CEH v13

The Certified Ethical Hacker is one of those certifications everyone has an opinion about. Some people swear by it. Others dismiss it as a “paper cert” that doesn’t prove real hacking skills. After going through it myself, I think the truth is somewhere in the middle—and whether CEH is right for you depends entirely on what you’re trying to accomplish.

I got CEH because it kept showing up in job descriptions. HR departments and hiring managers recognize the name, even if technical people sometimes roll their eyes at it. That name recognition has value when you’re trying to get past resume filters. But I’ll be honest about what CEH is and isn’t so you can decide if it fits your goals.

What Is EC-Council CEH?

The Certified Ethical Hacker is EC-Council’s flagship certification. It’s been around since 2003, which gives it longevity and brand recognition that newer certs don’t have. CEH aims to teach you how attackers think and operate so you can better defend against them—or conduct authorized penetration tests.

The current version, CEH v13, was updated to reflect the evolving threat landscape, with expanded coverage of AI-powered attack techniques, updated cloud attack scenarios, and modernized toolsets. If you tested on an earlier version, v13 is a meaningful step forward in content relevance. The certification covers a broad range of hacking techniques: footprinting, scanning, enumeration, system hacking, malware, sniffing, social engineering, denial-of-service, session hijacking, web application attacks, wireless hacking, mobile attacks, IoT hacking, cloud security, and cryptography. Comprehensive in scope, though still often criticized for being surface-level in depth.

CEH is approved under DoD 8570/8140 for certain positions, which matters if you’re targeting government or defense contractor roles. It’s also recognized internationally—EC-Council has been around long enough that hiring managers in various countries know what it means.

What Does the Exam Cover?

The current version is CEH v13. The exam covers 20 modules spanning the attack lifecycle:

Introduction to Ethical Hacking – Ethics, legality, and methodology. Setting the foundation for everything else.

Footprinting and Reconnaissance – Gathering information about targets through passive and active means. OSINT, DNS queries, social media research.

Scanning Networks – Identifying live hosts, open ports, and services. Nmap and similar tools.

Enumeration – Extracting detailed information from identified services. User lists, shares, configurations.

Vulnerability Analysis – Identifying and categorizing vulnerabilities in systems and applications.

System Hacking – Exploiting vulnerabilities to gain access. Password attacks, privilege escalation, maintaining access.

Malware Threats – Types of malware, how they work, and analysis techniques.

Sniffing – Capturing and analyzing network traffic. Man-in-the-middle attacks.

Social Engineering – Manipulating people to gain access or information. Phishing, pretexting, baiting.

Denial-of-Service – DoS and DDoS attack techniques and countermeasures.

Session Hijacking – Taking over active sessions to bypass authentication.

Web Server and Application Attacks – Exploiting vulnerabilities in web infrastructure.

SQL Injection, Wireless, Mobile, IoT, Cloud – Additional attack vectors in modern environments.

Cryptography – Encryption concepts and attacks on cryptographic systems.

The CEH Debate: What You Should Know

Let me be straight with you about CEH’s reputation in the industry.

The positive: CEH has strong name recognition. HR departments know it. Government contracts often list it as acceptable. It provides a broad survey of hacking techniques that gives you vocabulary and awareness across many attack types. For getting past resume filters, it works.

The negative: Technical professionals often view CEH as too theoretical. The exam is multiple choice, which means you can pass without ever actually hacking anything. The material covers breadth over depth—you learn a little about many topics rather than mastering any of them. Compared to OSCP, which requires you to actually compromise machines, CEH doesn’t prove hands-on capability.

The cost is also significant. EC-Council’s official training is expensive, and while you can self-study, you need to prove either two years of information security experience or complete an official training program to be eligible for the exam.

My take: CEH is useful for breaking into the field, especially if you’re targeting jobs that specifically list it. But don’t stop there. Pair it with hands-on practice on platforms like TryHackMe and Hack The Box. If you want to prove real pen testing skills, plan to pursue OSCP or similar practical certifications afterward.

Who Should Get CEH?

CEH makes sense if you’re targeting jobs that specifically require or prefer it. Check job postings in your area—if CEH shows up frequently, it’s worth having.

For government and defense contractor roles, CEH is approved under DoD 8570/8140 for certain positions. If you’re pursuing that career path, CEH checks a box that needs checking.

If you’re new to offensive security and want a structured survey of hacking techniques, CEH provides that foundation. Just know that it’s a starting point, not proof of expertise.

If you’re choosing between CEH and PenTest+, consider your goals. PenTest+ is more methodology-focused and includes performance-based questions. CEH has broader name recognition. Many people eventually get both.

Exam Details

CEH is expensive. The exam voucher alone is close to a thousand dollars, and EC-Council pushes their official training packages which cost significantly more. Budget accordingly. One thing worth noting: EC-Council does offer a retake option for v13, which I took advantage of myself. I want to give a specific thanks to Jeff Sage at EC-Council who helped clarify the retake process—his guidance made it straightforward to navigate and get scheduled without losing time.

How I Passed CEH

I self-studied for CEH, which meant I needed to prove two years of information security experience to qualify for the exam. If you don’t have that experience, you’ll need to complete an official EC-Council training program.

For study materials, I used the CEH All-in-One Exam Guide by Matt Walker. It’s comprehensive and covers all the exam objectives. I supplemented with EC-Council’s own study materials where I could access them.

I made heavy use of flashcards for memorization. CEH tests a lot of terminology, tool names, and specific attack techniques. Knowing that Nikto scans web servers, SQLmap automates SQL injection, and aircrack-ng cracks wireless encryption—those details matter on the exam.

Even though CEH is multiple choice, I practiced hands-on to understand the concepts. I set up a lab with Kali Linux and practiced the techniques the exam covers. Actually running Nmap scans, exploiting Metasploitable, and trying SQL injection helped the concepts stick. CEH v13 places more emphasis on AI-assisted attack scenarios and updated cloud exploitation techniques, so make sure your study plan reflects the current objectives rather than materials written for earlier versions.

Practice exams were essential. Boson has CEH practice exams that match the difficulty and style of the real thing. I took practice tests until I was consistently above 85%. Given the exam’s length—125 questions in four hours—stamina matters too.

I reviewed the MITRE ATT&CK framework to understand how attack techniques map to real-world campaigns. CEH doesn’t explicitly test ATT&CK, but understanding the framework deepens your knowledge of how attacks work.

Test Day Tips

Four hours is a long time. Bring water if you’re testing in person. Pace yourself—that’s about two minutes per question on average, which sounds like plenty until you hit questions requiring careful analysis.

Many CEH questions are scenario-based. They describe a situation and ask what tool or technique applies. Read carefully—sometimes the answer depends on a specific detail in the scenario.

Know your tools. CEH loves asking about which tool does what. Don’t just memorize names—understand what category each tool falls into and when you’d use it.

Watch for questions about ethics and legal considerations. CEH is “ethical” hacker, and some questions test whether you understand the boundaries of authorized testing.

What Comes After CEH?

If you want to prove hands-on hacking skills, OSCP is the gold standard. It’s significantly harder—a 24-hour practical exam where you must actually compromise machines. Many pen testers view OSCP as the real proof of capability.

CEH Practical is EC-Council’s own hands-on exam. It’s six hours of actual hacking challenges. Adding CEH Practical to your CEH certification addresses the “paper cert” criticism and is worth considering if you want to strengthen what the standard CEH demonstrates.

For specific domains, consider GWAPT for web application testing, GPEN for penetration testing, or cloud security certifications if you’re testing cloud environments.

On the defensive side, CySA+ or CND complement CEH by adding blue team skills. Understanding both offense and defense makes you more valuable.

CEH opens doors, but it’s just the beginning of an offensive security career. Use it to get your foot in the door, then keep building skills through practice, experience, and advanced certifications.

Jenna Carson

Self-taught security pro. No degree, just certs, labs, and a lot of late nights.