'ZDNET Recommends': What exactly does it mean?
ZDNET's recommendations are based on many hours of testing, research, and comparison shopping. We gather data from the best available sources, including vendor and retailer listings as well as other relevant and independent reviews sites. And we pore over customer reviews to find out what matters to real people who already own and use the products and services we’re assessing.
When you click through from our site to a retailer and buy a product or service, we may earn affiliate commissions. This helps support our work, but does not affect what we cover or how, and it does not affect the price you pay. Neither ZDNET nor the author are compensated for these independent reviews. Indeed, we follow strict guidelines that ensure our editorial content is never influenced by advertisers.
ZDNET's editorial team writes on behalf of you, our reader. Our goal is to deliver the most accurate information and the most knowledgeable advice possible in order to help you make smarter buying decisions on tech gear and a wide array of products and services. Our editors thoroughly review and fact-check every article to ensure that our content meets the highest standards. If we have made an error or published misleading information, we will correct or clarify the article. If you see inaccuracies in our content, please report the mistake via this form.
The 6 best ethical hacking certifications: Hone your skills
Hacking isn't necessarily about just having an in-depth knowledge of code: It's about enjoying a challenge and problem-solving.
While understanding the bare bones of computing, specific programming languages, risk analysis, and networking before working your way up is valuable and may help you have a successful career in cybersecurity, the work opportunities vary based on your interests and the path you wish to pursue.
One path you can pursue is that of ethical hacking: Learning how to think like an attacker in order to find and remediate vulnerabilities before threat actors are able to exploit gaps in enterprise systems for illicit financial gain, cyberespionage, or to cause damage. Ethical hacking is also core to the concept of bug bounties -- finding vulnerabilities and security problems in services and software on behalf of vendors in return for credit and financial rewards.
One aspect of these courses is that they focus more on offense rather than defense, and topics covered often include penetration testing, malware analysis, exploit creation, learning how to use the programming languages which often provide the backbone for today's malware and a study of modern hacking tools.
Below, ZDNet has compiled a list of recommended courses to explore in the ethical hacking field.
The first recommendation, and perhaps the most well-known option today, is the EC-Council's Certified Ethical Hacker (CEH) qualification.
CEHv11 teaches students about today's modern hacking techniques, exploits, emerging cybersecurity trends and attack vectors, and how to use commercial-grade tools to effectively break into systems.
Modules also include cyberattack case studies, malware analysis, and hands-on hacking challenges.
Hacking challenges are introduced at the end of each module to put theory into practice, pushing learners to apply their new knowledge of attacks to business settings. The course makes use of ParrotOS, too, an alternative security-based operating system to Kali.
This certification would suit a range of roles, including security analysts, pen testers, network engineers, and consultants.
Pros
- Most well-known option
- Teaches modern hacking techniques, exploits, emerging cybersecurity trends, and attack vectors
- Includes e cyberattack case studies, malware analysis, and hands-on hacking challenges
Cons
- Relatively expensive
Offensive Security's Penetration Testing with Kali Linux (PEN-200) is the organization's foundation course in using the Kali Linux OS for ethical hacking.
The vendor's focus is hands-on learning rather than just lectures and academic study and encourages both critical thinking and problem solving with the "Try Harder" slogan.
You will need a solid grounding in network principles, and an understanding of Windows, Linux, and Bash/Python will help.
If you're serious about pursuing a career in ethical hacking but are looking for somewhere to start, the OSCP will give you a qualification well-received in the cybersecurity industry. You can also sign up for a subscription to earn your OSCP at a more relaxed pace.
Pros
- Hands-on learning
- Encourages both critical thinking and problem solving
- The OSCP will give you a qualification well-received in the cybersecurity industry
Cons
- You need a solid grounding in network principles
- You should have an understanding of Windows, Linux, and Bash/Python
- Relatively expensive
You should consider another ethical hacking certification, the PEN 300 (OSEP). The course builds upon PEN 200 and offers more in-depth, advanced penetration testing training, fieldwork instruction, and studies in perimeter attack and defense.
Topics include antivirus evasion, post-exploits, how to bypass network defenses and filters, and Microsoft SQL attacks. You are awarded the OSEP once you have passed the 48-hour exam.
"As a general rule, it will not specifically deal with the act of evading a blue team but rather focus on bypassing security mechanisms that are designed to block attacks," the vendor says.
Pros
- More in-depth, advanced penetration testing training
- Fieldwork instruction and studies in perimeter attack and defense
- Topics include antivirus evasion, post-exploits, how to bypass network defenses and filters
Cons
- Relatively expensive
The SANS Institute also offers courses that are likely to be of interest to anyone pursuing a career in enterprise security, penetration testing, and ethical hacking.
One such course is SEC560, which focuses on on-premise systems, Azure, and Azure AD as a penetration tester. By learning about and exploiting real-world vulnerabilities, learners are taught how to think like a modern attacker and what security holes need to be looked out for when testing enterprise systems.
The course includes over 30 practical lab sessions and ends with a Capture The Flag exercise to test your new skills. SANS offers a six-day in-person course or remote learning.
Pros
- Learn how to think like a modern attacker
- Over 30 practical lab sessions and ends with a Capture The Flag exercise
- SANS offers a six-day in-person course or remote learning
Cons
- The most expensive on our list
Another option to consider from the SANS Institute is SEC542, which focuses on the ethical hacking and testing of enterprise web applications.
SEC542 focuses on teaching participants how to spot vulnerabilities in web explications, how to exploit them, and what tools and techniques attackers may use to compromise these types of software.
The course includes hands-on exercises and instructor guidance based on a four-step web application penetration testing process.
Pros
- Focuses on the ethical hacking and testing of enterprise web applications
- Learn how to spot vulnerabilities in web explications and how to exploit them
- Hands-on exercises and instructor guidance
Cons
- The most expensive option on our list
CREST is a course provider also of note as an organization that offers professional development qualifications in information security.
CREST's certifications, accredited globally, are organized into three levels: practitioner, registered and certified. To reach the certified level, you can take exams in subjects including cybersecurity analysis, penetration testing, web applications, threat intelligence, and incident response. Prices vary.
Pros
- CREST's certifications are accredited globally
- Three levels offered: Practitioner, registered and certified
- To reach certified, you take an exam
Cons
- N/A
What is the best ethical hacking certification?
EC-Council CEH is our top choice, but one size doesn't fit all
If you're looking at a certified ethical hacking course, you should consider what course is right for you in terms of career development. Cybersecurity professionals are in high demand, and while the career can be a lucrative one, you should have researched whether or not specific qualifications will benefit you in the future, whether at your current job or in a future role. While 'cybersecurity expert' is an umbrella term, the industry itself has distinct career opportunities ranging from penetration testers to compliance, legal, and auditing professionals.
How did we choose these certifications?
Our recommendations are based on courses that offer learners instruction in different areas of ethical hacking: whether focused on offensive security, pen testing, or the aftermath of incidents and the means to investigate as a member of a cyberforensics team effectively.
What roles can an ethical hacking qualification benefit?
Recruitment paths vary country-to-country, but ethical hacking courses can be of use to those who want to become penetration testers, security analysts -- an umbrella term common in the field -- cyberforensics investigators, consultants, and members of red teams.
Are there alternative certifications worth considering?
If you're serious about a career in ethical hacking, perhaps consider learning more about cybersecurity. It may help you to eventually move up the ladder. What is the best cybersecurity certification? In our review of the top choices, Cybrary is No. 1 because it's an excellent online resource for free and paid video-based courses.