CEH v13 Exam Guide: Objectives, Cost, Difficulty, and How It Compares to CySA+

If CEH and CySA+ are both on your shortlist, the honest answer isn't "which one is better." It's "which direction are you pointed — offense or defense — and does your employer or target role care which vendor issued the credential."

What's actually on the CEH v13 exam?

CEH is built around 20 knowledge domains, and they read like a map of how an actual attack unfolds, phase by phase:

1. Introduction to Ethical Hacking
2. Footprinting and Reconnaissance
3. Scanning Networks
4. Enumeration
5. Vulnerability Analysis
6. System Hacking
7. Malware Threats
8. Sniffing
9. Social Engineering
10. Denial-of-Service
11. Session Hijacking
12. Evading IDS, Firewalls, and Honeypots
13. Hacking Web Servers
14. Hacking Web Applications
15. SQL Injection
16. Hacking Wireless Networks
17. Hacking Mobile Platforms
18. IoT and OT Hacking
19. Cloud Computing
20. Cryptography

That's a wide net. Unlike a lot of certifications that stay in one lane (networking, or security operations, or compliance), CEH expects you to have working knowledge of web apps, wireless, mobile, cloud, and IoT attack surfaces — because real attackers don't respect those boundaries either.

Exam details

On cost: sources disagree enough that we're not publishing a single number here. Figures range from roughly $650–$950 for the exam voucher alone up to $1,199–$1,699 when bundled with official training, plus a separate annual maintenance fee EC-Council charges to keep the certification active. Confirm current pricing directly on eccouncil.org before you budget for it — voucher and bundle pricing both shift.

How hard is CEH, really?

Harder to call "hard" or "easy" than most CompTIA exams, because the format works differently. There's no single passing percentage — EC-Council builds multiple exam forms, rates each question's difficulty, and sets a cut score per form. You could sit the same exam as someone else and need a different score to pass, depending on which form you draw.

What makes CEH demanding isn't trick questions. It's breadth. Twenty domains means you can't cram one or two topics and coast — you need working familiarity with web, wireless, mobile, cloud, and IoT attack techniques, on top of the core phases of an attack (recon, scanning, gaining access, maintaining access, covering tracks). If your background is narrow — say, you've only worked network security — expect to spend real study time on the domains outside your comfort zone.

CEH vs. CySA+: which one fits you?

Both show up near the top of on-site search for people researching their next certification, and for good reason — they're often considered together, but they're not really competing for the same job.

Pick CEH first if you're aiming at offensive security — penetration testing, red teaming, vulnerability assessment — and you want a credential that specifically signals "I understand how attacks are built," independent of any one vendor's product ecosystem.

Pick CySA+ first if you're on or headed toward a SOC/blue-team path, already have Network+ or Security+ under your belt, and want a certification focused on monitoring, detection, and incident response rather than offensive technique.

Honest answer for most people: these aren't mutually exclusive, and plenty of working security professionals eventually hold both. Understanding how an attack unfolds (CEH) makes you better at spotting one (CySA+'s territory), and vice versa. If you have to pick one first, let your target role decide — offense-leaning roles want CEH, defense-leaning roles want CySA+ or Security+ first.