Certifications
The 9 Hack The Box certifications
All of them are hands-on exams lasting several days, ending with a professional report written in English. Every page works the same way: study notes, flashcards and quizzes, module tracking, what the exam assesses, a study plan, advice and a checklist before booking.
Which certification should you choose?
Logical progressions depending on the job you are aiming for.
Pentest
Enterprise penetration testing
Defence
SOC and detection
Comparison
Exam length and the path to complete at 100% to unlock it.
| Certification | Field | Level | Required path | Modules | Exam |
|---|---|---|---|---|---|
| CJCA | General | Beginner | Junior Cybersecurity Analyst | 20 | 5 days |
| CPTS | Pentest | Intermediate | Penetration Tester | 28 | 10 days |
| CWES | Web | Intermediate | Web Penetration Tester | 20 | 7 days |
| CDSA | Defence | Intermediate | SOC Analyst | 15 | 7 days |
| CWEE | Web | Advanced | Senior Web Penetration Tester | 15 | 10 days |
| CAPE | Active Directory | Advanced | Active Directory Penetration Tester | 15 | 10 days |
| CWPE | Wi-Fi | Advanced | Wi-Fi Penetration Tester | 10 | 7 days |
| COAE | AI | Advanced | AI Red Teamer | 12 | 7 days |
| CDEP | Defence | Principal | Detection Engineer | 13 | 10 days |
Levels are indicative. Durations and paths taken from the HTB Help Center and HTB Academy path pages in November 2026.
Rules shared by every exam
Based on the official HTB Help Center.
Before the exam
- Access: the related path completed at 100% and an exam voucher.
- Starting the exam uses up one attempt.
- One exam at a time: you cannot start another while one is in progress or under review.
During the exam
- The countdown starts on confirmation and never stops.
- One connection at a time (VPN or Pwnbox).
- The Pwnbox lives 4 days at most: files stored on it are lost afterwards. Keep your notes elsewhere.
- AI tools are forbidden for solving exam tasks.
- Support gives no hints about the exam content.
Passing and the report
- Two conditions: reach the points threshold (through flags) and submit a professional report in English.
- Upload only from the exam dashboard; the file can no longer be changed afterwards.
- Usual format: unencrypted PDF or ZIP, 20 MB maximum (exception: CWEE, see its page).
- Allowed templates: the one provided with the exam, or SysReptor.
After the exam
- Review within 20 business days at most, result by email.
- If you fail: a second attempt to start within 14 days of the feedback.
- No second attempt if no report was submitted on the first one.
Source: HTB Help Center, “Academy Certifications”. Rules change: re-read that page before booking.