Ethical hacking courses: labs, certifications and what employers read

Offensive security is the one corner of this field where the training market is genuinely good, because you cannot fake a lab. Four things get called ethical hacking courses, and they do different jobs: subscription labs that teach, a practical certification that proves, a knowledge-based certification that screens, and beginner platforms that make the first month enjoyable enough that you keep going.

Hack The Box Academy: structured, and about to get more expensive

HTB Academy sells modules grouped into job-role paths, with a browser-based attack machine and its own certifications at the end of some tracks. Read on 24 September 2026, the monthly plans were Student at $8, Silver at $18, Gold at $38 and Platinum at $68, alongside annual access plans at $490 for Silver and $1,260 for Gold. The Student plan requires verification as a student or professor at an educational institution.

Know this before you subscribe: Hack The Box announced on 3 September 2026 that from 12 October 2026 the monthly plans become $10, $30, $95 and $125, and the annual plans $550 and $1,400. The monthly tiers also change character, moving from a fixed monthly allowance of cubes to tier-based access. Existing monthly subscribers get a one-month grace period at legacy rates and annual subscribers get one more renewal at theirs, so subscribing before the date has a real, if temporary, value.

Note also that Hack The Box's public pricing page shows team and enterprise plans only, with pricing on request; the individual figures above come from its help centre, not the page most people land on.

TryHackMe: the one to start on

TryHackMe is gentler, more gamified and has the better free tier: limited access to learning paths, free rooms only, and an hour a day on the browser attack box. That is genuinely enough to decide whether this work is for you before paying anybody.

On the page served to us on 24 September 2026 — in euro, because of where our request came from, so you may see your own currency — Premium was €10.50 a month billed annually against €16.99 month to month, and MAX was €17.99 billed annually against €29.11 month to month. Both paid tiers advertise a discount on certifications, which is a real saving if you were buying one anyway.

OSCP: the one employers read as proof

OffSec's OSCP is the credential that changes how a technical interview goes, and OffSec publishes its pricing openly, which is rarer in this market than it should be: a course and certification bundle at $1,749 as a one-time payment, giving 90 days of course access, labs and one exam attempt; Learn One at $2,749 a year for one 200 or 300-level course with two attempts; and CyberCore at $899 one-time for a 100-level course with two attempts.

That is a serious amount of money, and the honest framing is that you are buying the attempt, not the teaching — most people who pass have done months of lab work elsewhere first. OffSec runs no affiliate programme we are part of, so recommending it earns us nothing.

CEH: what is actually published

EC-Council's Certified Ethical Hacker is the credential that appears in job adverts written by HR departments, and it is the one we can tell you least about. Its own certification page publishes the format — a knowledge exam of 125 multiple-choice questions over four hours, and an optional practical exam of 20 challenges over six hours, with a passing score stated as a range of 60% to 85% — and awards the certification on the knowledge exam alone, with CEH Master requiring both.

What that page does not publish is the price, the eligibility requirements or the renewal rules. We are not going to quote a figure we did not read, so if CEH is on your list, budget by asking EC-Council directly rather than by trusting a third-party number.

Which of them to buy, and in what order

Start free on TryHackMe for a month. If you are still enjoying it, take the cheapest paid tier that covers the path you want, on either platform, and finish something. Only then consider an offensive certification, and choose it by who is reading your CV: OSCP if engineers are, CEH if a recruitment filter is.

And be realistic about the ceiling. A lab subscription is not a career plan, and the certification that follows is still one layer of a system — if your work is drifting towards architecture or governance rather than testing, the comparison of certifications by layer is the more useful page, and what online security courses actually buy covers the non-offensive routes.

Budget for the evenings, not just the subscription

The cheapest mistake in this corner of the market is paying monthly for something you use fortnightly. At $18 or €10.50 a month the sticker looks trivial, which is exactly why it goes unexamined for a year. A subscription used properly is four to six hours a week; used badly it is a direct debit with a guilty conscience attached.

The fix is mechanical rather than motivational. Pick one path, put two fixed evenings in the calendar, and cancel the moment you have gone a month without using them — both platforms are month-to-month at the entry tiers, and resubscribing later costs nothing extra. And check what an annual plan actually is before you commit to one: HTB Academy's $490 Silver Annual is not a cheaper version of its $18-a-month Silver, it is a different kind of access, so the bigger number is not a discount in the way the word usually works.