England publishes the implementation guide and names CREST as the accreditation and certification body. For CHECK, confirm with the NCSC and CREST whether your engagement needs a CHECK company and which title holders must perform the work. For PCI DSS, confirm with your acquirer or assessor which tester qualifications they accept. Ask each owner for written confirmation of the current version of its rules, and keep that record with the procurement file.

How should we use CREST and OSCP together when choosing a provider?

Use CREST to check the firm and OSCP or CREST individual certifications to check the people, then confirm both against the scheme your engagement must meet. CREST accreditation indicates that a company has been assessed by its scheme, while individual certificates indicate skills that the buyer can compare across firms. Neither replaces the scope, method and report requirements in your contract. CREST also accredits companies against the OWASP Verification Standard (OVS) for web application and mobile testing at Levels 1 and 2, which is relevant when your work targets ASVS or MASVS. Ask providers to name the staff who will do the work, their current certificate status and how the test will be reviewed.

How to use both when choosing a testing provider

Require the firm to hold the accreditation your regulator or buyer names, then ask to see the named testers who will do the work and their current credentials. Company accreditation shows that the firm's processes were assessed; it does not show that the person who logs into your environment on a given Tuesday holds a valid individual qualification. For CREST-accredited firms, ask for each tester's CREST certificate with its issue and expiry dates, and for CHECK work, confirm the Team Leader and Team Member titles and their CPD records. For OSCP or OSCP+ holders, check the status on OffSec's side, because the OSCP+ designation expires three years after issuance while the original OSCP does not. Confirm that the named individuals in the statement of work are the people who attend the kickoff and the debrief.

Match the tester's proven skill to the target rather than to the badge alone. A web application and API assessment calls for someone who can work through application-layer logic and authentication flows, and the OWASP Verification Standard accreditation that CREST announced on 28 October 2022 is a useful signal here, since it covers web assessments against ASVS and mobile assessments against MASVS at Levels 1 and 2. An Active Directory assessment calls for someone who has worked with directory trust paths and privilege escalation across domains, which the OSCP exam's Active Directory set exercises directly. Ask the firm to describe a recent engagement of the same target type, with the methodology it followed, without naming clients.

Be clear with the firm that the PCI SSC's Penetration Testing Guidance states that certifications alone do not establish experience, and that the body does not validate or endorse the certifications it lists. Ask for evidence of hands-on work, including references to comparable scope and reports that show manual exploitation rather than tool output. If your assessment is for a PCI DSS scope, confirm with your acquirer or QSA how they will treat the firm's credentials before you sign. Record the tester roster, certificate expiry dates and accreditation numbers in the contract file so that renewals and replacements are checked when they happen, not during the next audit.

How DeployOpen scopes and supports security testing engagements

DeployOpen is a Chainscore Labs company that runs security testing, including penetration testing, as part of platform work inside client infrastructure. We do not issue CREST accreditation or OSCP credentials, so the work below covers how we scope, test, document and hand over engagements that your team or your chosen provider needs to evidence.

How we scope

Written scope agrees which systems, roles and environments the test covers, including whether authenticated accounts are in play.
Most engagements are fixed-scope, with deliverables and timelines agreed in writing before any testing begins.
Ask any provider, including us, to show which tester certifications apply to the named staff on your engagement.

How we build

Test accounts and access are provisioned to the agreed roles, with rules of engagement recorded before testing starts.
Testing combines manual exploitation with automated tooling, and the mix is documented so reviewers can see what a person actually tested.
Findings are validated and retested where the scope requires it, with evidence kept for each result.

How we hand over

Reports set out scope, method, findings, evidence and remediation advice in a form your assessors and procurement teams can read.
Handover covers what was tested, what was excluded and which claims a certificate does not establish.
Documentation is delivered to your own infrastructure so your team keeps the records after the engagement closes.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the fixed-scope engagement ends.
Retainers can cover scheduled retesting and the periodic tests your scheme or regulator requires, agreed in writing.
Ask us to confirm the retainer scope, response arrangements and renewal terms in the written quote before signing.

CREST vs OSCP for penetration testers