CPTS Certification: The Complete 2026 Guide to HTB’s Penetration Testing Credential

The CPTS certification (Certified Penetration Testing Specialist) is a hands-on penetration testing credential from Hack The Box Academy. It requires candidates to compromise a simulated enterprise network over 10 days, capture at least 12 of 14 flags, and submit a professional-grade pentest report.

CPTS is widely considered one of the most job-realistic entry-level to intermediate offensive security certifications available in 2026.

Key Takeaways

• What it is: A practical, exam-based certification proving you can perform a full penetration test, not just answer multiple-choice questions.
• Format: 10 days of hands-on exploitation against ~8 machines (Linux, Windows, Active Directory), then a commercial-grade report submission.
• Passing bar: Minimum 12 out of 14 flags (roughly 85+ points).
• Prerequisite: You must fully complete the HTB Academy Penetration Tester job-role path (28+ modules) before you’re eligible to sit the exam.
• Cost in 2026: Realistically $242–$700 total, depending on subscription choice, $1,699 for standalone exam and $1,749 for a comparable first oscp+ attempt (PEN-200 + exam).
• Difficulty: Moderate-to-high; manageable for motivated beginners with 3–6 months of consistent study.
• CPTS vs oscp+: CPTS is more affordable, more report-focused, and arguably closer to real client work. oscp+ still has stronger name recognition among some employers, especially in the U.S. government and defense sectors.
• Worth it? Yes, for most people entering penetration testing, red teaming, or offensive security roles, particularly as a complement to or stepping stone toward the oscp+.

What Is HTB CPTS?

CPTS stands for Certified Penetration Testing Specialist. It’s issued by Hack The Box (HTB), a platform best known for its hacking labs and Capture The Flag (CTF) challenges.

Unlike many entry-level security certifications, CPTS is a fully hands-on exam that requires you to compromise a simulated enterprise environment and produce a professional-grade penetration testing report. There are no multiple-choice questions on the exam itself.

CPTS validates the full penetration testing lifecycle:

• Reconnaissance and enumeration
• Web application exploitation
• Network and infrastructure attacks
• Active Directory compromise
• Privilege escalation (Linux and Windows)
• Pivoting through segmented networks
• Professional report writing

Who Is CPTS For?

CPTS is designed for people who want to prove practical, job-ready penetration testing skills. According to HTB’s own positioning, the certification is best suited for aspiring penetration testers, red team juniors, security analysts, vulnerability analysts, incident handlers, systems administrators transitioning into offensive security, and cybersecurity students seeking a practical credential.

You don’t need prior offensive security experience or certifications to start. Many candidates use CPTS as their first serious hands-on penetration testing certification, though complete beginners with zero networking or Linux knowledge should first build those fundamentals.

CPTS Exam Format: What Actually Happens

Understanding the exam structure is critical before you commit time and money.

The Core Format

• Duration: 10 days for the practical hacking portion.
• Environment: A black-box, enterprise-style network of roughly 8 Linux and Windows machines in a simulated enterprise environment, including Active Directory.
• Flags: 14 total flags spread across the environment.
• Passing threshold: You must capture a minimum of 12 out of 14 flags, corresponding to roughly 85+ points out of 100.
• Report: After the hacking window, you must submit a commercial-grade penetration testing report. The exam gives you 10 days total from the moment you start the environment to both compromise the network and submit the commercial-grade report. Always confirm the exact current window on your HTB dashboard when you register.
• No multiple choice: The exam is 100% practical. The real exam is hands-on and does not include multiple-choice questions.

The Report Matters As Much As the Hacking

This is the detail most first-time candidates underestimate. Multiple CPTS-certified professionals emphasize that in the end, they pass you based on the report, not the pentest. Strong exploitation with a weak, disorganized report can still result in a fail.

A commercial-grade report typically needs:

1. An executive summary written for a non-technical audience
2. A methodology section
3. Detailed technical findings with evidence (screenshots, commands, output)
4. Risk ratings (CVSS or similar) for each finding
5. Clear remediation recommendations

Mandatory Prerequisite: The Penetration Tester Path

You cannot register for the CPTS exam until you have completed 100% of the HTB Academy Penetration Tester job-role path. This is not optional preparation, it’s a hard gate. As one recent CPTS pass account puts it: It is a hard requirement. You cannot sit the CPTS exam until you have completed 100% of the Penetration Tester job-role path, including all hands-on skills assessments at the end of each module.

The path itself is substantial. Reviewers describe it as the most extensive journey among all HTB certifications, and it’s designed to guide you from fundamentals to advanced Active Directory attack chains.

Realistic CPTS Cost Breakdown in 2026

CPTS pricing depends entirely on which HTB Academy subscription you choose. Here’s the honest math.

Subscription + Voucher Options

A standalone voucher runs around $210, and the annual subscriptions typically bundle one or more vouchers with training access. The Silver Annual plan gives the full training path and the exam voucher together for $490, which is effectively a discount if you plan to certify, bringing the CPTS route in near $700 all-in when you include realistic extras like lab time.

If you qualify for the student plan, the numbers are even better: with an educational email, the student subscription costs only $8 per month, and Tier I and Tier II modules fully cover the CPTS path. One reviewer calculated a total investment of around $242 for a 3- to 4-month student subscription study period, plus the exam voucher.

CPTS Cost vs oscp+ Cost

For comparison, a base oscp+ attempt through OffSec typically starts near $1,599, and each additional oscp+ exam retake costs $249 on top of that. CPTS is meaningfully cheaper across every subscription path.

CPTS vs oscp+: Full Comparison

This is one of the most searched questions among aspiring penetration testers, so here’s a direct, side-by-side breakdown.

How to Read This Table

CPTS gives you more time and lower pressure, which suits people who work methodically rather than under a ticking clock. oscp+ compresses everything into a brutal single day, testing composure as much as skill.

Many practitioners consider CPTS more realistic and more report-heavy, it mirrors an actual client engagement more closely, since CPTS gives you 10 days to work through a realistic multi-host environment, then another 10 days to submit your report, unlike oscp+’s compressed 24-hour format.

That said, oscp+ still has stronger brand recognition in many job postings and applicant tracking systems, particularly for U.S. government, defense contractor, and larger enterprise roles that have used as a hiring benchmark for over a decade. CPTS is closing that gap quickly but hasn’t fully caught up everywhere yet.

Practical recommendation: If budget is a major constraint or you want a lower-stress, methodical exam, start with CPTS. If you’re targeting a specific employer that explicitly lists oscp+ as a requirement, plan for both, with CPTS as strong preparation for oscp+.

CPTS Difficulty: Who Should Take It

CPTS sits at a moderate-to-high difficulty level for a certification exam, but it’s approachable for beginners who put in structured study time.

Signs You’re Ready for CPTS

• You’ve completed the entire Penetration Tester Academy path, including skill assessments
• You’re comfortable with Nmap, Burp Suite, and common privilege escalation techniques on both Linux and Windows
• You understand basic Active Directory attack concepts (Kerberoasting, BloodHound, lateral movement)
• You can write clear technical documentation under time constraints

Who Should Wait

• Complete beginners with zero networking or Linux fundamentals should build basics first (TryHackMe, HTB’s introductory content, or a networking course) before starting the Penetration Tester path.
• If you can’t commit at least 5–10 hours per week for a few months, your knowledge retention will suffer before exam day.

Step-by-Step CPTS Preparation Guide

Follow this sequence for the highest chance of passing on your first attempt.

1. Confirm your subscription. Choose Student Plan, Silver Annual, or a standalone module + voucher path based on your budget and eligibility.
2. Work through the Penetration Tester path linearly. Don’t skip modules, HTB designed the sequence deliberately, building from enumeration through to full Active Directory compromise.
3. Complete every module skill assessment fully. These mini hands-on exams are your best predictor of exam readiness.
4. Practice on retired HTB machines and ProLabs. The standard path uses standalone machines, but the real exam uses a connected enterprise network, additional practice on multi-host labs closes that gap.
5. Study the reporting module seriously. Don’t treat it as filler. Learn the report template HTB expects and practice writing findings in that exact format.
6. Do at least one full mock report. Pick a retired box or ProLab, exploit it, and write a full commercial-style report from scratch, timed.
7. Set up your exam toolkit in advance. Have your note-taking system, screenshot workflow, and report template ready before day one, don’t build your process during the exam.
8. Plan your 10 days. Many successful candidates dedicate the first several days to enumeration and initial footholds, then move into deeper Active Directory chains, leaving the final days for report writing and review.

Real Exam Experience: Practical Tips

Feedback from people who’ve completed CPTS consistently surfaces a few patterns:

• Enumeration eats more time than expected. Multiple test-takers report spending most of their first day on deep enumeration before finding a foothold.
• Report tooling matters. Several candidates recommend using dedicated reporting software rather than a standard word processor to avoid formatting issues and crashes under deadline pressure, one candidate noted that without a reporting tool, their document would have crashed repeatedly and they might have failed on formatting alone.
• The standard path labs don’t fully replicate exam conditions. As one CPTS holder put it, the CPTS preparation path largely consists of standalone machines, while the actual exam involves a full enterprise network with multiple endpoints, so extra practice on multi-endpoint labs is worth the investment.
• 10 days feels shorter than it sounds. Despite the generous window, several candidates describe the environment’s complexity as making even 10 days feel tight.
• Document as you go. Don’t wait until the exploitation phase ends to start writing. Capture screenshots, commands, and notes in real time.

Is CPTS Worth It in 2026?

For most people entering penetration testing, offensive security, or red team roles, yes; CPTS delivers strong value relative to cost.

Reasons It’s Worth Pursuing

• Lower financial barrier than oscp+, especially with the student plan or Silver Annual bundle.
• Genuinely practical skill validation, hiring managers increasingly value certifications that prove hands-on ability over memorized theory, since employers increasingly value this practical validation of skills over theoretical knowledge.
• Comprehensive curriculum, the Penetration Tester path alone functions as a structured, guided education in offensive security, useful even independent of the certification itself.
• Growing industry recognition, especially among companies that actively hire from the HTB community or use HTB Academy internally for training.

Where It Falls Short

• Recognition gap vs oscp+ in some traditional or government-adjacent hiring pipelines.
• Newer certification (launched 2023), so it has a shorter track record than 15+ year-old credentials.
• Subscription dependency, you need an active subscription throughout your study period, unlike a one-time course purchase.

Bottom Line

If you’re early in your penetration testing career, budget-conscious, or want a certification that closely mirrors real client engagements, CPTS is a smart choice in 2026. If you’re specifically targeting employers or contracts that name oscp+ explicitly, treat CPTS as strong preparation and pursue both over time.

Common Mistakes to Avoid

• Skipping ahead in the Academy path. The modules build on each other; skipping sections creates knowledge gaps that surface during the exam.
• Underestimating the report. Passing the hacking portion doesn’t guarantee a pass, report quality is graded heavily.
• Not practicing on multi-host environments. Relying solely on standalone-machine practice leaves you unprepared for the connected enterprise network in the real exam.
• Poor time management across the 10 days. Spending too long on one machine can eat into report-writing time.
• Letting your subscription lapse mid-study. Losing Academy access before finishing the path forces you to re-subscribe and lose momentum.
• Ignoring documentation during the exam. Trying to reconstruct your steps from memory after the fact wastes valuable time and increases errors.

Conclusion

CPTS certification is a practical, hands-on penetration testing credential that tests real-world skills over a 10-day exam window, requiring at least 12 of 14 flags and a commercial-grade report. It costs significantly less than oscp+, often between $242 and $700 depending on your subscription path, while covering a comparably deep curriculum through HTB’s mandatory Penetration Tester Academy path.

Choose CPTS if you want a lower-cost, lower-pressure entry into practical penetration testing certification. Choose oscp+ alongside it, or afterward, if a specific employer requires that exact name on your resume. For most people building a career in offensive security in 2026, CPTS is a smart, well-respected place to start.

Frequently Asked Questions FAQ’s