Cyber Security certification roadmap Official, vendor-verified certifications — from entry-level to expert. Source and verification details for every credential are in docs/certification-data-sources.md.
CCNP Security Cisco Certified Network Professional Security
Professional-level certification for the Cisco network security engineer role — securing routers, switches, and network devices, and deploying firewalls, VPNs, and IDS/IPS solutions. Requires the SCOR core exam plus one concentration exam (e.g. Securing Networks with Cisco Firepower).
Exam: 350-701 SCOR (core) + one concentration exam (e.g. 300-710 SNCF)
Recommended: Foundational networking and security knowledge; CCNA-level knowledge is recommended before attempting CCNP Security.
Network security Cloud security Content security
Official certification page CEH Certified Ethical Hacker
Certification validating offensive-security skills — scanning, testing, and legally hacking systems to find and fix vulnerabilities before real attackers do.
Exam: 312-50 (v13)
Recommended: Two years of information security experience (required only for candidates self-studying without official EC-Council training; official training waives this).
Reconnaissance & footprinting Scanning networks System hacking
Official certification page OSCP (PWK) OffSec Certified Professional
Hands-on penetration testing certification earned via a fully practical, performance-based exam — no multiple choice. Earned through the Penetration Testing with Kali Linux (PEN-200) course.
Exam: OSCP+ practical exam (23h 45m)
Prerequisite: Must complete the PEN-200 (Penetration Testing with Kali Linux) course to sit the exam
Penetration testing methodology Kali Linux tooling Active Directory attacks
Official certification page Expert
OSEP OffSec Experienced Penetration Tester
Advanced penetration testing certification for evading modern defenses and breaching well-secured enterprise environments. Earned through the Advanced Evasion Techniques and Breaching Defenses (PEN-300) course.
Exam: OSEP practical exam (47h 45m)
Prerequisite: Must complete the PEN-300 (Advanced Evasion Techniques and Breaching Defenses) course to sit the exam
Advanced evasion techniques Bypassing security controls Enterprise breach simulation
Official certification page CISSP Certified Information Systems Security Professional
Advanced, management-level security certification spanning eight security domains — architecture, engineering, risk, IAM, and operations. One of the most widely recognized credentials in security leadership.
Exam: CISSP CAT exam (125–175 questions, up to 3 hours)
Prerequisite: Five years of cumulative, full-time work experience in two or more of the eight CISSP domains (a relevant degree or approved credential can waive up to one year)
Security & risk management Asset security Security architecture & engineering
Official certification page CISA Certified Information Systems Auditor
Globally recognized certification for professionals who audit, control, monitor, and assess an organization's information systems.
Prerequisite: 5 years of IS audit, control, assurance, or security work experience — required to become certified, not to sit the exam
IS auditing process IT governance & management Information systems acquisition & development
Official certification page CISM Certified Information Security Manager
Management-focused security certification for professionals who design, oversee, and manage an enterprise's information security program.
Exam: 150 questions, 4 hours
Prerequisite: 5 years of information security work experience, including 3 years of security management experience across 3+ CISM domains, within the 10 years preceding application (a current CISA or CISSP waives 2 years; a relevant master's degree waives up to 2 years)
Information security governance Information security risk management Information security program development & management
Official certification page 
