EC-Council

What EC-Council is

EC-Council (the International Council of E-Commerce Consultants) is a cybersecurity training and certification organization, best known for the Certified Ethical Hacker (CEH). It writes the curriculum, sells the training and runs the proctored exams for a long list of certifications, from beginner courses that need no IT background to an executive program for chief information security officers. Its site says it was founded in 2001 by Jay Bavisi, who serves as Group President, and that it has trained more than 400,000 cybersecurity professionals, with certified professionals in 170+ countries. The group also runs EC-Council University, EC-Council Global Services and EC-Council Learning, its online training platform, along with scholarships and a global capture-the-flag competition called Hackerverse.

The readers here are individuals preparing for a certification exam and employers or government bodies certifying staff. The site routes inquiries by type: individual, teams and enterprise, government and military, and educator.

The certification roadmap

The home page lays out a roadmap by experience level, with each certification mapped to job roles:

• Foundational, no experience required: the Essentials Series of 8 courses, covering network defense, ethical hacking, digital forensics, DevSecOps, SOC, cloud security, IoT security and threat intelligence
• Entry level (1-2 years of basic computer knowledge): Certified Cybersecurity Technician (C|CT)
• Core (more than 2 years of networking knowledge): Certified Network Defender (C|ND) and C|EH Master, which combines CEH and CEH Practical
• Specializations: penetration testing (C|PENT), SOC analyst (C|SA), threat intelligence (C|TIA), incident handling (E|CIH), digital forensics (C|HFI), cloud security (C|CSE), DevSecOps (E|CDE), application security (C|ASE for Java and .NET), web app hacking, ICS/SCADA, disaster recovery and 3 blockchain certifications
• Executive leadership: C|CISO for 5+ years of experience, and Associate C|CISO for those with 3 years

The FAQ adds AI security certifications, CAIPM and CRAGE, which it says do not require prior AI technical experience. According to the FAQ, the Essentials courses combine self-paced video lessons with hands-on labs, and learners who pass the proctored exam receive a certification, which makes them a low-risk way to try the format before a harder program.

The Certified Ethical Hacker

CEH v13 is the flagship. The course page calls it "the most comprehensive Ethical Hacking program in the world" and the core program in the Vulnerability Assessment and Penetration Testing (VAPT) track. It teaches the tools and techniques attackers use, from a vendor-neutral perspective, and says the current version adds AI-driven cybersecurity skills.

The course runs across 20 modules, from footprinting and reconnaissance, scanning, enumeration and vulnerability analysis through system hacking, malware, sniffing, social engineering, denial of service and session hijacking, to evading IDS and firewalls, web server and web application hacking, SQL injection, wireless, mobile, IoT and OT hacking, cloud computing and cryptography. The page lists over 221 hands-on labs, 550 attack techniques and over 4,000 hacking and security tools, and says more than 50% of training time goes to labs. Students practice within the "5 Phases of Ethical Hacking": reconnaissance, scanning, gaining access, maintaining access and covering tracks.

The FAQ explains the approach. Where a defensive course teaches configuration and firewalls, CEH takes "defense in depth by attacking the systems," pairing offensive tactics with defensive countermeasures. The body of knowledge, it says, draws on security experts, academicians, practitioners and the wider security community, and the course is regularly updated for new techniques and exploits.

The CEH exams

There are 2 exams:

• CEH (knowledge exam): 4 hours, 125 multiple-choice questions on threats and attack vectors, attack detection and prevention, procedures and methodologies. Exam prefix 312-50, delivered through ECC EXAM or VUE.
• CEH Practical: a 6-hour exam with 20 challenges in a performance-based cyber range. The page stresses that it is "NOT a simulation": candidates work on a live corporate network of virtual machines and applications.

The Practical's skill list includes port scanning with tools such as Nmap and Hping, vulnerability detection, DoS and session hijacking, web server and web application attacks, SQL injection and its evasion techniques, wireless and Bluetooth hacking, cryptography with OpenSSL and CrypTool, malware analysis and log analysis.

Passing both earns the CEH Master designation, and the top 10 performers across both exams are shown on the Global Ethical Hacking Leader Board. The program's last stage adds new challenges every month in a 4-hour CTF competition against peers worldwide, focused on new attack vectors.

The FAQ covers the logistics. A candidate who fails buys a retake by writing to the exam team. The exam voucher is valid for 1 year from receipt, remotely proctored sessions must be booked at least 3 days ahead, and all sessions are proctored by EC-Council's certification department.

How training is delivered

The CEH page lists 4 modes:

• iLearn: asynchronous self-study in a video-streaming format
• iWeek: a live online course led by an instructor
• Master Class: training with world-class instructors alongside top infosecurity professionals
• Training Partner: in-person classes at training centers, found through a locator on the site

For iWeek and Master Class, the page asks visitors to fill in a form and speak to a career advisor for the details. No course or exam prices appear on these pages.

Recognition claims

EC-Council puts its credentials up front, and they are its own claims. The FAQ says it is an ISO/IEC 17024-accredited organization and that its programs are recognized by accreditation bodies such as ANSI, as well as by government agencies and Fortune 500 companies. The CEH page states that CEH is listed as a baseline certification on the US Department of Defense 8570/8140 directive and by the British NCSC, and that it is mapped to 45+ cybersecurity job roles. The home page says the DoD recognizes CEH, CEH Practical, CND, ECIH, CHFI and CCISO for roles in its cyber workforce. Testimonials on the home page include a CISO who credits the C|CISO program with helping redesign cybersecurity at the BBC, and a learner who says CEH helped land a job on a red team in the government sector. The CEH page also cites its own figures, including that 1 in every 2 professionals received a promotion after CEH and that 97% found its labs accurately mimic real-world cyber threats.

Who EC-Council suits and who it does not

EC-Council suits someone who needs a named certification an employer or a government contract will ask for, CEH above all, and wants the training and exam from the same organization. The roadmap is broad enough that a learner can start with an Essentials course, move into CEH or CND, and later specialize or step into the C|CISO track. Defense and public-sector candidates have the clearest reason to choose it, given the DoD and NCSC listings the site cites.

It is less suited to someone who wants to compare costs before talking to anyone, since prices sit behind forms and advisors. And the CEH knowledge exam is multiple choice; candidates who want their skills tested hands-on should plan for the CEH Practical as well.