Skip to content
CertGPS
Comparison

CEH and CISSP: Different Career Stages, and No Shortcut From One to the Other

CEH checks attack knowledge after two years in security; CISSP needs five years of program work. Why they rarely compete, and what CEH does and doesn't count toward.

SC
Sarah Chen
Senior Security Consultant
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

CEH and CISSP: Different Career Stages, and No Shortcut From One to the Other

CEH won't take a year off the CISSP experience requirement. ISC2's list of credentials that waive one of the five years includes Security+ and CySA+, but nothing from EC-Council. That matters because the two are rarely a real choice: CEH is a knowledge exam you can sit two years into a security career, and CISSP certifies someone who has spent five years doing the work and wants to run a program.

The two credentials in one table

CEHCISSP
IssuerEC-CouncilISC2
FormatMultiple choice (exam 312-50); a separate six-hour CEH Practical is optionalComputerized adaptive test; multiple choice and advanced item types
Questions125100 to 150, including 25 unscored pretest items
Time4 hours3 hours
Passing scoreSet per exam form, between 60% and 85%700 out of 1000, reported as pass or fail
Price$950 remote voucher plus $100 application on self-study; training from $1,699$749 standard registration (Americas, Asia Pacific)
ExperienceOfficial training, or two years in information security, to sit the examFive years in two or more of eight domains to certify; the exam can be sat earlier
Renewal120 credits per 3 years and an $80 annual fee120 CPE credits per 3 years and a $135 annual fee

Who is at which stage

A CEH candidate is usually early to mid career: a security operations center (SOC) analyst, a system administrator who has picked up security duties, an auditor who needs to follow a penetration test report, or someone on a defense contract. EC-Council states that both CEH exams are approved under US Department of Defense (DoD) 8140, which matters when a contract specifies it.

A CISSP candidate is a security engineer moving into architecture, a security manager, or a consultant who advises on whole programs. ISC2 also lists CISSP as approved under DoDM 8140.03, so for government work the two cover different rungs of the same ladder.

Two years in, CISSP is still some way off, so the live question is whether CEH is the right credential for now. Take it if a role needs it. If it doesn't, the CISSP vs OSCP and CEH vs OSCP comparisons cover the hands-on alternatives.

Where CEH's material reappears in CISSP

Much of CEH shows up inside CISSP as a subtopic. Penetration testing sits in CISSP Domain 6, Security Assessment and Testing, which ISC2 weights at 12%, alongside vulnerability assessment, log review and audits. Cryptography sits in Domain 3 and network security in Domain 4.

CEH asks the technician's question. Its blueprint v5.0 gives 17% to reconnaissance and 24% to network and perimeter hacking, and EC-Council's candidate handbook gives each of the 20 sub-domains six or seven questions: which scan a firewall drops, which tool cracks which hash. CISSP asks what an organization should do about the test: when to commission one, how to scope it, who acts on the findings. Its heaviest domain is Security and Risk Management at 16%, covering governance, law, business continuity and supply chain risk, the program-level topics furthest from CEH's attack techniques.

The formats pull apart as well. CISSP's adaptive exam picks each item so you have about a 50% chance of getting it right and won't let you go back, and ISC2 warns that candidates often come out feeling they did poorly. CEH's fixed 125 questions are closer to a conventional certification test.

Getting from CEH to CISSP

The certification won't shorten the path, but the work behind it counts. ISC2 measures experience in its eight domains, and years spent on vulnerability assessment, monitoring or testing fall within Domain 6 or Domain 7, Security Operations. You'll need a second domain as well, which might mean taking on work in identity and access management, network security or risk.

A relevant degree waives a year, and so does a credential on ISC2's list; only one year can be waived either way. If CEH is your only certification and you want that waiver, Security+ or CySA+ gets it. You can also sit CISSP before reaching five years. Passing makes you an Associate of ISC2, with six years to finish the experience.

Holding both means two renewal schedules with the same 120-credit count: $80 a year to EC-Council, $135 a year to ISC2. EC-Council's CPE policy awards 40 credits for passing a certification exam related to IT security, so passing CISSP covers a third of a CEH cycle.

Our view

CEH and CISSP sit years apart in the same career, so we'd rarely weigh one against the other. We'd take CEH only when a role or contract names it, and treat CISSP as the goal for anyone moving toward architecture, management or consulting. A reasonable counterargument is that CEH gives a future CISSP holder the attack vocabulary Domain 6 assumes, and in a DoD role it may be required anyway. If you're already near five years, though, go straight to CISSP: self-study CEH costs $1,050 at EC-Council's prices, more than the $749 CISSP registration.

Sources