CompTIA
Entry
CompTIA Security+
Vendor-neutral proof of core security administration skills, tested partly through performance-based tasks and mapped by CompTIA to DoD 8140 work roles
- Exam
- $439
- Study
- 3-6 months
Every certification we track, from entry-level to expert. Filter by level, provider, domain or the role you're aiming for.
Prefer a picture? Career map or matrix view
55 certifications
Foundation certifications for career starters
CompTIA
Entry
Vendor-neutral proof of core security administration skills, tested partly through performance-based tasks and mapped by CompTIA to DoD 8140 work roles
ISC2
Entry
Proves you understand core security concepts with no work experience required, on an adaptive exam rewritten in September 2026 with AI topics
CompTIA
Entry
Vendor-neutral proof that you can address, configure, secure and troubleshoot business networks, tested with performance-based tasks on a 90-minute exam
INE Security
Entry
Proves you can scan, exploit and pivot through a live lab, answering 45 questions during a 48-hour practical exam
Centri
Entry
Proves you can investigate phishing, forensic, threat intelligence and SIEM evidence in a 24-hour practical incident response exam
GIAC
Entry
Tests the computing basics security work assumes, from hardware and networking to Linux, Windows and reading code, in GIAC's cheapest exam
Professional certifications for skill development
EC-Council
Intermediate
Tests recognition of attack techniques across nine domains in a 125-question exam, with an optional six-hour hands-on Practical leading to CEH Master
ISC2
Intermediate
Proves a year of hands-on security administration, from access control to cryptography, on a two-hour adaptive exam across seven evenly weighted domains
ISC2
Intermediate
The designation ISC2 grants for passing the CISSP exam before you have five years of experience, with six years to qualify
CompTIA
Intermediate
Tests a security analyst's ability to detect threats, prioritize vulnerabilities and handle incidents using real tool output, now on the CS0-004 exam
CompTIA
Intermediate
Covers a full penetration test from scoping to report, including Active Directory, cloud and AI attacks, through scenario-based questions rather than a live lab
GIAC
Intermediate
Proves hands-on defensive skill across Windows, Linux, networks and cloud in a four-hour open-book exam that includes CyberLive virtual machine tasks
Microsoft
Intermediate
Proves you can secure Azure, hybrid and AI workloads across identity, network, data and compute; SC-500 replaced the retired AZ-500 in 2026
GIAC
Intermediate
Proves you can detect, contain and investigate attacks by understanding the tools behind them, with hands-on CyberLive tasks in live virtual machines
Hack The Box
Intermediate
Proves you can investigate intrusions across several lab networks for seven days, then write an incident report an instructor grades
TCM Security
Intermediate
Five-day external-to-domain-controller pentest, followed by a written report and a live debrief with TCM Security assessors
Microsoft
Intermediate
Proves you can run Microsoft Entra end to end: hybrid sync, Conditional Access, app integration, Privileged Identity Management and access reviews
Okta
Intermediate
Proves day-to-day Okta administration through six hands-on use cases in a live Identity Engine org, with no multiple-choice questions
EC-Council
Intermediate
Tests secure Java development across the whole lifecycle, from abuse cases and threat modeling to Spring Security, error handling and Tomcat hardening
GIAC
Intermediate
Proves you can prevent and detect common web application flaws, from injection to OAuth and API abuse, the defender's counterpart to GWAPT
OffSec
Intermediate
A 3h45m proctored practical in which you recover wireless keys by hand and reach the access point in two of three live scenarios
INE Security
Intermediate
Hands-on INE Security web pentest exam tied to the OWASP Web Security Testing Guide, with exploitation domains carrying 45% of the weight
INE Security
Intermediate
Practical incident response exam where you investigate a simulated corporate breach and answer scenario questions drawn from the evidence
GIAC
Intermediate
Proves you can test web applications as an attacker would, on a GIAC exam that includes hands-on CyberLive tasks in live virtual machines
Microsoft
Intermediate
Tests SOC analyst work in Microsoft Defender XDR and Sentinel, from detection rules and incident response to KQL threat hunting
Advanced certifications for experienced professionals
ISC2
Advanced
Vendor-neutral proof that you can secure cloud architecture, data and operations, and handle the legal and contract side of cloud services
ISC2
Advanced
ISC2's credential, called CAP until 2023, for taking an information system through control selection, assessment, authorization and monitoring
OffSec
Advanced
Proctored 24-hour practical with an Active Directory set; passing now awards lifetime OSCP plus a three-year OSCP+
CompTIA
Advanced
CompTIA's senior engineering and architecture exam, formerly CASP+, scored pass/fail and built almost entirely on scenario and requirements-based objectives
ISACA
Advanced
Shows you can identify, assess and treat IT risk and design controls, with three verified years in both risk assessment and response
Amazon Web Services
Advanced
Proves you can secure a multi-account AWS organization, from detection and incident response to KMS keys, now tested on the SCS-C03 exam
GIAC
Advanced
Proves you can plan and run an enterprise penetration test, from reconnaissance to Kerberos and Entra ID attacks, in an exam with CyberLive tasks
ISC2
Advanced
Tests security across the whole software lifecycle, from requirements and threat modeling to release, patching and supplier code
Google Cloud
Advanced
Proves you can secure a Google Cloud organization, from IAM and VPC Service Controls to encryption keys, logging and AI workload controls
Cisco
Advanced
Proves hands-on skill with Cisco security products through the SCOR core exam, revised in August 2026, plus one concentration exam
Oracle
Advanced
Proves you can secure Oracle Cloud Infrastructure with IAM policies, network segmentation, Vault, Data Safe and Cloud Guard, tested on exam 1Z0-1104-26
Hack The Box
Advanced
Proves you can attack web, external and internal Active Directory targets over ten days, then write a commercial-grade report
INE Security
Advanced
Practical INE Security exam where Active Directory work carries 30% of the score and results are auto-graded within hours
Centri
Advanced
Proves you can run a 72-hour intrusion investigation, from malware analysis to threat hunting, and write a hand-marked report
GIAC
Advanced
Proves you can reconstruct what a user did on a Windows system from registry, browser, email, USB and cloud storage artifacts, partly in hands-on tasks
GIAC
Advanced
Proves you can trace an attack from network evidence alone, using packet captures, NetFlow, proxy logs and protocol analysis, in a hands-on CyberLive exam
Zero-Point Security
Advanced
Proves you can run adversary simulation with Cobalt Strike; the £399 course includes unlimited free exam attempts
ISACA
Advanced
Tests whether you can build privacy into systems and data flows, with privacy engineering making up 39% of the exam
INE Security
Advanced
INE Security's most advanced web pentest exam, with API testing at 25% plus OAuth, deserialization and WAF bypass objectives
GIAC
Advanced
Proves you can investigate intrusions across a Windows enterprise using memory forensics, filesystem timelines and NTFS analysis, partly tested in live virtual machines
GIAC
Advanced
Proves you can read network traffic at the header level and write detection rules, tested partly through hands-on CyberLive tasks
CNCF
Advanced
Proves you can harden and monitor a live Kubernetes cluster in a two-hour command-line exam open only to CKA holders
Elite certifications for industry leaders
ISC2
Expert
Proves five years of security experience across eight broad domains, endorsed by a peer and tested on an adaptive exam of up to 150 items
ISACA
Expert
Verifies that you can run an information security program, and ISACA checks five years of security management experience before granting it
ISACA
Expert
Proves you can plan and run risk-based IT audits, and it is granted only after five years of verified audit, control or security work
GIAC
Expert
Proves you can reverse-engineer Windows malware and malicious documents with disassemblers and debuggers, including unpacking samples and defeating anti-analysis tricks
OffSec
Expert
Proves you can find chained web vulnerabilities by reading source code, then automate the full attack in one unattended script within 48 hours
OffSec
Expert
Proves you can breach a defended corporate network and reach a set objective in a proctored 48-hour practical that never expires
ISACA
Expert
Recognizes enterprise IT governance leaders, covering frameworks, investment benefits, resources and risk, after five verified years in governance roles
OffSec
Expert
Proves you can reverse engineer Windows binaries and write exploits that bypass DEP and ASLR, across three tasks in a 48-hour proctored exam