I Don’t Hate the CEH v13 Updates

I don’t hate the CEH v13 updates. EC-Council put AI into every phase of the course instead of bolting it on as a separate track, kept the knowledge exam the same size, and kept pushing hands-on labs. The price is still steep, but it was steep before v13 too. If you’re deciding whether to study for CEH, the update isn’t a reason to stop.

For context, I earned my CEH around 2016, on a much older version. This isn’t a review of the v13 exam. It’s a look at what EC-Council changed and why the complaints mostly miss.

What changed in CEH v13?

The big change is AI, woven through the whole course. EC-Council launched v13 on September 23, 2024, and according to its CEH v13 page the course now has 20 modules covering over 550 attack techniques, 221 hands-on labs and more than 4,000 hacking and security tools.

The AI content isn’t a single chapter. It shows up inside the modules you’d expect: footprinting with AI-powered OSINT tools, scanning and enumeration with AI, AI-assisted vulnerability analysis and exploitation, AI-based malware and AI-powered malware detection, social engineering and impersonation using AI, and AI-assisted web application and SQL injection attacks. The course also covers attacking AI systems themselves, based on the OWASP Top 10.

Cloud, IoT and OT still have their own modules, which is where they belong now that most of what attackers want lives in someone’s cloud tenant or runs a factory floor.

What does the CEH v13 exam look like?

The certification exam is 125 multiple-choice questions in four hours. EC-Council doesn’t use one fixed passing score; each exam form has its own cut score, set by psychometricians from how its questions perform, so the percentage you need depends on the form you get.

There’s also an optional practical exam: six hours, 20 real-world challenges against a live network of virtual machines. Pass both and you earn CEH Master. EC-Council says both exams are approved under the US DoD 8140 framework and ANAB accredited, which is a big part of why CEH keeps showing up in government and defense contractor job postings.

Why don’t I mind the AI focus?

Because AI belongs inside the job, not next to it. I firmly believe most AI skills should be rolled into every job, and the same goes for certifications. CEH v13 does that: it teaches recon, scanning, exploitation and social engineering the way attackers now do them, with AI in the toolkit.

I’ve said something similar about CompTIA. I think the material in SecAI+ should be covered in Security+ itself, though I understand why CompTIA wants Security+ broad and passable. EC-Council took the other route and folded AI into the main certification. For an ethical hacking cert, that’s the right call.

Are the common complaints about CEH v13 fair?

Mostly no, with one exception: price. Here’s how the usual complaints hold up.

“It’s too expensive.” Fair, and it was before v13. In North America, EC-Council’s official training packages start at $1,699 for on-demand and $2,499 for live online. You can skip official training and apply to sit the exam on your experience instead, but that route means an eligibility application with a $100 fee and a review before you can book. If cost is your dealbreaker, there are cheaper offensive security certs, and v13 didn’t change that math.

“The AI stuff is just marketing.” Some of the copy on EC-Council’s site is, frankly. The course outline isn’t. When AI shows up as a technique in footprinting, scanning and exploitation, that’s what an attacker’s workflow actually looks like now.

“My study materials are outdated.” That’s how updates work. EC-Council says it paces CEH versions every 12 to 18 months, though v13 has now been current for two years. If you’re buying material today, make sure it says v13.

“The older versions were harder.” I hold one of the older versions, and I’m not going to claim that. Different versions test different things. Someone passing v13 today studied more current material than I did in 2016.

Is CEH still worth it in 2026?

Yes, for the right job. CEH is still one of the most recognized names in offensive security, and its DoD 8140 standing keeps it on government and contractor job requirements. If those are the postings you’re reading, CEH earns its place.

If you’re aiming at hands-on penetration testing outside that world, compare it against the alternatives before you spend. CompTIA’s PenTest+ covers similar ground for a $439 exam fee with no training requirement, and if you’re more interested in defense than offense, CySA+ is the better fit.

What should you do if you’re studying for CEH right now?

Keep going, and make sure your materials are for v13. Spend real time in the labs, not just the reading, because the practical exam and the job both reward people who have actually run the tools. Learn the AI techniques in each module rather than skipping them as fluff; they’re in there because attackers already use them.

Then close the forum thread telling you v13 ruined everything, and go practice your Nmap scans.

Keep reading: The New PenTest+ Is Actually Fun. It Just Won’t Get You Hired by Itself and CySA+ Is the Most Underrated CompTIA Cert (and the Most Fun to Study)