Where can I book EXP-401?

Live bookings via offsec.com only. EXP-401 is not part of Learn One or Learn Enterprise. We link to the official course page so you can check price and dates straight with OffSec, and we support procurement if needed.

Does OSEE make sense for a team?

Only for dedicated research roles. For pentest teams OSEP or OSWE deliver far more.

EXP-401 · OSEE · Attack · Expert

EXP-401: Advanced Windows Exploitation - on the way to OSEE.

EXP-401 (OSEE) is the most demanding course in the OffSec catalogue: exploiting modern Windows targets, complex memory corruption, browser and kernel surfaces, and bypassing current mitigations.

Ask for guidance Official OffSec course page

Certification: OSEE - OffSec Exploitation Expert
Level: Expert
Discipline: Attack
Audience: For individual practitioners

Who this course is for

Expert-level exploit developers and vulnerability researchers.

Not the right course yet if

-You have not completed EXP-301
-You do not do vulnerability research

What you can do afterwards

→Exploit complex memory corruption in modern targets
→Build multi-stage exploit chains against current mitigations
→Conduct vulnerability research at expert level

Prerequisites

·OSED level or equivalent exploit dev practice
·Strong assembly and debugging skills
·Reverse engineering experience

Not sure whether you meet them? We run a short placement conversation before you buy.

Course content (official scope)

What EXP-401 covers.

Modern Windows internals
Complex memory corruption classes
Browser and kernel attack surface
Mitigation bypasses
Your own research methodology

Course content, labs and the OSEE exam are provided by OffSec. Precedence always sits with the official course description. This page reviewed: 2026-08-12.

Labs and format

Live format with highly demanding labs, bookable only as live training through OffSec. EXP-401 is not part of any subscription - not Learn One and not Learn Enterprise.

Exam and credential

Multi-day practical exam. Passing awards the OSEE certification.

Buy a licence

The packages that include EXP-401.

Prices in EUR, net, plus statutory VAT. Invoiced through a German entity. Your course is pre-selected at checkout.

This course is only available directly from OffSec. Price, schedule and booking run through the official course page.

Official OffSec course page Discuss procurement with XPLT

What Exploit Labs adds

+An honest check whether EXP-401 is the right step for your role - usually it is not
+When seats are available, we clarify procurement directly with OffSec