CEHCertified Ethical Hacker

How CEH renewal actually works

ECE credits are tracked in the ASPEN portal (EC-Council's member dashboard). Each submitted activity needs date, sponsor, hours, and category — and most categories require a supporting document upload before EC-Council marks the credit as accepted. Unsupported entries sit in pending status indefinitely.

On top of ECEs, there's an annual EC-Council membership fee of $80 USD (as of 2025; verify before quoting). The fee is per-credential — holding CEH + CHFI + ECSA means paying $80 × 3 each year. Many candidates underestimate the membership cost when stacking EC-Council credentials.

ECE category caps and what they mean

EC-Council splits eligible activities into named categories with per-cycle caps. Category A — EC-Council instructor-led training: uncapped (the cleanest credits to earn but among the most expensive). Category B — Vendor-led security training (non-EC-Council): 30 credits/cycle. Category C — Reading approved books / passing the EC-Council book quiz: 5 credits per book, 25/cycle cap. Category D — Authoring articles or research: 20 credits per peer-reviewed article, 40/cycle cap. Category E — Conferences and webinars: 20 credits/cycle cap. Category F — Mentoring / teaching: 10 credits per delivery, 30/cycle.

The cap that surprises CEHs most: the conference + webinar cap at 20 credits per cycle. One Black Hat attendance can technically generate 30+ ECE-eligible hours, but EC-Council won't credit more than 20 for the full 3-year cycle. The cap forces diversification, which is the design intent.

The category that's most useful for cost-conscious renewals: Category C (reading + quiz). EC-Council maintains a list of ~80 approved security titles. Read the book, pass a short EC-Council quiz on the title, earn 5 credits. Most CEHs can cap this category (25 credits) with five books over 3 years at near-zero cost beyond book purchases.

Earning ECEs at low or zero cost

The free-tier ECE path: 5 approved-book quiz passes (Category C, 25 credits) + 6 vendor-led webinars from sources like SANS or vendor-hosted briefings (Category B, ~6 credits) + 4 attended security conferences with free virtual passes (Category E, capped at 20 credits) + 1 peer-reviewed article on a CEH-domain topic (Category D, 20 credits) + 1 mentoring engagement (Category F, 10 credits) = 81 credits, leaving 39 credits to earn from any combination. Total cost: a few books and the time investment.

Free ECE-eligible conferences worth noting: BSides events (virtual passes free, 4–8 credits typical), DerbyCon's archived materials (no longer running but pre-archived sessions still accepted), DEF CON's free YouTube content (case-by-case acceptance, document the session and quiz yourself).

EC-Council also runs occasional free webinars from cert.eccouncil.org/events — these count as Category A (uncapped) and are the highest-leverage free ECE source available. Subscribe to the EC-Council newsletter; webinars are announced ~30 days in advance and fill quickly.

Common pitfalls (and how to avoid them)

Pitfall 1: Missing the 40-credit annual floor. The 120 / 3 = 40 math is the floor, not the target. Plan year-by-year, not cycle-by-cycle. ASPEN shows year-by-year totals on the dashboard — check it every December.

Pitfall 2: Forgetting the membership fee. The annual $80 fee is separate from ECE submissions. A clean ECE balance with an unpaid membership puts the credential into suspended status. Set up auto-renew via ASPEN.

Pitfall 3: Treating EC-Council's audit as theoretical. EC-Council audits a meaningful percentage of renewals — published as 5–8% depending on year — and audits are non-negotiable about documentation. "I attended this webinar but don't have the cert" rarely passes. Keep evidence for the full 3-year cycle plus 12 months.