Skip to main content
POST ATLAS
Cybersecurity

CEH

Still passes HR filters in compliance-driven hiring; practitioners typically pair it with hands-on work (HTB / labs / OSCP).

DifficultyIntermediate
Study2–4 months
Exam£944
Valid3 years
Compare
POST verdict
MisplacedMarket-level call. Not personal advice.

Dominant in DoD-adjacent and compliance-checkbox hiring. A liability in practitioner interviews at any serious UK offensive security shop.

Confidence: High Signal strength: Low
Why this confidence
The split between HR-filter value and practitioner signal has been consistent for over a decade. EC-Council's exam format and content refresh cycles are well documented. No evidence of structural change.
Why this signal strength
High name recognition in non-practitioner hiring contexts. Actively negative signal at CREST-registered consultancies and red team shops where interviewers associate it with tool enumeration without methodology depth.
Who this pays off for

Best for

  • Candidates pursuing roles where DoD 8570 or 8140 compliance or its UK government analogue is the gating requirement and no practical cert is mandated
  • Security professionals in compliance, audit or governance functions who need a pentest qualification line item for role-banding purposes rather than active testing
  • SC-cleared or DV-cleared roles at system integrators where procurement spec lists CEH by name alongside CISSP and CISM
Who walks away with nothing

Usually a mistake for

  • Technical preparation for actual penetration testing engagements or CREST CRT attempts
  • A credential that earns practitioner respect at UK consultancies doing CHECK, CREST-assessed or GBEST work
  • An alternative to hands-on certs for candidates who want to move into active offensive security delivery roles
The named failure mode

Common mistake

Framework-knowledge substitution. Candidates who've memorised EC-Council's five-phase model arrive in CREST CRT prep or consultancy technical interviews unable to adapt methodology to scope, finding that recited frameworks don't survive contact with a real engagement brief.

Recruiter signal, not marketing

What it actually does

Buys access to specific US-aligned and compliance-driven job specs that list it by name, and satisfies procurement documentation requirements at government system integrators. Does not buy credibility at CREST-registered consultancies, does not contribute to CHECK team member status, and actively signals to practitioner-led hiring panels that hands-on lab time may be limited.

Falsifiability

What would change this call

  • EC-Council replaces the current multiple-choice format with a mandatory practical exam component carrying independent verification
  • NCSC or DSIT procurement frameworks explicitly deprecate CEH as an accepted qualification in favour of CREST-pathway certs
  • US DoD 8140 successor frameworks drop CEH from approved qualification lists, removing the compliance-pull that sustains its UK government adjacent value

This tells you whether the cert is worth pursuing. It does not tell you whether it is worth pursuing for you.

See if it's right for you

In context

This cert in isolation tells you very little. Here is where it actually sits. The pathways that use it, and the roles it realistically supports.

Roles it realistically supports
  • HR keyword filters
  • Government / audit hiring
  • Compliance roles
Go deeper
Practitioner take

CEH is the most expensive cert with the lowest practitioner respect. EC-Council marketing positions it as a hands-on offensive cert, the exam is multiple-choice with practical add-ons, and serious red teamers won't take a CEH-only candidate seriously. That said, it still appears on UK government, MoD, and contractor job specs because DoD 8570 grandfathered it in. Take CEH if a specific job spec demands it and the employer will fund it. Don't pay for it yourself. PNPT costs a third of the price, gets you taken seriously in interviews, and teaches more useful skills.

Authored opinion. Updated against current hiring conditions, not vendor marketing.

Recommended prior knowledge

  • Security+ knowledge

Common misconceptions

  • CEH alone clears HR filters; it doesn't replace shipped, documented work.

What this cert does NOT guarantee

  • Modern pentest roles
  • Red team
  • Hands-on offensive interviews

The next step

A cert is a signal. A Career Verdict tells you whether the signal is worth sending.

A Career Verdict tells you whether this cert earns its place on your specific route, what it won't fix, and what to sit before or after it.

A route shows what people usually do. A Career Verdict judges whether it's realistic for you.

A Career Verdict includes

The call
A single written judgement on whether the route is realistic for you.
Plateaus and failure modes
The flat years and the specific ways this route tends to stall.
Where you stand
The strongest and weakest parts of your current position, named.
Salary reality
What this route actually pays, set against what you've been told it pays.
Certification rulings
Each cert on your list: useful, optional, or skip, with reasons.
Likely timeline
How long this route takes from where you actually are, not from zero.
Get a judgement on your situation£39, one-off. Built for your inputs, yours to keep.

Built on POST's practitioner-authored assessment framework, calibrated by James from twenty years across helpdesk, infrastructure and security. Framework is human-authored; the verdict applies it to your inputs.

Plan a route with this cert