Certification Statistics
Exam fees, experience requirements, exam formats, and renewal rules across 80 cybersecurity certifications from 19 issuers. Every figure comes from the certification profiles on this site, which take each fact from the issuer's own pages.
Updated
Key Findings
- Across the 80 cybersecurity certifications profiled on ImmunitySec, the median listed exam fee is $599 for the 76 with a one-time price in US dollars. By level, the median is $350 for entry-level, $550 for intermediate, and $749 for advanced certifications.
- Listed one-time exam fees range from $99 (SC-900) to $1,749 (OSEP and OSAI). Some listed prices include training, lab access, or a retake.
- GIAC lists 20 of the 76 priced certifications, which pulls the overall median up. Counting each of the 15 issuers once, at its own median fee, the median is $445.
- By track, among the 80 cybersecurity certifications profiled on ImmunitySec, Identity and Access certifications have the lowest median fee ($249) and Forensics and Incident Response certifications the highest ($999, where 6 of 11 come from GIAC).
- 63% of the 80 cybersecurity certifications profiled on ImmunitySec (50) have no stated experience requirement. Of the rest, 20 require experience, official training, or another certification, and 10 recommend experience without requiring it.
- Among the 80 cybersecurity certifications profiled on ImmunitySec, 31 use multiple choice only, 30 mix multiple choice with performance-based items, 13 use hands-on practical exams, 4 use computerized adaptive exams, and 1 is a course certificate.
- The median time limit for a question-based cybersecurity certification exam (multiple choice, adaptive, or mixed format) is 158 minutes, across the 64 profiled exams with a published time limit. Of the hands-on exams, 8 run longer than 24 hours.
- 84% of the 80 cybersecurity certifications profiled on ImmunitySec must be renewed. The most common cycle is 3 years (37 certifications), 59 accept continuing education credits for renewal, and 13 do not expire.
- 46 of the 80 cybersecurity certifications profiled on ImmunitySec appear in the DoD 8140 qualification matrix (version 2.1). GSEC qualifies for the most DCWF work roles (22).
Exam Fees
76 priced in US dollars- Under $25013 (17%)
- $250 to $49917 (22%)
- $500 to $74918 (24%)
- $750 to $99925 (33%)
- $1,000 or more3 (4%)
One-time listed prices in US dollars. Left out: BTL1 (£399), Google Cybersecurity Certificate ($49/month), eJPT (not published), CRTO (£399).
Exam Fees by Level
| Level | Priced | Median | Range |
|---|---|---|---|
| Entry | 14 of 18 | $350 | $99 to $999 |
| Intermediate | 41 of 41 | $550 | $165 to $1,699 |
| Advanced | 17 of 17 | $749 | $165 to $1,749 |
| Expert | 4 of 4 | - | $599 |
Levels follow the issuers' own level labels and stated experience requirements. A median needs at least 5 priced certifications.
Exam Fees by Issuer
| Issuer | Priced | Median | Range |
|---|---|---|---|
| GIAC | 20 | $999 | $399 to $999 |
| ISC2 | 9 | $599 | $199 to $749 |
| CompTIA | 8 | $419 | $274 to $544 |
| EC-Council | 6 | $600 | $450 to $999 |
| Microsoft | 6 | $165 | $99 to $165 |
| IAPP | 5 | $550 | $550 to $799 |
| ISACA | 5 | $760 | $599 to $760 |
| Cisco | 4 | - | $300 to $700 |
| Hack The Box | 3 | - | $210 |
| OffSec | 3 | - | $1,699 to $1,749 |
| Altered Security | 2 | - | $249 to $299 |
| TCM Security | 2 | - | $249 to $499 |
Issuers with at least 2 priced certifications. Counting each of the 15 issuers once, at its own median fee, the median is $445.
Exam Fees by Track
| Track | Priced | Median | Range | Largest issuer |
|---|---|---|---|---|
| Identity and Access | 7 of 7 | $249 | $99 to $599 | Microsoft (3) |
| Foundations | 9 of 10 | $399 | $99 to $999 | CompTIA (3) |
| Cloud Security | 13 of 13 | $445 | $165 to $999 | GIAC (4) |
| Security Operations | 21 of 23 | $450 | $165 to $999 | GIAC (7) |
| Offensive Security | 14 of 16 | $525 | $210 to $1,749 | OffSec (3) |
| Network Security | 9 of 9 | $550 | $249 to $999 | Cisco (4) |
| Privacy | 6 of 6 | $550 | $550 to $799 | IAPP (5) |
| GRC and Audit | 21 of 21 | $599 | $99 to $999 | IAPP (4) |
| Security Architecture | 9 of 9 | $599 | $165 to $999 | ISC2 (4) |
| AI Security | 8 of 8 | $899 | $165 to $1,749 | GIAC (3) |
| Forensics and Incident Response | 11 of 12 | $999 | $210 to $999 | GIAC (6) |
A certification in more than one track counts in each. The table leaves out tracks with fewer than 5 priced certifications. The largest issuer is the one with the most priced certifications in the track.
Experience Requirements
- None required or stated50 (63%)
- Another certification first1 (1%)
- Up to 1 year4 (5%)
- 2 to 3 years12 (15%)
- 4 to 5 years9 (11%)
- More than 5 years4 (5%)
The fewest years of experience any route to the certification needs, counting a required certification's own requirement. 20 certifications require experience, official training, or another certification, and 10 only recommend experience.
Experience by Level
| Level | Certifications | No experience required | Median years |
|---|---|---|---|
| Entry | 18 | 15 (83%) | - |
| Intermediate | 41 | 27 (66%) | 2 |
| Advanced | 17 | 8 (47%) | 5 |
| Expert | 4 | 0 (0%) | - |
Median years counts only the certifications that require or recommend experience, and needs at least 5 of them.
Exam Format
- Multiple choice31 (39%)
- Multiple choice and performance-based30 (38%)
- Hands-on practical13 (16%)
- Computerized adaptive4 (5%)
- Course certificate1 (1%)
Counted over the 79 certifications whose issuer publishes the exam format. Hands-on practical exams are lab exams, often with a written report.
Exam Length
- Up to 2 hours26 (34%)
- More than 2, up to 3 hours28 (36%)
- More than 3, up to 4 hours10 (13%)
- More than 4, up to 24 hours5 (6%)
- More than 24 hours8 (10%)
The time limit of the 77 exams with a published one. Where there are several exams, the core or first one counts. Report time that the issuer lists separately does not count. Where an issuer gives one window for the lab work and the report, the whole window counts.
Renewal Cycle
- Every year5 (6%)
- Every 2 years5 (6%)
- Every 3 years37 (46%)
- Every 4 years20 (25%)
- Does not expire13 (16%)
How long a certification stays valid before it must be renewed. 59 of the 67 that expire accept continuing education (CPE) credits for renewal. The others renew by passing an assessment or the current exam, or under the issuer's own rules. Certifications that do not expire: BTL1, CCSK, Google Cybersecurity Certificate, HTB CDSA, HTB CPTS, HTB CWES, SC-900, OSCP, OSAI, OSEP, PJPT, PNPT, CRTO.
DoD 8140 Work Roles
Announced Exam Changes
| Date | Certification | Change |
|---|---|---|
| 2026-11-17 | Security+ | Security+ V8 (SY0-801) is scheduled to launch in English on or around this date. It keeps the 90-question, 90-minute format, reweights the domains and adds coverage of AI-related risks. |
| 2026-12-01 | OSCP | OffSec replaces the fixed 70-point pass mark with a scaled grading system for the OSCP+ exam. |
| 2027-02-02 | CCNA | The 200-301 CCNA v1.1 exam retires. |
| 2027-02-03 | CCNA | The v2.0 blueprint replaces the six v1.1 domains with five: Network Infrastructure and Connectivity, Switching and Network Access, IP Routing, Network Services and Security, and AI, and Network Operations and Management. It adds agentic and generative AI topics and hands-on practical skill assessments, and keeps the 120-minute duration and 300 USD price. |
| 2027-06-11 | Security+ | The SY0-701 exam retires. |
The issuers announced these dates. A change leaves this list once its date passes.
Frequently Asked Questions
How much does a cybersecurity certification cost?→
Across the 80 cybersecurity certifications profiled on ImmunitySec, the median listed exam fee is $599 for the 76 with a one-time price in US dollars. By level, the median is $350 for entry-level, $550 for intermediate, and $749 for advanced certifications. Listed one-time exam fees range from $99 (SC-900) to $1,749 (OSEP and OSAI). Some listed prices include training, lab access, or a retake. GIAC lists 20 of the 76 priced certifications, which pulls the overall median up. Counting each of the 15 issuers once, at its own median fee, the median is $445.
Which cybersecurity certifications need no experience?→
63% of the 80 cybersecurity certifications profiled on ImmunitySec (50) have no stated experience requirement. Of the rest, 20 require experience, official training, or another certification, and 10 recommend experience without requiring it. Entry-level examples without a stated requirement: CRTP, BTL1, CCNA, CCNA Cybersecurity, CCSK, GCLD, GFACT, GISF, and 7 more.
How often do cybersecurity certifications need to be renewed?→
84% of the 80 cybersecurity certifications profiled on ImmunitySec must be renewed. The most common cycle is 3 years (37 certifications), 59 accept continuing education credits for renewal, and 13 do not expire.
Which cybersecurity certifications do not expire?→
Of the 80 cybersecurity certifications profiled on ImmunitySec, 13 do not expire: BTL1, CCSK, Google Cybersecurity Certificate, HTB CDSA, HTB CPTS, HTB CWES, SC-900, OSCP, and 5 more.
How long is a cybersecurity certification exam?→
The median time limit for a question-based cybersecurity certification exam (multiple choice, adaptive, or mixed format) is 158 minutes, across the 64 profiled exams with a published time limit. Of the hands-on exams, 8 run longer than 24 hours.
Method
- The build counts every number on this page from the 80 certification profiles on this site. Data as of 2026-11-06, the newest profile review date.
- The profiles are a curated selection, not every certification on the market, so shares describe this selection. One issuer with many profiled certifications moves the overall figures. The fees by issuer table and the issuer median show by how much.
- Each profile takes its facts from the issuer's own pages: certification pages, exam outlines, candidate handbooks, pricing pages, and renewal policies. The counts leave out facts an issuer does not publish.
- Fees are the price each certification page lists; its price note gives member, regional, and bundle prices. Fee figures leave out monthly subscriptions and prices in other currencies.
- Levels and tracks follow the site's difficulty scale and certification roadmap. Experience is the fewest years any route to the certification needs.
- Medians are the middle value; with an even count, the average of the two middle values. A median needs at least 5 certifications. Percentages are rounded to whole numbers.
Cite This Page
ImmunitySec. "Cybersecurity Certification Statistics." Data as of November 6, 2026. https://www.immunitysec.com/certifications/statistics/The figures change with the data, so a citation should include the data date.
Counted from profiles of 80 certifications from 19 issuers, checked against each issuer's own pages. Certification names are trademarks of their owners. This site is not affiliated with or endorsed by any certification body.