CEH is the better choice if you want hands-on offensive security work like penetration testing. CISSP is the better choice if you’re aiming for a security leadership, management, or CISO-track role. Most professionals who hold both took CEH earlier in their career for the technical grounding, then moved to CISSP once they had five years of relevant experience.
That said, a few things changed in 2026 that most CEH vs CISSP comparisons online haven’t caught up with yet. ISC2 quietly removed CEH from its list of certifications that waive a year of CISSP experience, and the CISSP exam itself now runs shorter and with fewer questions than it did a few years ago. Both changes affect how you should plan the two certifications together, not just which one to pick.
Quick answer, by goal:
| Your Goal | Better Fit |
|---|---|
| Penetration testing, red team, offensive security | CEH |
| CISO, security director, security manager track | CISSP |
| Entry into security with 2 years of experience | CEH |
| You already have 5+ years across security domains | CISSP |
| Highest salary ceiling and broadest job-posting demand | CISSP |
| Fastest, cheapest single-exam path | CISSP (lower exam fee, shorter exam) |
What Is CEH?
The Certified Ethical Hacker (CEH) is an EC-Council credential for offensive, hands-on security work. It teaches candidates to find vulnerabilities the way an attacker would, across reconnaissance, scanning, system hacking, web application attacks, and more. The current version, CEH v13, folded AI-assisted attack and defense techniques into the standard curriculum rather than keeping them as a separate module.
For a deeper look at where the credential stands in the market, see our breakdown of CEH certification worth and demand.
What Is CISSP?
The Certified Information Systems Security Professional (CISSP) is administered by ISC2 and validates a candidate’s ability to design, engineer, and manage an organization’s entire security program. It leans managerial and strategic rather than purely technical, covering governance, risk, architecture, and operations across eight domains. It’s frequently a prerequisite for CISO, security director, and security manager roles.
Does CEH Still Count Toward the CISSP Experience Waiver?
No, not anymore. Effective April 1, 2026, ISC2 cut its list of certifications that qualify for the CISSP one-year experience waiver from roughly 50 credentials down to about 25, and CEH was one of the certifications removed (ISC2 CISSP experience requirements). CISA, CRISC, OSCP, and most GIAC certifications were cut alongside it. Certifications that survived include CompTIA Security+, CySA+, CASP+, CISM, and the rest of the ISC2 family.
This matters if you were planning to earn CEH first and use it to shave a year off CISSP’s five-year experience requirement. That path no longer works for applications submitted on or after April 1, 2026. If you already hold CEH and applied for CISSP before that date, your application was assessed under the old rules and isn’t affected retroactively. If you’re still deciding, this is a real reason to treat CEH and CISSP as two separate investments rather than a two-step combo.
What Changed in the CISSP Exam Format?
The CISSP exam got shorter. As of the April 15, 2024 exam refresh, the English-language CISSP moved to Computerized Adaptive Testing (CAT) exclusively, with 100 to 150 questions in a 3-hour maximum window, down from the previous 150 questions in 4 hours, as outlined in the ISC2 exam weighting update.
The domain weighting shifted too. Security and Risk Management increased from 15% to 16%, and Software Development Security dropped from 11% to 10%. The other six domains held steady:
| CISSP Domain | Exam Weight |
|---|---|
| Security and Risk Management | 16% |
| Asset Security | 10% |
| Security Architecture and Engineering | 13% |
| Communication and Network Security | 13% |
| Identity and Access Management (IAM) | 13% |
| Security Assessment and Testing | 12% |
| Security Operations | 13% |
| Software Development Security | 10% |
Passing score remains 700 out of 1,000. Because it’s adaptive, the exam can end as early as question 100 once the algorithm has enough confidence in your ability level, or run the full 150.
What’s the CEH Exam Format in 2026?
CEH v13 stayed a fixed-length, linear exam rather than moving to adaptive testing. It’s 125 multiple-choice questions over 4 hours, with a passing score that varies by exam form (typically 60% to 85%, depending on question difficulty calibration). The curriculum spans 20 modules, weighted roughly like this:
| CEH v13 Domain Area | Approx. Weight |
|---|---|
| Reconnaissance and footprinting | 15% |
| System hacking | 15% |
| Scanning networks | 10% |
| Enumeration | 10% |
| Malware threats | 10% |
| Web application hacking | 10% |
| SQL injection | 7% |
| Evading security controls | 7% |
| Social engineering | 8% |
| Cryptography | 5% |
| Wireless, mobile, IoT/OT, and cloud hacking (combined) | ~16% |
There’s also a separate CEH Practical exam, a 6-hour hands-on lab test with 20 real-world challenges, required if you want the CEH Master designation on top of the standard CEH.
How Do CEH and CISSP Exam Formats Compare?
| CEH v13 | CISSP | |
|---|---|---|
| Provider | EC-Council | ISC2 |
| Format | Linear, multiple choice | Adaptive (CAT) |
| Questions | 125 | 100-150 |
| Duration | 4 hours | 3 hours max |
| Passing score | 60%-85% (varies by form) | 700/1000 |
| Domains | 20 modules | 8 domains |
| Experience needed to sit | 2 years, or official training | 5 years in 2+ domains (1-year waiver available with a qualifying degree or an approved credential) |
CEH vs CISSP: Which Is Harder?
Difficulty depends more on your background than on the exam itself.
If you’re coming from a hands-on IT or networking role (sysadmin, help desk, junior pentester), CEH will likely feel more familiar. It tests tools, commands, and attack techniques you can practice in a lab, and the multiple-choice format means you’re not being scored on business judgment. The main difficulty is breadth: 20 modules covering hundreds of tools and techniques means memorization load is high even if no single topic is conceptually hard.
If you’re coming from a security analyst, compliance, or IT management background, CISSP will likely feel more natural conceptually but harder mechanically. The adaptive format doesn’t let you skip a question and come back to it, so a shaky answer early can commit you to harder follow-up questions before you’ve found your rhythm.
CISSP also expects you to pick the “most correct” answer among several technically defensible options. That trips up candidates who are used to purely technical, right-or-wrong questions.
A few common mistakes on each exam:
- CEH candidates often under-practice hands-on labs and over-rely on memorizing tool names and switches, which falls apart on scenario-based questions.
- CISSP candidates often study CISSP material like a technical certification and answer from a hands-on-technician mindset instead of a risk-and-governance one, which is usually the wrong lens for the “best answer” format.
Realistic study time: EC-Council and multiple training providers put CEH v13 prep at roughly 6 to 10 weeks for someone with existing security experience, longer if you’re new to offensive security. CISSP prep runs closer to 3 to 6 months at 10-15 hours a week, mainly because of the breadth across all eight domains rather than any single domain’s difficulty.
How Much Do CEH and CISSP Cost?
| Cost Item | CEH v13 | CISSP |
|---|---|---|
| Exam voucher (Pearson VUE) | ~$1,199 | $749 |
| Exam voucher (remote/ECC proctoring) | ~$950 | Not applicable |
| Eligibility application fee (no official training) | $100 | Included in application |
| Annual maintenance fee | $80/year (~$240 over 3 years) | $135/year (~$405 over 3 years) |
| Retake voucher | ~$499 | Included with Peace of Mind Protection, or separate standard retake fee |
| Recertification cycle | 3 years, CEUs | 3 years, 120 CPE credits |
CISSP’s single exam fee is lower than CEH’s, but CISSP candidates typically also budget for training materials given the breadth of the eight domains, and the annual maintenance fee runs higher over a 3-year cycle. CEH’s biggest added cost is usually the $100 eligibility application if you’re not going through official EC-Council training.
Which Pays More, CEH or CISSP?
Government wage data doesn’t break salaries out by individual certification, so treat certification-specific premium figures as directional rather than exact. The U.S. Bureau of Labor Statistics puts the median salary for information security analysts, the closest official occupational match for both credentials, at $124,910 as of its most recent data.
Within that baseline, third-party salary trackers consistently report:
- CISSP carries the larger premium of the two, commonly cited in the $25,000-$35,000 range above non-certified peers, reflecting its weight in senior and management-track roles.
- CEH carries a smaller but still meaningful premium, commonly cited around $12,000-$18,000, concentrated in penetration testing and offensive security roles specifically.
These premium ranges come from industry salary surveys and training providers rather than a single official source, so use them as a rough signal of relative pay difference rather than a guaranteed number for your market or role.
As one specific data point, Payscale’s aggregated self-reported salary data puts average CEH-holder pay at roughly $86,000, noticeably below the CyberSeek/BLS-anchored figures above. That’s a reminder that CEH’s pay ceiling tends to track the specific role (pentester vs. generalist analyst) more tightly than CISSP’s does.
For location-by-location and role-by-role breakdowns, see our dedicated guides on CISSP salary in 2026 and how much Certified Ethical Hackers earn.
Which Certification Has More Job Demand in 2026?
CISSP is the most-referenced certification in U.S. cybersecurity job postings.
In a 2026 analysis of nearly 2,700 deduplicated postings, CISSP appeared in 17.6% of all listings and in 70% of postings that mentioned any certification at all, roughly 2.3 times more often than the next most common credential, CISM.
CEH shows up consistently too, but concentrated specifically in penetration testing, red team, and offensive security job families rather than across the board.
Do Working Security Professionals Actually Rate These Certifications?
It’s worth separating what employers ask for from what practitioners say about the certs once they’re in the room. Discussion threads among working security professionals on forums like Blind and Reddit show a fairly consistent split: certifications like CEH and CISSP are widely treated as resume filters and baseline knowledge signals, useful for getting past an ATS or a recruiter screen, but not as a substitute for demonstrated hands-on skill in an interview.
Several experienced practitioners describe CISSP specifically as teaching them little that was new, while still calling it a career-relevant credential precisely because so many employers screen for it.
The practical takeaway isn’t that either certification is a shortcut. It’s that CEH and CISSP function differently depending on where you are in the hiring pipeline. Both get you past keyword filters and into interviews. Neither replaces the technical depth or judgment you’ll actually be tested on once you’re there.
Which Certification Should You Choose?
Choose CEH if:
- You want hands-on penetration testing, red team, or vulnerability assessment work
- You’re earlier in your security career and want a technical credential you can sit for with 2 years of experience
- Your target roles are Penetration Tester, Security Analyst, or SOC Analyst
Choose CISSP if:
- You’re aiming for security leadership: CISO, security director, security manager
- You already have 5 years of relevant experience (or 4 with a qualifying degree)
- Your target role leans governance, risk, architecture, or program management over hands-on exploitation
Should You Get CEH Before CISSP, or Can You Skip Straight to CISSP?
You can technically go straight for CISSP once you have the required experience, and plenty of security managers never touch CEH. But if you’re earlier in your career, CEH first still makes sense for the hands-on grounding, even though it no longer shortens your CISSP timeline. Plan the order deliberately given the 2026 waiver change: since CEH no longer reduces the CISSP experience requirement, there’s less structural reason to rush it specifically for that purpose. A sequence that still works well: CEH (or equivalent technical experience) early in your career, then CISSP once you’ve independently accumulated 5 years of qualifying experience across two or more CISSP domains.
Related reading:
OSCP vs CEH
CISSP vs CISM
CRISC vs CISSP
CISSP vs CCSP
Can You Get Both?
Yes, and plenty of professionals do, but plan the order deliberately given the 2026 waiver change. Since CEH no longer reduces the CISSP experience requirement, there’s less structural reason to rush CEH first specifically for that purpose. A common sequence that still makes sense: CEH (or equivalent technical experience) early in your career for hands-on grounding, then CISSP once you’ve independently accumulated 5 years of qualifying experience across two or more CISSP domains
Frequently Asked Questions (FAQs)
Does CEH still count toward the CISSP experience waiver in 2026?
No. ISC2 removed CEH from the CISSP one-year experience waiver list effective April 1, 2026. Applications submitted before that date were assessed under the previous, broader list.
How long is the CISSP exam now?
Up to 3 hours, with 100 to 150 adaptive questions, following the April 2024 exam refresh. This is shorter than the older 4-hour, 150-question format still cited on many comparison pages.
Is CEH or CISSP harder to pass?
Neither is objectively harder across the board. CEH tests broad technical recall under a linear format; CISSP tests fewer but more judgment-based questions under an adaptive format that doesn’t allow backtracking. Your existing background (hands-on technical vs. governance and management) usually determines which one feels harder.
Can I pursue CEH and CISSP with limited experience?
You can sit for CEH with 2 years of information security experience or by completing official EC-Council training. CISSP requires 5 years of cumulative experience in two or more domains (4 years with a qualifying degree), though you can pass the exam early and hold an Associate of ISC2 designation while you accumulate the required experience.
Which certification has higher demand in job postings?
CISSP is referenced more broadly across cybersecurity postings overall. CEH shows stronger demand specifically within penetration testing and offensive security roles rather than across the field.
