What Studying for CEH Taught Me, and What It Didn't

Certifications are a hot topic in cybersecurity. Some people see them as essential. Others dismiss them as expensive multiple-choice tests. After earning the Certified Ethical Hacker (CEH) credential from EC-Council, my view sits somewhere in between.

Studying for CEH genuinely changed how I look at networks and systems. It also made it clear what a certification can and can't give you. This article is an honest look at both sides, for anyone deciding whether CEH, or any certification, is the right next step.

Why I chose CEH

When I decided to move from IT support and networking into security, I wanted a structured way to understand how attacks actually work. I'd spent years fixing problems after they happened. I wanted to understand the attacker's side: how they find targets, what they look for and why certain weaknesses get exploited again and again.

CEH appealed to me because it covers a broad range of attack techniques in a defined sequence. It's also widely recognized by employers and recruiters, and it appears in many job descriptions for security roles. For someone building a foundation, that combination of breadth and recognition made sense.

What it taught me: think in phases

The most valuable thing CEH gave me was a mental model. Attacks aren't random. They follow a sequence, and understanding that sequence changes how you defend.

CEH frames ethical hacking as a set of phases:

1. Reconnaissance. Gathering information about the target, often without touching it directly: public websites, employee profiles, DNS records, job postings that reveal technologies in use.
2. Scanning and enumeration. Actively probing the target to find live hosts, open ports, running services, versions and user accounts.
3. Gaining access. Exploiting a weakness, such as an unpatched service, a weak password or a misconfiguration, to get into a system.
4. Maintaining access. Establishing a foothold so the attacker can return, often by creating accounts or installing tools.
5. Covering tracks. Hiding evidence by clearing logs or disguising activity.

Once you've studied these phases, you can't unsee them. Every network becomes a set of questions. What could someone learn about us from public sources? Which services are exposed that don't need to be? Where would an intruder hide, and which logs would show it?

What it taught me: the attacker's view of "normal"

My support background trained me to see systems from the user's side: does it work, is it fast, can people do their jobs? CEH trained me to see the same systems from the attacker's side.

A file share that everyone can access is convenient for users. To an attacker, it's a goldmine. A service account with a password that never changes keeps an application running smoothly. To an attacker, it's a long-lived key. An old server nobody wants to touch because "it still works" is a support team's comfort and an attacker's opportunity.

Holding both views at once is, I think, what makes a good security practitioner. Users need things to work. Attackers look for what works too well.

What it taught me: tools and their limits

CEH introduced me to a wide set of tools for scanning, enumeration, password testing, traffic analysis, web application testing and more. Much of my practice happened on Kali Linux, the same platform I later used to build and test Forensic Raptor, my Android forensics project.

The lesson wasn't just how to run tools. It was understanding what they actually do and how their activity looks from the defender's side. A port scan generates traffic patterns that a well-monitored network can spot. A password-guessing attack leaves failed login records. Knowing what an attack looks like in the logs is just as valuable as knowing how to perform it.

What it taught me: ethics and authorization

The "ethical" in Certified Ethical Hacker isn't decoration. A significant part of the material deals with scope, permission and professional conduct.

The difference between a penetration test and a crime is authorization. Testers work under written agreements that define exactly what they may test, when and how. They report findings responsibly and protect the data they encounter. That discipline matters in every security role, not just testing. Analysts, administrators and investigators all handle sensitive information and powerful access. Trust is the foundation of the job.

What it didn't teach me: depth of hands-on skill

Here's the honest part. Passing a certification exam proves you understand concepts. It doesn't prove you can apply them under pressure on a real network.

The CEH exam is knowledge-based. EC-Council offers a separate hands-on practical exam for that reason. The skills that make someone effective, like working through an unfamiliar environment, adapting when a tool fails or chaining small findings into a meaningful result, come from practice, not study guides.

That's why I built a home lab and why I keep experimenting there. Knowledge from CEH gave me the map. The lab is where I learn the terrain.

What it didn't teach me: defence and detection in depth

CEH focuses mostly on offensive techniques. That's useful for understanding threats, but most security jobs, especially at entry and mid level, are defensive: monitoring alerts, investigating incidents, hardening systems and managing vulnerabilities.

My postgraduate program in Cybersecurity and Threat Management at Seneca Polytechnic helped fill that gap, with more focus on threat management, risk and how organizations detect and respond. In practice, the offensive view from CEH and the defensive view from my studies and support work fit together. You defend better when you understand the attack, and you attack more usefully when you understand what defenders can see.

What it didn't teach me: communication

No certification fully prepares you to explain a technical finding to a manager who has five minutes and no security background. Yet that's often what decides whether a vulnerability gets fixed.

My years in IT support helped here more than any exam. Translating "this service is exposed and runs an outdated version with known vulnerabilities" into "this system could let an outsider into our network, and here's what it would take to fix it this week" is a skill in its own right.

How I'd study for it today

If I were preparing for CEH again, here's how I'd approach it.

Build the lab first. Set up a small, isolated practice environment before opening the study guide: a Kali Linux machine and one or two deliberately vulnerable target machines on a private virtual network. Never practise against systems you don't own or have permission to test.

Learn each phase with the tool and the log. For every technique, run it in the lab, then look at what it leaves behind on the target: log entries, network traffic, new files or accounts. This doubles the value of every hour, because you learn to attack and detect at the same time.

Write your own notes. Summarize each module in your own words, with the commands you used and what they showed. Those notes become a personal reference long after the exam.

Use practice questions to find gaps, not to memorize answers. When you get one wrong, go back to the lab and work through the concept until it makes sense.

Connect it to real incidents. Read public breach reports and map them to the phases. Seeing how real attackers moved from reconnaissance to access to persistence makes the material stick.

Pace yourself. Steady study over several weeks beats cramming. The goal is understanding you can use at work, not just a passing score.

Keeping a certification current

Security changes quickly, and certifications evolve with it. I earned CEH at version 10, and EC-Council has since released newer versions that reflect changes in the threat landscape, including cloud, IoT and AI-related topics. A certificate captures what you knew at a point in time. Staying useful means continuing to learn: following current threats, practising new techniques in a lab and maintaining credentials through continuing education.

Should you get CEH?

It depends on your goals. Here's how I'd think about it:

• If you want a broad introduction to attack techniques and a recognized credential for your resume, CEH can be a good choice.
• If you're aiming for a defensive role like a SOC analyst, consider pairing it with, or starting from, a credential focused on security fundamentals and operations.
• If you want to become a penetration tester, look for hands-on, practical certifications and spend serious time in labs and practice environments.
• Whatever you choose, treat the certification as the start of learning, not the finish line. Build things, break things safely and document what you learn.

My takeaway

CEH gave me a framework I still use every day: think in phases, see systems as an attacker would and always act with authorization. It didn't make me an expert, and it was never going to. Experience, practice and curiosity do that.

If you hold a security certification, which one has been most useful in your day-to-day work, and why?