The Certified Ethical Hacker (CEH) is a certification offered by the EC-Council that validates a professional's ability to think and act like a malicious hacker while operating within legal and ethical boundaries. CEH covers reconnaissance, scanning, enumeration, system hacking, malware threats, sniffing, social engineering, denial-of-service attacks, session hijacking, web server and application hacking, SQL injection, wireless network exploitation, and cryptography. It is designed for security professionals who want to understand offensive techniques so they can better defend their organizations against real-world attacks.
The CEH exam (312-50) consists of 125 multiple-choice questions to be completed within four hours. A passing score of 60-85% is required depending on the exam form difficulty. EC-Council offers two paths to eligibility: completing official CEH training or demonstrating at least two years of information security experience. The CEH Practical exam is also available as an optional add-on, requiring candidates to demonstrate hands-on hacking skills in a live lab environment within six hours. Recertification requires 120 ECE credits over three years. The curriculum is updated regularly to reflect current attack vectors and tooling.
CEH provides a structured foundation in offensive security that is recognized worldwide. It is one of the most commonly requested certifications for penetration testing and vulnerability assessment roles, particularly in organizations that follow compliance frameworks requiring ethical hacking assessments. The certification satisfies DoD 8570 requirements for certain technical roles. While more advanced practitioners may pursue OSCP or GPEN, CEH serves as an accessible entry point into offensive security and demonstrates to employers that a candidate understands the attacker mindset. It bridges the gap between defensive security knowledge and offensive capabilities.