With change a constant, IT professionals looking to improve their careers can benefit from the latest insights into employers’ needs. Data from Foote Partners on the skills and certification most in demand today may provide helpful signposts.
Analyzing more than 640 certifications as part of its 2Q 2025 “IT Skills Demand and Pay Trends Report,” Foote Partners calculated the most valuable IT security certifications to pursue right now based on two dimensions. The first, the average pay premium, measures the difference in pay between IT pros with a particular credential and those without it. The second, market value increase, measures the increase in pay gains over the past six months.
Together, average pay premium and market value increase can give cybersecurity pros a starting point in deciding which certification to pursue for more pay. Apart from considering their overall professional goals, security professionals should consider each certification’s training and exam costs, whether vendor-specific or vendor-neutral, and the lateral or vertical role opportunities it may open.
Offensive Security Certified Expert (OSCE)
OffSec’s Offensive Security Certified Expert consists of three courses: Advanced Web Attacks and Exploitation, Advanced Evasion Techniques and Breaching Defenses, and Windows User Mode Exploit Development. The format for each course exam is the same: Candidates have 48 hours to compromise a given target using various techniques. No formal prerequisites exist for any of the three courses, though OffSec makes specific knowledge and skill recommendations for each. Candidates who complete the three courses and earn the OSCE also get a challenge coin symbolizing their expertise in offensive security.
Training and exam fees: OffSec bundles each course with a certification exam for US$1,649, so the total cost for OSCE is US$4,947.
Average pay premium: 12%
Market value increase: 9.1%
Offensive Security Certified Professional (OSCP)
To earn the Offsec Certified Professional certification, candidates must complete the affiliated course, PEN-200: Penetration Testing with Kali Linux, and pass the subsequent exam. The course covers 10 modules, including information gathering, vulnerability scanning, client-side attacks, and fixing exploits. Certificate holders will have shown mastery of penetration testing methodologies ideal for new roles, such as an ethical hacker, incident responder, or threat hunter. The OSCP+ exam is entirely hands-on, and test-takers must compromise systems within a lab environment.
OffSec does not enforce any prerequisites but recommends candidates be familiar with TCP/IP networking, scripting in Bash and Python, and Linux and Windows, which they can learn through its Network Penetration Testing Essentials Learning Path.
Training and exam fees: OffSec bundles the course and exam for US$1649 and as a one-year subscription that also includes a lab environment for US$2079 annually.
Average pay premium: 11%
Market value increase: 22.2%
OffSec Experienced Penetration Tester (OSEP)
The OffSec Experienced Penetration Tester is ideal for penetration testers and ethical hackers who need more advanced techniques to obtain Windows credentials. Across 20 modules, the certification introduces these professionals to new strategies in phishing, antivirus evasion, privilege escalation, and “living off the land.” During the two-day proctored exam, professionals must connect to a lab environment via a VPN and compromise multiple machines within a network through several possible attack paths. To pass, professionals must achieve the objective stated within the control panel or score at least 100 points — 10 points are awarded for every flag found in a local.txt or proof.txt file. Professionals who earn their OSEP can also obtain their OSCE³ Certification to demonstrate their mastery of offensive security. They would also need to pass the exams for WEB-300: Advanced Web Attacks and Exploitation and EXP-301: Windows User Mode Exploit Development, after which the OSCE³ is automatically awarded.
While there are no formal prerequisites for OSEP, OffSec recommends candidates take the PEN-200: Penetration Testing with Kali Linux or have a strong foundation in operating systems, networking, and scripting.
Training and exam fees: US$1,749, course plus exam
Average pay premium: 11%
Market value increase: 22.2%
Certificate of Cloud Security Knowledge (CCSK)
As a certificate and not a certification — an important distinction — the Cloud Security Alliance (CSA) positions its Certificate of Cloud Security Knowledge as the foundation for future credentials and upskilling in the sector. From this perspective, the CCSK is helpful for cybersecurity analysts, compliance managers, security engineers, architects, and administrators. This vendor-neutral certificate covers topics in cloud incident response, application security, data encryption, and more. CCSK offers a variety of training modalities, including an exam prep kit, instructor-led classes offered virtually and in person, and an online self-paced option. Candidates must score at least 80% on the exam, randomly pulling 60 multiple-choice questions from a test bank. A new version of this certificate will be offered beginning July 2024.
Training fees: Prices vary based on modality. A course bundles the exam for US$795, and online, instructor-led training begins at €1160.
Exam fees: The exam costs US$599, though discounts are available for corporate members, and US military veterans can take it for free.
Average pay premium: 11%
Market value increase: 22.2%
EC-Council Certified Chief Information Security Officer (C|CISO)
EC-Council has a Certified Chief Information Security Officer certification (C|CISO). The title of the certification may be misleading: It is not designed only for CISOs or those who aspire to that position. The C|CISO materials state that the program is ideal for over two dozen professionals, ranging from CEOs and managing directors to delivery managers and security auditors. Despite this breadth, candidates must still have five years of experience in each of the C|CISO domains, which include governance and risk management, information security core competencies, and more. This experience can overlap, and candidates can substitute some requisite experience with other credentials or advanced degrees. The two-and-a-half-hour exam comprises 150 questions across three levels: knowledge, application, and analysis. The certificate is valid for three years, and candidates must maintain it through continuing education requirements and a US$100 annual fee.
Training fees: EC-Council offers a variety of training modalities, including on-demand, live in-person or online, and group options. The caveat is that interested candidates are invited first to inquire to obtain the price or a quote.
Exam fees: US$100 application fee
Average pay premium: 11%
Market value increase: 10%
CyberSecurity Forensic Analyst (CSFA)
Administered by the CyberSecurity Institute, the CyberSecurity Forensic Analyst Certification teaches professionals how to conduct a forensic examination of a computer or digital device, including CDs, DVDs, USBs, and mobile phones, and communicate their analysis to stakeholders. The three-day exam is held on-site at Edmonds College in Lynnwood, Wash., and consists of 50 multiple-choice questions and a hands-on scenario. Candidates are given a hard drive and, in some cases, additional media and must produce an affidavit, declaration, or other response depending on the scenario. To earn a CSFA, the professional must score 85% across the two sections, with the practical scenario carrying 70% of the grade weight, and the written score the other 30%. Professionals who pass are prominently displayed on a public database of CyberSecurity Institute alongside more than a hundred CyberSecurity forensic analysts. The last exam was held in August 2024; interested professionals should follow CyberSecurity’s website for announcements of the next date.
While there are no formal prerequisites, CyberSecurity Institute recommends experience in the administrative side of digital forensics, such as writing the verbiage for subpoenas and motions. Candidates must also pass an FBI criminal background check, a process that can take up to three months.
Training fees: Edmonds College hosts an instructor-led CSFA study group over Zoom in advance of the exam. Professionals interested in joining are encouraged to contact cyberdefense@edmonds.edu for more information.
Exam fees: US$750 — waived for Edmonds College students
Average pay premium: 10%
Market value increase: 11.1%
GIAC Certified Intrusion Analyst (GCIA)
GIAC offers a Certified Intrusion Analyst Certification that focuses on traffic analysis, network and host monitoring, and intrusion detection through Snort and Zeek. GCIA is ideal for system and security analysts, network engineers and administrators, security managers, and other professionals involved in intrusion detection. To earn a GCIA, professionals must score a 67% on a 106-question, 4-hour exam. The exam tests knowledge in more than 15 areas, including application protocols, fragmentation, packet engineering, TCP protocol, and Wireshark fundamentals. To renew, GCIA holders must take 36 continuing education credits over the four years that the certification is active, or retake and pass the certification exam. There are no official prerequisites for the GCIA, but the affiliated preparatory course recommends that candidates have working knowledge of network monitoring and threat hunting.
Training fees: GIAC offers self-paced, virtual, and in-person training in major cities worldwide, starting at US$8,780. A practice test is also available for US$399.
Exam fees: US$999 for the first attempt, and US$899 for retakes
Average pay premium: 10%
Market value increase: 11.1%
Offensive Security Defense Analyst (OSDA)
The course that culminates in the OSDA is Foundational Security Operations and Defensive Analysis, which teaches candidates to defend networks and systems against cyber threats. Specific modules include attack methodology, Windows client- and server-side attacks, Linux attacks, network detections, and antivirus alerts and evasion. Earning the OSDA may open job opportunities as a threat hunter, incident responder, or defensive-focused security engineer. During the exam, students have 24 hours to identify and respond to threats in a lab environment and an additional 24 hours to submit an incident response report. While there are no formal prerequisites to OSDA, OffSec recommends knowledge of TCP/IP networking, Windows and Linux, and general cybersecurity concepts.
Training and exam fees: US$1,749, course plus exam
Average pay premium: 10%
Market value increase: 11.1%
Offensive Security Exploitation Expert (OSEE)
OffSec’s Offensive Security Exploitation Expert is a vendor-specific certification, focusing on advanced Windows exploitation. As a penetration testing course, the material dives deep into topics such as advanced heap manipulations and disarming WDEG mitigations. Certificate holders can identify problematic code in Windows operating systems and develop exploits. For the practical exam, candidates must complete a comprehensive penetration test of software and create an exploit within a lab environment — all within 72 hours. To qualify, you must have experience debugging, developing Windows exploits, and using the following technologies: WinDBG, x86_64, IDA Pro, and basic C/C++ programming. OffSec recommends completing its 300-level certifications before OSEE, which it calls its hardest course.
Training and exam fees: OffSec offers only instructor-led, in-person training. Enterprises should inquire for more information.
Average pay premium: 10%
Market value increase: 11.1%
