PenTest+CompTIA certification

How PenTest+ renewal actually works

CEUs are tracked in the CompTIA CE Portal; each activity needs a date, provider, description, and a completion certificate or verifiable URL. The audit rate is the published 2.5% per cycle with a 30-day documentation window. 60 CEUs over three years is 20 per year — meaningful, but offensive-security pros usually clear it through hands-on training and conferences.

The CE fee is separate from CEUs: $50/year, billed annually through the portal. A fully CEU-compliant account still lapses if the fee goes unpaid.

Activity caps that catch PenTest+ candidates

The five categories mirror CySA+ (the same 60-CEU tier): (1) higher-tier CompTIA certs (CASP+, CSAE, CNVP) — uncapped, each retires the full requirement; (2) education and training with assessment — 1 CEU/hour, no overall cap; (3) Activities (publishing, teaching, mentoring) — capped around 21 CEUs/cycle; (4) conferences and webinars — capped around 27 CEUs/cycle; (5) relevant work experience — capped around 21 CEUs/cycle. Confirm the current figures in the CE Portal.

The conference cap is generous and a natural fit for pentesters — a heavy con year (DEF CON, Black Hat, BSides, Wild West Hackin' Fest) can hit it in a few days of substantive sessions. Hands-on labs (Hack The Box, TryHackMe, OffSec course content, vendor training) land in the uncapped education category and are the reliable backbone.

1 CEU = 1 hour, rounded to 0.25 — CTF socializing and expo-floor time don't count. The audit wants the session agenda plus a tie to PenTest+ exam objectives.

The CASP+ stack-renew option

CompTIA's stack-renew rule means a single higher exam closes out the CEU requirement entirely. PenTest+ is renewed by CASP+ (now CompTIA SecurityX) and the CSAE / CNVP stackable credentials.

Earning PenTest+ in turn renews your lower-tier CompTIA certs — Security+, Network+, and A+ — for a fresh cycle, and per CompTIA's renewal matrix it also renews a held CySA+. If you carry the full CompTIA security stack, one CASP+ pass cascades through all of them at once; many multi-cert holders time CASP+ into the renewal year specifically for that.

The exam-vs-CEU math: CASP+ runs about $509 and is a hard, broad exam — worth it if you wanted SecurityX anyway, not as a pure renewal shortcut. If you don't, 60 CEUs from labs plus one conference is cheaper than the cumulative $150 CE fee plus an exam attempt.

Common pitfalls (and how to avoid them)

Pitfall 1: Logging engagement work as work-experience CEUs without documentation. That category needs a job description plus manager attestation tying duties to PenTest+ objectives. "I ran pentests this year" without the paperwork fails the audit.

Pitfall 2: Lab-platform certificates that expire. Hack The Box / TryHackMe completion records and vendor lab certificates sometimes have retrieval windows — export the certificate when you finish, not at audit time. CompTIA's 1-year documentation lookback is unforgiving on expired provider records.

Pitfall 3: The fee plus buried audit emails. The $50/year fee invoices separately, and audit notices land in CompTIA email that's easy to filter as promotional. Whitelist @comptia.org and calendar the fee.