Is the CEH certification worth it?

Is CEH worth it in 2026? What security-analyst ads show

We count how often employers name a certificate in ads for one role in each country, using the local job title. For the CEH, that role is security analyst. The figures on this page come from those ads. Penetration testing is a different role, which our penetration-tester page covers.

In the US, the CEH appeared in 81 of the 8,110 security-analyst ads in October 2026. In the same ads, Security+ was named in 112, the CISSP in 338 and the CISM in 134. We count Security+ by the phrase comptia security, so ads that write only Security+ are missed and its count is a minimum. Our reading: each of these certificates appears in a small minority of US security-analyst ads, so the choice between the CEH and Security+ comes down to price and prerequisites more than to demand.

The UK sample is smaller. The CEH appeared in 4 of the 235 UK security-analyst ads, while the CISSP was named in 29. In Brazil, the CEH was named in 3 of the 434 ads for analista de segurança. The Mexico sample (12 ads for analista de ciberseguridad) is too small to read.

The ad count cannot show whether an employer that leaves the CEH out of its ad would still value it, or whether a contract requires it in documents that never reach a job board. What the count does show is that a buyer should not expect to see the CEH in many US or UK security-analyst ads.

Is CEH worth it in India?

Partly. Indian employers named the CEH in 7% of the ads for security analysts in October 2026. In the same ads, the CISSP appeared in 18% and Security+ in at least 3%. The sample is small, 250 ads, so a few ads can move a share by several percentage points from month to month. Read the figure as a sign that some Indian employers ask for the CEH, not as a precise rate.

The price is the same problem as elsewhere: EC-Council lists the exam in US dollars ($950 online, $1,199 at a test center), and training partners set their own prices. For an Indian candidate, the CEH makes most sense when an employer or a college program pays for the official training, which also removes the $100 eligibility fee. If you pay for it yourself and have no security experience, Security+ is still the cheaper start: $439, with no prerequisite.

What security-analyst ads name besides certificates

Three posts asked whether to learn Python, Terraform or a SIEM before buying another certificate. Our count tracks two skills for this role. In US security-analyst ads, SIEM (security information and event management) appeared in 5.1% and Splunk in 1.2%. In UK ads, SIEM appeared in 25%; in India, in 20%. Our reading: for an analyst job, hands-on SIEM experience belongs on the resume next to any certificate. Our security-analyst page lists every skill we track for the role by country.

CEH cost: exam, eligibility fee and training

EC-Council offers two ways to become eligible for the exam, and they change the bill.

Source: EC-Council eligibility page, exam retake policy and continuing education fee page, read October 4, 2026. Analysis: CertWorthIt.

Self-study route. You apply with proof of two years in an information security role, pay $100 and, once approved, buy a voucher. With the online exam, the minimum is $1,050; at a test center, $1,299. Approval usually takes 5 to 10 business days, the approval is valid for 90 days, and a voucher must be used within 12 months.

Training route. Official training from EC-Council's iClass, an Authorized Training Center or a partner university makes you eligible without the application, the fee or the reference checks. Most training packages include the exam voucher. EC-Council does not set training prices; its partners do, and its own course page asks you to contact an advisor for a price. So we cannot give a training figure. Compare at least two quotes and check what each one includes: EC-Council's course kits list courseware, an exam voucher and six months of lab access, with retakes in some packages.

Show the numbers

Exam cost for one attempt: CEH and three alternatives. Sources: EC-Council eligibility page (exam voucher and $100 eligibility fee); CompTIA Security+ and PenTest+ pages (US price); OffSec PEN-200 page (standalone exam). Prices read October 3 and 4, 2026.

Item
CEH, self-study route (online exam + eligibility fee)	$1,050
CompTIA Security+ (SY0-701)	$439
CompTIA PenTest+ (PT0-003)	$439
OSCP+ standalone exam (OffSec)	$1,699

Over three years, the self-study route with the online exam comes to $1,290: $1,050 to get certified plus $240 in continuing education fees. The same three years of Security+ cost $589 ($439 for the exam plus $150 for one renewal). Adding the practical exam for CEH Master raises the CEH figure to $1,840.

How hard is CEH, and how long does it take to get it?

The knowledge exam has 125 multiple-choice questions in four hours. The passing score depends on the exam form you get and ranges from 60% to 85%; your cut score and your result appear on the transcript when you finish. EC-Council does not publish a pass rate. It does say that members with limited experience rate the exam as difficult, while experienced IT and security staff find it moderately hard.

How long it takes depends on the route. Official training is a five-day boot camp, and training centers often hold the exam at the end of the fifth day. Self-paced courses and self-study take longer, and we cannot say how much longer: the Reddit posts we collected about the CEH contain no first-person study-time reports we could count, so we give no range.

The bigger question is what you know before you start. EC-Council recommends at least two years of IT security experience and says its course will not teach you what a port is. Becoming an ethical hacker without that background is harder, because the course assumes networking basics. If they are new to you, budget time for them before you start. That is one reason to look at Security+ first.

For study materials, two posters asked which resources and labs to use. The official course has 20 modules and 221 hands-on labs in EC-Council's cyber range, and course kits include six months of lab access. Self-study materials are sold in the EC-Council store. EC-Council says self-published YouTube videos are not a substitute for official training and do not count as study when you apply for eligibility. We have no sourced comparison of third-party practice platforms, so we do not rank them.

Both CEH exams are accredited by ANAB under ISO/IEC 17024, EC-Council says. If you fail, there is no wait before the first retake and a 14-day wait before each later one, up to five attempts in 12 months.

Show the numbers

CEH exam format at a glance. Source: eccouncil.org, cert.eccouncil.org, checked October 4, 2026.

Item	CEH
Questions	125 questions
Exam time	240 minutes (4 h)
Passing score	60–85%
Format	Multiple choice, hands-on practical
Where you take it	test center · online, proctored

Is CEH v13 worth it, or should you wait for the next version?

The current exam is version 13, which EC-Council markets as "CEH AI" and which adds AI tools to the course. New versions come every 12 to 18 months, EC-Council says. Waiting gains little: under the ECE policy, taking a newer-version exam later counts toward renewal. If you need the CEH for a job now, take the current version.

Does CEH expire? Renewal with ECE credits

Yes. A CEH is valid for three years. To keep it, you earn 120 EC-Council Continuing Education (ECE) credits within each three-year cycle and pay the continuing education fee of $80 every year (ECE policy and fee page, read October 4, 2026). Credits for a calendar year must be registered by February 1 of the next year.

Activities that count include conferences, webinars, courses, writing articles and passing another exam. Two entries in EC-Council's credit table matter most for a typical holder: another IT security certification exam earns 40 credits, and an EC-Council ECE exam earns all 120. Your normal job duties earn none.

If you miss the 120 credits, your certification is suspended. You then have 12 months to make up the credits and pay the fee. After that, it is revoked, and you must pass the current exam again to get it back.

Compared with CompTIA, the CEH costs more to keep: $240 per three-year cycle against $150 for Security+ or PenTest+. If you hold both, passing a CompTIA exam during the cycle counts for 40 of your 120 CEH credits.

Show the numbers

CEH certification path: requirements, exam, renewal cycle. Source: cert.eccouncil.org, checked October 4, 2026.

Item
1. Experience	2 years of work experience
2. Exam	125 questions, 240 minutes
3. Certified	valid for 3 years
4. Renewal	120 ECE credits every 3 years

CEH salary: what the figures measure

EC-Council's salary page puts US entry-level roles at about $60,382 a year for a security analyst, $65,946 for a SOC analyst and $66,802 for a junior ethical hacker, figures it takes from ZipRecruiter, Salary.com and Indeed. For US ethical hackers overall, it gives $99,000 to $170,000 (Glassdoor, May 2026) and an average of $130,000. None of these figures measures what the CEH itself adds: they describe pay for job titles, not for people who hold the certificate.

EC-Council's CEH course page cites Glassdoor at about $174,000 a year as of July 2026, with top earners at $298,000. The salary page also breaks pay down by role for 2026:

Source: EC-Council, ethical hacker salary page, read October 4, 2026; figures as EC-Council quotes them from ZipRecruiter and Salary.com.

The highest-paid role in the table, the CISO, is a management job, not a hacking job. Our reading: the job you land sets your pay far more than the CEH does. For certified ethical hacker salary questions, the useful figure is the pay for the role you can realistically get. For a first security job, those are the junior ethical hacker and SOC-analyst rows, not the $174,000 headline. Our security-analyst page covers demand for that role by country.

Show the numbers

CEH in SOC analyst job ads, by country. Share of job ads that name each item. Source: Adzuna job ads, October 2026.

Country	CEH	Ads	Share of ads
India	CEH11	Ads54	Share of ads20%
United States	CEH30	Ads233	Share of ads13%
United Kingdom	CEH3	Ads69	Share of ads4%

CEH salary in India

We have no CEH salary figure for India from EC-Council or from any source we could verify, so we give none. What we can give is demand: the CEH appeared in 7% of the ads for Indian security analysts in October 2026. We found no India figure that separates the effect of the CEH from experience and job title, which is why we leave salary sites out.

CEH alternatives: Security+, PenTest+ and OSCP

The four credentials test different things, and the format matters more than the name. Each pairing has its own comparison page; here is the short version.

Source: EC-Council, CompTIA and OffSec certification pages, checked October 3 and 4, 2026. Analysis: CertWorthIt.

Security+ is the cheaper entry-level option and needs no experience; a new version (SY0-801) is planned for November 17, 2026. Studying its material without taking the exam gives you the basics but not the credential. See our CEH vs Security+ comparison.

PenTest+ costs $439, mixes multiple-choice and performance-based questions, and CompTIA recommends three to four years of penetration-testing work first. See CEH vs PenTest+ and the PenTest+ page.

The OSCP is a long practical: OffSec's exam guide gives about 23 hours and 45 minutes of hands-on time, followed by a written report. Skills from practice platforms such as Hack The Box map onto that format, not onto 125 multiple-choice questions. Our CEH vs OSCP page compares the two in full.

For readers on the road to the OSCP, our answer, based on these facts, is Security+ first at $439, then the OSCP if penetration testing is the goal. The CEH fits in between only if a job or contract asks for it.

More comparisons: CEH vs CISSP, CEH vs CySA+ with the CySA+ page, and CEH vs eJPT with the eJPT page. The cybersecurity field page groups every security credential we track.

Show the numbers

CEH vs CompTIA CySA+: share of SOC analyst job ads naming each. Share of job ads that name each item. Source: Adzuna job ads, October 2026.

Country	CEH	CompTIA CySA+
India	CEH20%	CompTIA CySA+15%
United Kingdom	CEH4%	CompTIA CySA+25%
United States	CEH13%	CompTIA CySA+15%

Who should take the CEH, and who should skip it

Take it if:

• Your employer pays for official training, which also removes the $100 eligibility fee and the reference checks.
• A job ad, a client contract or a US Department of Defense role names it. EC-Council lists six 8140 work roles that recognize the CEH: all-source analyst, warning analyst, cyber defense analyst, cyber defense incident responder, vulnerability assessment analyst, and research and development specialist. It also says the CEH meets the baseline for four of five Cybersecurity Service Provider roles.
• You target India and an employer pays: the CEH appears in 7% of the ads for Indian security analysts, from a small sample, with the CISSP at 18%.

Skip it, or take it later, if:

• You are new to IT security. Start with Security+ and the networking basics the CEH course assumes.
• You want to prove you can run a penetration test. The OSCP exam tests that directly; the CEH knowledge exam does not.
• You would pay $1,050 or more yourself for a line on your resume. In the US, the same money covers Security+ with $611 left over for practice labs or a second exam.

Show the numbers

Is the CEH for you? A two-question check. Source: cert.eccouncil.org, checked October 4, 2026.

Item
Do you have 2 years of the work experience it requires?	No: Not yet. Look at CISSP (Certified Information Systems Security Professional) first, then the CEH once you qualify.
Yes	Apply for the CEH exam.

Is CEH worth it? What posters ask on Reddit

We grouped the CEH questions in the Reddit posts we collected (r/SecurityCareerAdvice, r/cybersecurity and r/oscp) by theme. Reddit is a self-selected sample, so these show what people ask, not how many people hold an opinion.

• Value for a first job. One poster asked whether the CEH would improve their chances at an entry-level job, or whether Security+, PNPT, eJPT or the CCNA would be a better use of money (r/SecurityCareerAdvice). Our answer: Security+ first if you pay for it yourself, as the alternatives section explains; we have no facts on PNPT or the CCNA.
• What to learn next. Three posts asked whether Python, Terraform, a SIEM, the CEH or the CISSP would close a skills gap (r/SecurityCareerAdvice). The skills section gives the ad counts.
• Resources and labs. Posters asked which materials and lab platforms to use alongside the CEH (r/SecurityCareerAdvice; r/cybersecurity). The difficulty section covers the official labs; we do not rank third-party platforms.
• Order on the road to the OSCP. CEH or Security+ first (r/oscp), and whether to study only the key Security+ modules before the CEH (r/oscp). Our answer: Security+ first; studying its material without the exam gives you the basics but not the credential (see the alternatives section).
• OSCP or CEH next to Hack The Box practice (r/SecurityCareerAdvice). Our answer: the OSCP, because practice-platform skills match its hands-on format.

None of these posters asked how to renew, but renewal is where the CEH's cost adds up, so check the renewal section before you buy.

How to get the CEH, step by step

1. Choose a route. Official training (iClass, an Authorized Training Center or a partner university) makes you eligible directly. Otherwise, apply for eligibility with proof of two years in an information security role.
2. For the self-study route, pay the $100 eligibility fee and tell your references that EC-Council will contact them. Approval usually takes 5 to 10 business days and stays valid for 90 days.
3. Buy the voucher: $950 for the online proctored exam or $1,199 at a Pearson VUE center. Use it within 12 months.
4. Take the four-hour exam of 125 multiple-choice questions.
5. Optional: take the six-hour practical exam ($550) for CEH Master.
6. After you pass, pay the $80 fee each year and log 120 ECE credits within three years.

Show the numbers

Where CEH sits among cybersecurity certifications. Source: vendor requirements in our fact files, checked October 3, 2026.

Level	Certification	Experience	Named first
Entry	CertificationISC2 CC	Experienceno work experience required	Named first–
Entry	CertificationGoogle Cybersecurity	Experienceno work experience required	Named first–
Entry	CertificationIBM Cybersecurity Analyst	Experiencebeginner course (vendor)	Named first–
Associate	CertificationSSCP	Experiencerequired: 1 year of work experience	Named first–
Professional	CertificationCompTIA Security+	Experiencerecommended: 2 years of work experience	Named first–
Professional	CertificationCEH	Experiencerequired: 2 years of work experience	Named first–
Professional	CertificationCRISC	Experiencerequired: 3 years of work experience	Named first–
Professional	CertificationCompTIA PenTest+	Experiencerecommended: 3 years of work experience	Named first–
Expert	CertificationCISSP	Experiencerequired: 4 years of work experience on the shortest route (4–5 years, depending on the route)	Named first–
Expert	CertificationCompTIA CySA+	Experiencerecommended: 4 years of work experience	Named first–
Expert	CertificationCISM	Experiencerequired: 5 years of work experience	Named first–
Expert	CertificationCISA	Experiencerequired: 5 years of work experience	Named first–
Expert	CertificationISO 27001 Lead Implementer / Auditor	Experiencerequired: 5 years of work experience	Named first–
Expert	CertificationCompTIA SecurityX (CASP+)	Experiencerecommended: 10 years of work experience	Named first–

Sources

• Adzuna job-ad counts, security-analyst ads in the US, UK, India, Brazil and Mexico, October 2026; analysis: CertWorthIt. How we count.
• EC-Council, Certified Ethical Hacker course page (exam format, passing score, version, training, recognition, salary citation), read October 4, 2026.
• EC-Council, CEH application process and eligibility, read October 4, 2026.
• EC-Council, exam retake policy, ECE policy and continuing education fees, read October 4, 2026.
• EC-Council iClass, CEH course page, read October 4, 2026.
• EC-Council, ethical hacker salary page, read October 4, 2026.
• CompTIA, Security+ and PenTest+ pages and continuing education pages, checked October 3, 2026.
• OffSec, PEN-200 and OSCP page, checked October 3, 2026.
• Reddit questions about the CEH from the posts we collected, linked in the Reddit section, read October 4, 2026.

Edited by Elena Marsh · Data checked October 4, 2026