The Burp Suite Certified Practitioner (BSCP) is PortSwigger’s fully practical web security certification: four hours, two deliberately vulnerable applications, zero multiple-choice questions. PortSwigger advertises the certification for €89, but passing requires demonstrated exploitation skill with Burp Suite, not memorized objectives. This guide covers the exact exam format, the hidden cost most candidates miss, a step-by-step preparation path and how BSCP compares with multiple-choice credentials like CompTIA Security+.
The cost people forget
Before you book anything, understand what the €89 actually buys. It covers the exam credit only. An active subscription of Burp Suite Professional is a hard requirement for exam day: PortSwigger states plainly that it will not be possible to complete the exam without Burp Suite Professional, and you must run the whole session inside a Burp project file that you submit for analysis afterwards. Budget for both the exam credit and the subscription period, and make sure your license will still be active on your planned exam date.
What the exam involves
According to PortSwigger’s official exam documentation, the format is unlike almost any other vendor certification. You get four hours to exploit two deliberately vulnerable applications, and each one is solved in three escalating stages: first gain access to any user account, then use that account to reach the admin interface by elevating your privileges or compromising the administrator, and finally use the admin interface to read the contents of /home/carlos/secret from the server filesystem and submit it. Identifying a vulnerability is not enough on its own; you must exploit it to advance, exactly as in the Web Security Academy labs.
A few exam-specific mechanics matter. Each application has up to one active simulated user who visits the homepage every 15 seconds and clicks links in emails the application sends, so client-side attacks delivered through the exploit server are viable. An SSRF can be turned into file reads via an internal service on localhost port 6566. Host header attacks are fair game, but tampering with the _lab cookies wastes time. The exam is open book, so you can consult Web Security Academy materials during the session, and any cheating results in a permanent ban.
Proctoring and exam-day checklist
Identity verification is automated, not human-proctored: you upload a government-issued photo ID and configure your device before the timer starts, and you cannot pass until your ID is verified. Run through this checklist before exam day so nothing technical sinks a four-hour attempt:
- Desktop or laptop with a built-in or external webcam and microphone — tablets and phones are not supported.
- Latest Google Chrome with the pop-up blocker disabled.
- A stable wired or Wi-Fi connection of at least 2 Mbps up and down; avoid hotspots.
- Burp Suite Professional licensed, running, and configured to save to a project file from the first request.
- Government photo ID uploaded, with name and photo clearly readable.
- A quiet, uninterrupted four-hour window — the real exam cannot be restarted once the timer starts.
Results arrive by email within a few working days. If you pass, you receive a certificate with a unique identifier and start and end dates that employers can verify on PortSwigger’s validation platform.
How to prepare step by step
PortSwigger publishes its own preparation path, and it works as a readiness gate: if any step defeats you, the real exam will too. Work through it in order:
- Complete every apprentice and practitioner-level lab in the Web Security Academy without opening solutions.
- Use the mystery lab challenge at the end of each topic, so you practice solving labs with no contextual clues.
- Finish five randomized practitioner mystery labs to train recon and discovery under uncertainty.
- Take and pass at least one practice exam; the practice exam gives you two hours and one application, and you can restart or retake it as often as you like, which makes it an honest difficulty gauge before you spend the real credit.
- Read the official exam hints and guidance page, especially the material on using Burp Scanner during manual testing and obfuscating attacks with encodings to bypass broken defenses.
Whatever your result on practice attempts, log every failed exploit and misread request. Our guide to turning practice exam errors into a study plan applies directly here: the skill being tested is recon discipline as much as exploitation.
BSCP versus Security+
BSCP and CompTIA Security+ sit in different lanes, and choosing between them is usually a question of what you want to prove. Security+ SY0-701 lasts 90 minutes with a maximum of 90 questions mixing multiple-choice and performance-based items, per CompTIA’s official exam page, and covers broad domains from governance to cryptography. BSCP is the opposite: narrow, deep and hands-on. The comparison below summarizes the trade-off:
| Dimension | BSCP | Security+ SY0-701 |
|---|---|---|
| Format | 4-hour practical, 2 vulnerable apps, 3 stages each | 90-minute exam, max 90 questions (multiple choice + PBQs) |
| What it proves | Live web exploitation with Burp Suite | Broad baseline security knowledge |
| Typical audience | Penetration testers, web security specialists | Security analysts, DoD 8140 roles, career switchers |
| Renewal | Expires after 5 years | Renewed through CompTIA’s CE program |
Nothing stops you holding both: many testers use Security+ for HR filters and BSCP to demonstrate actual exploitation ability in technical interviews. If you are scheduling several vendor exams around each other, our overview of 14-day retake rules explains the waiting windows common across proctored certification programs.
Validity and verification
The credential is not permanent: the certificate is valid for five years from the date you pass, and the end date is printed on the certificate itself. Employers can verify a candidate’s status using the unique certification identifier on PortSwigger’s public validation platform, so treat the identifier as part of your professional profile rather than a decorative badge.