What each certification actually covers
Security+ and CEH are both well-known cybersecurity credentials, but they come from different organizations, target different career stages, and cover fundamentally different skill sets. Security+ is defensive and broad; CEH is offensive and specialized.
Side-by-side comparison
| Category | Security+ | CEH |
|---|---|---|
| Focus | Broad defensive security — governance, threats, architecture, operations | Offensive security — hacking phases, tools, exploits, evasion |
| Difficulty | Entry–Intermediate; manageable with 2–3 months study | Intermediate; requires real security experience to pass |
| Cost | ~$404 exam voucher | ~$950–$1,199 including required EC-Council training materials |
| Issuing body | CompTIA (vendor-neutral) | EC-Council (vendor-neutral) |
| Employer recognition | Very high — near-universal in job postings | High in offensive/red team roles; lower recognition in general IT |
| Best job roles | SOC analyst, security analyst, IT security generalist | Penetration tester, ethical hacker, red team analyst |
| Salary impact | $60,000–$90,000 for entry security roles | $80,000–$120,000+ for dedicated pen test roles |
| DoD 8570 | IAT Level II — very commonly required | CSSP roles — more specialized government positions |
| Practical exam option | No | Yes — CEH Practical (separate hands-on exam) |
What Security+ actually tests
Security+ SY0-701 is organized into five domains with a strong emphasis on scenario-based thinking. The biggest domain is Security Operations at 28%, followed by Threats, Vulnerabilities, and Mitigations at 22%. You're expected to know how to recognize attack patterns, apply appropriate controls, and understand governance frameworks — not execute attacks yourself.
What CEH actually tests
CEH v13 is structured around the five phases of ethical hacking: reconnaissance, scanning, gaining access, maintaining access, and covering tracks. The exam tests knowledge of specific tools (Nmap, Metasploit, Wireshark, Burp Suite), attack techniques (SQL injection, XSS, session hijacking), and how to think offensively. It's less about governance and more about how attacks actually work.
Which is harder?
CEH is harder if you don't have hands-on offensive security experience. The exam covers a wide range of specific tools and attack techniques that you genuinely need to have worked with to recognize in exam scenarios. Security+ is harder than people expect — the scenario questions require real analytical thinking — but it's designed for candidates earlier in their careers and doesn't require hands-on exploitation experience to pass.
The cost difference is also significant. At nearly three times the price of Security+, CEH is a real investment that makes the most sense once you've already validated your baseline security knowledge with Security+.
CEH is not universally loved in the security community. Many practitioners prefer OSCP (Offensive Security Certified Professional) for demonstrating practical pen testing ability, as it requires a hands-on 24-hour exam rather than multiple choice questions. CEH is still highly valued in enterprise hiring and government contracting, but if your goal is to prove real offensive capability, be aware of how each cert is perceived in different hiring contexts.
Which should you get first?
Ready to start with Security+?
Security+ is the right first step for most people. Here's where to study and what to read: