Security+ and eJPT: what two very different certifications gave me

Between November and December 2025 I passed two certifications almost back to back: CompTIA Security+ and eJPTv2. From the outside they look like two more boxes ticked on a CV, but they’re very different and each one left me with something else. With a bit of distance, and after putting them to the test at work, I wanted to stop and think about what each one really gave me.

Security+: the map

Security+ is a multiple-choice exam with some hands-on questions (the famous PBQs), and it covers a lot: cryptography, identity, networking, risk management, incident response, compliance… It doesn’t make you an expert in anything. What it gives you is the map.

And the map is worth more than it looks. When I started at the SOC, a good chunk of what I saw already rang a bell: I knew what an IOC was, why least privilege matters, the difference between an IDS and an IPS. I hadn’t mastered it, but I knew where everything was and what to look for. When you’re starting out, that takes a lot of pressure off.

What it doesn’t give you is practice. You can pass it without ever opening a SIEM. That’s why, for me, it’s a good place to start but a bad place to stop.

eJPT: getting your hands dirty

The eJPTv2 is another story. It’s a 48-hour practical exam in a lab: you’ve got a network in front of you and you have to dig out answers by enumerating, exploiting and pivoting between machines. Knowing what something is isn’t enough here, you have to do it.

What it taught me most was patience with enumeration. When you’re stuck, it’s almost never because you’re missing some advanced technique. It’s because you overlooked something in a scan or skimmed over a service. That habit of going back and looking again calmly has followed me everywhere, systems work included.

What I didn’t expect: offense made me a better defender

The funny thing is that the offensive cert is the one that’s helped me most on the defensive side. When an alert tells you someone ran a port scan or tried to upload a weird file to a web server, if you’ve done it yourself, you get what’s going on in a second and what’s likely to come next. And when, later on in a systems role, I had to clean a webshell off a WordPress site, I knew exactly what to look for because I’d been on the other side.

What I took from it

Neither of them turned me into anything on its own. The real learning started when I had real systems, real alerts and problems no syllabus covered in front of me. But Security+ gave me the vocabulary to understand what I was seeing, and the eJPT took away my fear of getting into a machine and seeing what happens. For getting started, I can’t think of a better combination.