CREST Certifications: Exams, Pathways and Who Needs Them

CREST certifications are the credentials many UK and international buyers of penetration testing, threat intelligence and incident response services expect to see on the testers they hire, yet the naming, levels and prerequisites confuse candidates and hiring managers alike. CREST runs twelve exams across three disciplines and three levels, from the entry-level CREST Practitioner Security Analyst (CPSA) to the two-part Certified Tester exams. This guide explains the pathways, exam formats, prerequisites, fees and where each exam fits on a career path, using only CREST's own published pages (checked 8 November 2026). It is written for aspiring and working penetration testers, team leads planning staff development, and buyers who want to know what a CREST credential actually tells them. For the wider career route, see the Penetration Tester Career Guide.

Key takeaways

• Three levels, three disciplines. Practitioner, Registered and Certified exams exist for penetration testing, threat intelligence and incident response, plus two red team exams at Certified level.
• CPSA comes first for testers. It has no prerequisites, and a valid CPSA is required before you can book the CREST Registered Penetration Tester (CRT).
• CRT is hands-on. A 2.5 hour practical exam in a provided Kali Linux environment, with separate infrastructure and web application sections that must each reach 60%.
• Experience guidance is advisory. CREST recommends about 2,500 hours for Practitioner, 6,000 for Registered and 10,000 for Certified, and states these timescales are recommended, not mandatory.
• Fees rise steeply. £275 for Practitioner, £600 for Registered and £1,600 for Certified exams (GBP, excluding tax), with Certified exams in two separately booked parts.

Who the certification is for

CREST is a not-for-profit accreditation and certification body for the technical security industry. Its individual certifications matter most where buyers require them: CREST notes that the CRT is recognised by the UK NCSC for its CHECK scheme, the government-approved penetration testing scheme, and CREST member companies commonly staff engagements with certified testers. The table shows who each pathway serves.

• Career changers and graduates: CPSA, CPTIA or CPIA prove foundation knowledge for a first role.
• Working testers with two to three years' experience: CRT is the practical benchmark many consultancies ask for.
• Senior testers and team leads: CCT INF or CCT APP, chosen by specialism; red team specialists and managers take CCRTS or CCRTM.
• Buyers: the level tells you how much hands-on depth was assessed. A CPSA is a written knowledge test; CRT and the Certified exams test practical skill.

Note on naming: some job adverts and articles refer to a "CRPT". CREST's current certification list uses CRT for the Registered Penetration Tester, so check the exact abbreviation on CREST's site when a requirement is unclear.

Exam format and domains

CPSA syllabus areas as published by CREST: soft skills and assessment management; core technical skills; cryptography; background information gathering and open source; networking equipment; Microsoft Windows security assessment; Unix security assessment; web technologies; web testing methodologies; web testing techniques; databases. CPSA preliminary results come from Pearson VUE at the end of the session, with official results from CREST within five working days.

CRT syllabus areas: core technical skills, internet information gathering, networks, network services, Windows, Linux and Unix, web technologies and databases. The web application section carries 60 of the 160 marks, so candidates from a pure infrastructure background cannot pass on network skills alone.

Full syllabuses are published as PDFs on each exam page. Read the current version before booking: CREST revises them, and the detailed objectives are more complete than the summary lists.

Threat intelligence and incident response exams follow the same three-level ladder and the same price bands as the testing path. The CREST pages read for this guide list the exams and levels but not their formats, so read each exam page and syllabus PDF before planning study time rather than assuming they mirror CPSA and CRT.

Using CREST credentials when hiring or buying

• Match the level to the work: a scoping document that asks for "CREST-certified testers" is ambiguous. Specify CRT as the minimum for testers working unsupervised, and CCT INF or CCT APP for the engagement lead.
• Match the specialism: CCT INF and CCT APP assess different skills. A web application or API test should be led by someone with application depth, an internal network or Active Directory test by someone with infrastructure depth.
• Check currency: ask for certificate numbers and expiry dates and confirm them with CREST, since a lapsed certificate tells you less than a current one.
• Look beyond the exam: certifications assess a candidate on one day. Ask for sample reports, methodology and references, and check whether the supplying company is itself CREST accredited where your procurement rules require it.
• Do not overread Practitioner level: CPSA is a written multiple-choice exam. It shows broad knowledge, not the ability to run an engagement.

Prerequisites and experience

CREST is explicit that these timescales are recommendations, not requirements. In practice the CRT page targets roughly three years or more of hands-on testing, and the CPSA page frames CPSA as showing readiness for hands-on roles at about two years. Candidates who sit early usually find the time pressure, not the concepts, the main obstacle.

Preparation plan

1. Download the syllabus PDF for your target exam and map each objective to a rating: confident, need practice, never done.
2. For CPSA, cover breadth. The question bank spans eleven areas, including cryptography, network equipment and databases that daily web testers rarely touch. Revise protocol behaviour, default ports, Windows and Unix authentication internals and common web vulnerabilities.
3. For CRT, practise against the clock. Build a lab with Windows, Linux and web targets, and rehearse finding flags with standard Kali tooling within a fixed time. Practise the web section as seriously as infrastructure, since both must reach 60%.
4. Write a methodology. A one-page checklist (enumerate, identify services, test authentication, test web inputs, escalate, record evidence) keeps you moving under exam pressure and mirrors real engagements.
5. Book through Pearson VUE once you can complete a full practice run in time; you need a Pearson VUE account, and the CRT is only offered at selected centres.
6. Plan for a retake. CPSA allows a retake after seven days; CRT after eight weeks. Build the possible gap into job or contract plans.

Practical skill transfers between certifications. Candidates who already hold OSCP often find the CRT's practical style familiar, though the CRT is shorter and includes a scored web section. See the OSCP Certification Guide.

Cost, renewal and continuing education

CREST states that it also accepts USD, EUR, AUD, HKD and SGD, and that applicable tax is confirmed when booking with Pearson VUE. A full penetration testing path from CPSA through CRT to one CCT therefore costs at least £2,475 before tax and any retakes.

Renewal: the CREST exam, certification and pricing pages read for this guide do not state a validity period or recertification rule. Confirm the current validity and renewal terms directly with CREST before relying on a certificate for a contract or CHECK requirement, and check expiry dates on certificates when hiring.

Professional titles: CREST is also a route to UK Cyber Security Council professional titles, which recognise ongoing professional development rather than a single exam. CREST also links to an announcement that CHECK Team Leader and Member requirements are changing; check the NCSC and CREST pages for the current mapping before planning CHECK roles.

Where it fits on the career path

Choosing between CREST and alternatives: if you will work for UK consultancies, CREST member firms or public sector buyers, the CREST ladder is usually the most direct route. If you work mainly with international clients who ask for OSCP, start there and add CRT later. Testers who assess identity systems, cloud tenants and machine credentials will find the CRT's Windows and web content directly relevant.

Practitioner checklist

• Pick the discipline (penetration testing, threat intelligence or incident response) before the level.
• Download the current syllabus PDF from the exam's CREST page and score yourself against every objective.
• For testing roles, pass CPSA first; it is required before booking CRT.
• Rehearse CRT in a timed lab with both infrastructure and web targets.
• Create a Pearson VUE account and confirm which centres offer your exam.
• Budget for exam fees, tax and a possible retake at each level.
• Confirm validity and renewal terms with CREST, and record expiry dates.
• Check current CHECK requirements with the NCSC and CREST before planning CHECK work.

Standards and references

• CREST: CREST Certifications
• CREST: About CREST Certifications
• CREST: CREST Practitioner Security Analyst (CPSA)
• CREST: CREST Registered Penetration Tester (CRT)
• CREST: Certifications pricing and booking
• CREST: Certification and careers

Related NHI Mgmt Group resources: Penetration Tester Career Guide · OSCP Certification Guide · Red Teamer Career Guide · CEH Certification Guide