What do CEH holders earn? What the BLS data can and cannot say

A salary for a certification would need someone to survey holders, control for job title, region and years of experience, and publish the method. BLS does none of that, and its information security analyst page does not mention penetration testing or CEH at all. What it does publish is pay for the occupation closest to ethical hacking work.

So read every figure below as the pay of US information security analysts, certified or not. BLS does not break penetration testers out of that group, and it has no column for any certification.

That BLS line is the strongest public evidence that a certification helps, and it names no particular one. CEH's realistic job is narrower: it clears filters that ask for a named certification, and it counts where a contract asks for it. EC-Council, for instance, states CEH is approved for several DoD 8140 work roles; the CEH and DoD 8140 page lists which, with that claim's limits.

BLS describes the typical entrant to the occupation as having a bachelor's degree and less than five years of work in a related occupation. The certification sits next to that experience; it does not replace it. The route into ethical hacking shows how the experience gets built.

Entry level

BLS publishes no entry-level wage. The nearest marker is the bottom-10% line, $75,090, and it describes the low end of the whole occupation at every career stage.

Is CEH worth it?

Searches for "CEH is worthless" come from people who expected a certificate to do the work of experience. It will not. As a structured map of attack classes and a box that applications ask you to tick, it does its job. Whether it pays for itself depends on whether the jobs you want ask for it, so read twenty postings in your area before you spend the voucher money.