Skip to content
CertGPS

ISC2 CC and CEH: Why the Ethical Hacking Exam Usually Comes Two Years Later

Comparison

CEH asks for two years of security work or paid official training before you sit; CC asks for nothing. How the two fit in sequence, and what to do in between.

Published
Updated
Read time
4 min
C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

On this page

ISC2 CC and CEH: Why the Ethical Hacking Exam Usually Comes Two Years Later

EC-Council settles most of this comparison with its eligibility rule. To sit the Certified Ethical Hacker (CEH) exam you need either two years of information security work or EC-Council's official training, which starts at $1,699. ISC2's Certified in Cybersecurity (CC) asks for no experience at all, so for a newcomer the two aren't alternatives. CC can come first, and CEH belongs later, if a job or contract asks for it.

The two exams in numbers

CCCEH
IssuerISC2EC-Council
FormatComputerized adaptive test; multiple choice and advanced item typesMultiple choice, exam code 312-50
Questions100 to 125, including 25 unscored pretest items125
Time2 hours4 hours
Passing score700 out of 1000, reported as pass or failSet per exam form, between 60% and 85%
Price$199$950 remote-proctored voucher plus $100 application, or training from $1,699
ExperienceNoneTwo years in information security, or official EC-Council training
Renewal$50 a year and 45 CPE credits per three years120 credits per three years and $80 a year

The gate in front of CEH

EC-Council offers two ways in. The first is to complete official training from an accredited center, its online platform or an approved academic institution, which makes you eligible without an application. The second is to prove at least two years of experience in one of the domains its blueprint covers, pay a non-refundable $100 fee, and wait for approval. EC-Council's handbook says decisions take five to ten business days, and an approval is valid for 90 days, so you buy the $950 voucher inside that window.

For someone holding CC but lacking the required security experience, the training route is the only one open, and it's an expensive way around an experience rule. A $1,699 course buys eligibility for an exam whose own designers expect two years of work behind it. CC doesn't shorten that wait either. EC-Council's eligibility page offers experience or training, and the only certificate it mentions is an older version of CEH itself.

What CC's 2026 outline says about attackers

CC changed on September 1, 2026, and the new Domain 5, Security Operations and Incident Response, now carries more offensive vocabulary than before. ISC2's outline asks you to understand security readiness testing (red, blue and purple teaming), to recognize threat actors and their motives, and to know physical penetration testing methods such as phishing, tailgating and impersonation. Vulnerability scanning sits there too. All of that is 17.3% of an exam whose other domains cover governance, identity, networking and cloud.

CEH's blueprint gives attack technique the whole exam. Network and Perimeter Hacking alone is 24%, Reconnaissance Techniques 17%, and System Hacking 15%. Questions ask which tool or flag does what, which scan type a firewall will drop, and which phase of an attack an action belongs to. A CC holder knows what a red team is for. A CEH candidate is expected to know the tools and steps at every phase, across 20 sub-domains running from footprinting to cryptography.

Neither exam asks you to break into anything. EC-Council sells a separate six-hour CEH Practical, 20 challenges on live virtual machines for a $550 voucher, and passing both earns CEH Master. If you want the credential to show that you can do the work, the Practical is the part that does it.

What to do in the two years between

The useful move after CC is a job, because the self-study route requires one. EC-Council's form asks for work in domains such as network hacking, web applications, wireless and cloud computing, so a SOC analyst post or an administration job with real security duties is where that experience comes from. Keep a note of which of your tasks fit those domains. Along the way, Security+ is, in our view, a better use of a newcomer's next exam fee than a test aimed at testers: ISC2 accepts it as one year of the five CISSP requires, and CEH isn't on that list.

CEH earns its place when an employer or contract names it. EC-Council states that both the knowledge exam and the Practical are approved under US Department of Defense 8140, and ISC2 lists CC as approved under DoDM 8140.03 as well, so a defense contractor might accept either for different roles. Check which one the role you want asks for before buying either.

If testing is the career you're after, CEH isn't the only next step. Security+ vs CEH covers the middle ground, and CEH vs OSCP compares it with OffSec's 24-hour practical.

Our view

Take CC if you're new and want a cheap, structured first exam, then get a job before thinking about CEH. We'd only buy CEH when a posting or a contract names it, and we'd take the self-study route with two years of experience behind you: $1,050 instead of $1,699 or more. If nobody requires CEH, we'd spend that money on a practical exam that shows you can test, or on the $550 CEH Practical if CEH is already on your resume.

Sources (12)