OSCP: The Cult, The Market, The Madness
Do you remember those 90s cults that believed some race war would save humanity? Yeah? In the Cyber World, OSCP has become one of those weird little cults. And who are the grandmasters of this cult? Hiring Managers. The same people who think OSCP is some holy grail that automatically proves somebody can do a penetration test.
And before the internet starts foaming at the mouth, relax, you sensitive piece of shits. I am not saying OSCP is useless. OffSec, if you’re reading this, yes, I still want to keep my certification. My problem is with the people who get an erection the moment they see OSCP on a resume, while having zero fucking clue how a real penetration test actually works.
The biggest conspiracy out there
Now here’s the part that really gets under my skin. Every fucking job post, hiring manager, and client requirement seems to want OSCP as mandatory. Why? Because somewhere along the way, people convinced themselves that OSCP is the ultimate proof of pentesting ability. I’ve seen web application penetration testing jobs ask for OSCP like it’s the only valid credential in the universe.
Do y’all understand that OSCP is fundamentally a network-focused certification? Yes, it touches some web application concepts. So does CEH. That doesn’t mean either one automatically makes someone a strong web application tester. If a role is specifically about web app security, the skillset should match the work — not just the brand on the certificate.
And that’s the problem. People confuse recognition with competence.
What OSCP actually proves
Let’s not lie to ourselves. If you have OSCP, it usually means you can grind, enumerate, troubleshoot, and keep your head on straight under pressure. That’s respectable. It also means you can probably survive a very specific kind of lab-style attack path.
But real penetration testing is not just, “solve boxes until the points add up”. A real engagement has scope, time limits, weird edge cases, security controls, documentation requirements, retesting, stakeholder communication, and systems that don’t behave like neat little lab targets. It involves adapting to what the environment actually is, not what some training box wanted it to be.
So when people act like OSCP alone makes someone a “real hacker”, I already know that they’ve never actually watched a serious pentest unfold from start to finish.
The money problem nobody likes talking about
And then there is the part people conveniently skip.
Do you want every college graduate to burn roughly 1800 USD just to get a certificate that throws them into a crowd where they can easily disappear? Seriously, think about that. With just OSCP-level knowledge and nothing else, what are you really doing?
You are not some unstoppable cyber wizard. you can probably solve a Hack The Box machines. Cool. That is still not the same as being a strong practitioner in a real environment. And that’s why I hate the “OSCP = elite hacker” nonsense. What it often really means is the person had enough money, time, and suffering tolerance to buy into the ecosystem. That is not the same thing as having real-world depth.
Why I got the cert?
So if I hate the cert, why did I get it?
Get Steven Pereira (Cursed)’s stories in your inbox
Join Medium for free to get updates from this writer.
Simple: I wanted to satisfy hiring managers in two countries. That is it. I thought this stupidity was limited to my home country. Turns out the whole world has the same fucking disease. did the cert improve my existing skills? No. I was already doing the work before I got it, and I am still doing the work the same way after it. The only difference is I am now short of 1800 USD and slightly more annoyed than before. That is the dirty little truth nobody puts on LinkedIn.
The Padawan Problem
And then there is the flood of people who treat OSCP like a secret temple and ask the same questions over and over. My LinkedIn gets stuffed with Padawans asking how I passed, what my methodology was, what I studied, what hack I used, what magical ritual I performed under the moonlight.
The answer is apparently something like a virgin’s blood, a unicorn’s horn, rosemary leaves, a black candle, and sitting naked in a salt circle while praying to the Egyptian gods. Mate, there are countless guides online. There is no magic. Grind your ass off, fail a lot, and keep going until your brain is sick of hearing your own voice asking why you paid for this cert in the first place.
That’s the process. Not a hack, not a shortcut, not a hidden exploit. Just suffering, repetition, and stubbornness.
OffSec made it worse in one way
Now, one more fucking thing. OffSec, why have you made the exam so mentally exhausting?
When I say hard, I do not mean technically hard in the interesting way. I mean exhausting, draining, and needlessly brutal in ways that punish your mind more than your actual skill. I have met way too many people who failed the exam, and when I ask why, they start giving excuses that are mostly about time management, mental block, or getting stuck in rabbit holes. Come on. Give us a technically hard exam, not just a psychological endurance test dressed up as one.
Yes, I know OSCP+ changed the structure, including the AD section and the removal of bonus points. That still does not erase the fact that the exam culture has become more about surviving the ordeal than proving clean, practical skill.
Why I am writing this
Now let me be clear before someone accuses me of launching a personal attack on OffSec. I am not. I have nothing against OffSec. Please do not screw me, OffSec.
The reason I am writing this blog is simple: I am tired of answering the same damn questions from the same damn people. Do not run behind OSCP just to satisfy a hiring manager. And do not stop at OSCP. Keep learning. That’s the whole message.
What happened in the background
OffSec marketed OSCP extremely well. Honestly, it was a Wolf of Wall Street moment for them.
They introduced the cert at the right time, when the market was still relatively young and the competition was thin. Back then, people latched onto two names in particular: CEH and OSCP. And that is how the cult formed. Not because OSCP is some divine object floating above the rest of the industry. But because it was marketed well, recognized early, and then copied into hiring culture until everyone started pretending it was the only thing that mattered.
The actual lesson
OSCP is not the proble by itself. The problem is what people turned it into. It is a certification. A useful one, sometimes a respected one, sometimes a convenient hiring filter. But it is not the final authority on whether someone can pentest, and it sure as hell is not a magical stamp of offensive security greatness.
If you want the cert, get it. If you want to be good, keep going after getting that cert. And if you are a hiring manager treating OSCP like sacred scripture — well FUCK YOU.
Toodles.
