Certification & Career

A UK-based accreditation body certifying both individuals and penetration testing firms. That organisational accreditation is what sets it apart: UK public sector tenders frequently require a CREST-approved supplier.

Hands-on labs and mock exams for security certifications — preparation by actually running the tools rather than memorising a question bank.

The certification body for business continuity and disaster recovery. Unlike security certifications it is concerned with disruption rather than attack — fire, flood and supply chain failure belong to the same plan.

The body behind CEH (Certified Ethical Hacker). Unlike OSCP its exam is multiple-choice and widely criticised for not measuring practical skill: it works for getting past HR filters, but as evidence of technical competence OSCP is preferred.

The examination arm of SANS training, with over fifty certificates — the broadest catalogue in the field. What separates it is open-book exams that go deep technically; the price is that these are the most expensive certifications around, rarely taken without an employer paying.

A certification body devoted to identity and access management. Against broad security organisations it covers one area only — IAM, which produces a great many job postings and very few certificates.

The continuation of eLearnSecurity, awarding practical certificates such as eJPT and eCPPT. Against OSCP, eJPT is genuinely entry-level — a gentler first encounter with a hands-on exam format.

The body behind CISA, CISM and CRISC, covering audit, governance and risk. The split from ISC2 is focus: ISC2 looks at security architecture, ISACA at internal audit and compliance. In finance and regulated industries CISA is frequently a hard requirement in job postings.

The body behind CISSP. Unlike technical certifications it leans on governance and risk, and passing is not enough: five years of documented experience and an endorsement are required. That is why it carries weight with employers and why it is a poor first certificate.

A UK firm selling training, consultancy and toolkits around ISO 27001, GDPR and cyber resilience. Unlike a certification body it also takes on the implementation — it does not just award, it runs the compliance work.

An alternative body with a catalogue resembling EC-Council’s, awarding C)PTE and C)ISSO among others. It differs on price and US government mappings (NSA/CNSS); the drawback is recognition narrower than EC-Council’s or GIAC’s.

A programme of hundreds of practical exercises graded on submitted work rather than a sat exam. That is the break from exam-centred bodies: the assessment accumulates as a portfolio, on a subscription model.

The body behind OSCP, formerly Offensive Security. Against multiple-choice exams it is entirely practical: you compromise real machines within 24 hours and write the report. It is widely treated as an entry ticket for penetration testing hiring, and its difficulty is the source of its standing.

A continually updated cheat sheet of the commands and techniques the OSCP exam most often needs. Unlike general pentest notes it is pruned to the exam: focused on topics in OSCP+ scope like AD CS abuse, laid out for quick reference during the test.

The Application Security Verification Standard: measurable security requirements in areas such as authentication, sessions, cryptography and APIs, at three levels. Unlike test guides it sets the bar for what counts as secure enough.

Turkish YouTube channel by Prof. Kemal Bıçakcı featuring university lectures and talks on cryptography, application security, and authentication; focuses on protocol and architectural foundations rather than surface-level tool demos.

A business-driven security architecture framework and its certifications. Against general architecture frameworks like TOGAF it is security-specific; against technical certificates it insists every security decision trace back to a business requirement.

A widely recognised name in security training, with courses feeding into GIAC exams. Against online course platforms, most instructors come from active incident response work. Its Reading Room papers and cheat-sheet posters are free without taking a course.

The roadmap’s HTML source under CC BY-SA. Against the image itself it hands you the data in extractable form, for deriving your own list or auditing the coverage. Last updated August 2024, so anything newer is missing from the chart.

An interactive chart placing security certifications across ten specialisms and four difficulty tiers. Unlike each body’s own pages it is vendor-neutral: competing certifications at the same level sit side by side, so you can see which is genuinely advanced without reading anyone’s marketing.

A Turkish cyber security FAQ. Unlike English career guides it is in Turkish and covers local career questions — where to start, which certification — as much as technical ones.

Turkish national cybersecurity talent program for university students covering penetration testing, malware analysis, and digital forensics; combines in-person bootcamps and CTF competitions rather than passive video courses alone.

The body behind PNPT, whose exam is a five-day real engagement followed by a report and a live debrief. The debrief and a price around a tenth of OSCP’s are the differences — the shortest route to a practical certificate without a budget.

A self-study curriculum that orders free resources by topic for people teaching themselves information security. Unlike certification roadmaps it rests on free material rather than on courses.

A body offering practical exams focused on application and API security. Against the broad-catalogue organisations its narrowness is the point: short, inexpensive exams that measure web and mobile penetration testing directly.