Hiring managers and candidates often treat CRTO, CRTP and PNPT as interchangeable "practical red team" badges, but they test different things, in different formats, with different reporting and renewal rules. This guide compares the three on the facts their providers publish: who runs each one today, what the exam asks you to produce, how long it lasts, what it costs and whether it expires. It covers the Red Team Operator certification from Zero-Point Security (now part of Fortra), the Certified Red Team Professional from Altered Security and the Practical Network Penetration Tester from TCM Security. It is written for practitioners choosing a next credential and for managers who need to read these credentials on a CV or fund them. It deliberately describes the certifications, not offensive techniques. Facts were checked on the providers' own pages on 24 October 2026; these providers change prices and rules often, so confirm on the linked pages before you buy.
Key takeaways
- All three are lab exams, not multiple choice. Each requires work in a live environment; none is a knowledge test.
- Only two require a written report. CRTP asks for detailed solutions with mitigations after a 24-hour exam, and PNPT asks for a professional report plus a live 15-minute debrief; the CRTO exam pages read describe a flag-based pass with no report.
- They emphasise different skills. CRTO centres on adversary simulation with a commercial command and control framework in an assumed-breach scenario, CRTP on Active Directory across multiple domains and forests, and PNPT on a full external-to-internal penetration test including OSINT.
- Ownership has changed. Fortra announced its acquisition of Zero-Point Security on 2 April 2026; the courses and certifications still carry the Zero-Point Security name on the provider's own pages.
- Renewal rules differ sharply. CRTP expires after three years with a free renewal exam, PNPT does not expire according to TCM Security, and the Zero-Point Security pages read do not state an expiry for the Red Team Operator certification.
Who the certification is for
These are practitioner credentials for people who already understand networking, Windows and Linux administration and the basics of penetration testing. They sit in the space between entry-level offensive certifications and expert-level adversary emulation credentials. Our Cybersecurity Certifications Guide covers the wider landscape; this page goes deeper on three practical options only.
- Red Team Operator (often called CRTO), Zero-Point Security: aimed at penetration testers moving into red team operations who want structured practice in adversary simulation. The provider lists the course at practitioner level.
- Certified Red Team Professional (CRTP), Altered Security: aimed at people who need to assess or defend Active Directory. Altered Security describes it as beginner-friendly and the course title, "Attacking and Defending Active Directory", reflects a defensive angle as well; the stated prerequisites are a basic understanding of Active Directory and the ability to use Windows command-line tools.
- Practical Network Penetration Tester (PNPT), TCM Security: aimed at people heading for penetration testing consultancy work, where the report and the client debrief are part of the job. TCM Security sets no formal prerequisites and recommends its junior PJPT first for those without professional hacking experience.
- For defenders and managers: blue team leads, detection engineers and identity administrators can use these to understand how assessments of their environment are run; CRTP in particular is relevant to Active Directory owners.
Exam format and domains
| Item | Red Team Operator (CRTO) | CRTP | PNPT |
|---|---|---|---|
| Provider (owner) | Zero-Point Security, acquired by Fortra (announced 2 April 2026) | Altered Security | TCM Security |
| Linked course | Red Team Ops | Attacking and Defending Active Directory Lab | PNPT training bundle (45+ hours of video) |
| Exam style | Practical CTF-style event on Snap Labs, starting from an assumed breach, guided by a threat profile released at booking | Fully hands-on challenges in a patched Windows environment with multiple domains and forests, individual to each student | Full penetration test: OSINT, then Active Directory work, antivirus and egress bypass, lateral and vertical movement, ending in compromise of the domain controller |
| Time in the environment | Up to 48 hours of runtime, usable within a 4-day window (VMs can be paused) | 24 hours | 5 full days |
| Pass criterion | At least 6 of 8 flags (75%) | Not stated on the course page | Assessment of report and debrief; no flags |
| Report | Not described on the exam pages read | Detailed solutions with practical mitigations submitted at the end | Professional report, 2 additional days |
| Debrief | None described | None described | Live 15-minute debrief in front of assessors |
| Access | Browser only through Guacamole; no VPN or internet access | Browser or VPN to the lab | Not proctored; candidate's own system (TCM lists 8 GB RAM and 256 GB disk) |
| Notable rules | Reschedule or cancel up to one hour before the start | Unfair practice leads to a six-month cooldown, a second offence to a permanent ban | AI tools allowed, but their use must be disclosed in the report |
What each one is really testing
- CRTO: operating as an adversary within a scenario and threat profile, with a licensed copy of Cobalt Strike provided in the course labs. It tests tradecraft and persistence through a multi-machine environment, scored on flags.
- CRTP: depth in Active Directory: trust relationships across domains and forests, privilege paths and the mitigations for them. The lab manuals cover both standalone tools and the open-source Sliver C2.
- PNPT: the consultancy workflow from reconnaissance to a written deliverable and a client-style debrief. Communication carries as much weight as technical success.
None of the providers publishes a formal domain-weighted outline of the kind ISC2 or ISACA use; the course syllabus is the scope.
Prerequisites and experience
- No experience verification: none of the three requires proof of work experience or an endorsement. That makes them accessible, but it also means the credential says nothing about professional history.
- Stated prerequisites: Altered Security lists basic Active Directory understanding and Windows command-line use. TCM Security lists none (candidates under 18 need a parental consent form) and suggests PJPT first. The Zero-Point Security pages read do not list formal prerequisites; the course is pitched at practitioner level.
- Realistic baseline: comfort with Windows domains, Kerberos and NTLM concepts, Linux and Windows command lines, networking and basic scripting. Candidates without penetration testing experience should expect a longer preparation period.
- Legal and ethical baseline: all of these labs are authorised environments. Skills learned there are only used on systems you have written permission to test. See the Penetration Test Scoping Checklist.
Preparation plan
- Choose by job, not by badge. Internal or consultancy red team role: CRTO. Active Directory assessment or defence: CRTP. Consultancy penetration testing with client reporting: PNPT. Use the decision table below if two fit.
- Check the exact current terms. Confirm price, included attempts, lab time and expiry on the provider page on the day you buy; all three have changed rules in recent years.
- Plan lab time before you buy it. CRTP lab access is time-boxed (30, 60 or 90 days) and starts when you activate it within 90 days of purchase, so block study time first. Zero-Point Security courses and exam vouchers have no expiry. The PNPT training access and the exam voucher run for 12 months.
- Work through the course labs fully, taking notes you could hand to a colleague. For CRTP and PNPT these notes become the backbone of your report.
- Practise reporting. For PNPT and CRTP write at least one practice report with findings, evidence, risk and remediation before the exam. For PNPT rehearse a 15-minute debrief aimed at a non-specialist audience.
- Run the exam as a project. Plan sleep and breaks: CRTO runtime can be paused within its window, CRTP is a single 24-hour block, PNPT is a working week plus two report days.
- If you fail, use the retake rules. Zero-Point Security states there is no financial penalty for failing and you may take as many attempts as you need; TCM includes one free retake; Altered Security charges per reattempt with a cooldown.
Decision table
| If you need to show... | Closest fit | Why |
|---|---|---|
| Adversary simulation within a defined threat profile | CRTO | Assumed-breach scenario, threat profile, commercial C2 in labs |
| Active Directory attack paths and their mitigations | CRTP | Multi-domain, multi-forest environment; mitigations required in submission |
| End-to-end consultancy delivery with a client deliverable | PNPT | OSINT to domain controller, written report and live debrief |
| A credential that will not need renewing | PNPT | TCM states it does not expire (since 17 April 2023) |
| The lowest entry price | CRTP (30-day option) | Lowest listed price among the three on the day checked; compare currencies |
Cost, renewal and continuing education
| Item | Red Team Operator (CRTO) | CRTP | PNPT |
|---|---|---|---|
| Entry price | GBP 399 for the Red Team Ops course, which includes an exam attempt (coupon on request) | $249 (30 days lab), $379 (60 days), $499 (90 days); each includes lifetime course material and one exam attempt | $499 for exam voucher plus training |
| Retakes | As many attempts as needed; no financial penalty for failing (provider statement) | $99 each, one-month cooldown; six-month cooldown after three attempts | One free retake included |
| Extensions | Labs and course have no expiry; lifetime access with updates | 30-day lab extension with an exam attempt, $199 | Training access and voucher valid 12 months from purchase |
| Validity | Not stated on the pages read | Expires after three years | Does not expire (TCM, as of 17 April 2023) |
| Renewal | Not stated on the pages read | Free renewal exam before expiry (renewal lab $149, extra renewal exam $29), or by earning CRTE, CETP or CRTM | Not required |
| Discounts | None noted | Seasonal sale terms | 20% for military, veterans, students, teachers and first responders with proof |
Altered Security and TCM Security show prices with a dollar sign without naming the currency; Zero-Point Security prices in pounds sterling. TCM Security also sells an Ethical Hacker Bootcamp at $2,999 that includes a PNPT voucher. None of the three operates a CPE scheme or annual maintenance fee. Fortra's acquisition release states that Red Team Operations I and II meet CREST certification standards; that is the owner's statement, and CREST's own pages were not reviewed for this guide.
Where it fits on the career path
| Stage | Typical credentials | Where these three sit |
|---|---|---|
| Entry offensive | Junior practical exams such as TCM's PJPT | Preparation for PNPT |
| Practitioner penetration testing | PNPT, OSCP, GIAC GPEN | PNPT sits here; see the OSCP Certification Guide and GIAC GPEN Guide |
| Practitioner red team and Active Directory | CRTO, CRTP | Specialisation after general penetration testing |
| Advanced | Red Team Lead (Zero-Point RTO II), CRTE (Altered Security), OSEP | Next steps named by the same providers; see the OSEP and OSWE Certification Guide |
For employers the useful question is what the candidate had to produce. A flag-based pass shows operational skill; a report and debrief also show the ability to deliver to a client. For context on the work itself see the Red Teaming Guide and the Penetration Testing Guide.
Common failure patterns
- Buying lab time before you have time: CRTP lab days run once activated; activating during a busy work month wastes them.
- Treating the report as an afterthought: PNPT gives two dedicated report days and a debrief because the deliverable is assessed; CRTP requires mitigations, not only an attack narrative.
- Relying on second-hand exam reviews: blog reviews often describe older formats, prices or expiry rules. Use the provider page.
- Reading the badge, not the exam: recruiters who equate the three miss that one is flag-based, one is Active Directory specific and one includes client communication.
- Letting CRTP lapse: renewal is free before expiry, but costs lab time and fees if you need refresher access.
Practitioner checklist
- Write down the role you are aiming for and choose the certification whose exam output matches it.
- Read the provider's current course and exam pages on the day you buy; save a copy of the terms.
- Check included attempts, retake fees and cooldowns before you book.
- Schedule lab activation only when you have study time blocked.
- Produce at least one practice report with mitigations before any report-based exam.
- Plan the exam window like a project, including rest.
- Record any expiry date and the renewal options that apply.
- Keep all practice within authorised lab environments.
Standards and references
- Zero-Point Security: Red Team Ops exam information
- Zero-Point Security: Red Team Ops course
- Zero-Point Security: Exams
- Zero-Point Security: FAQ
- Fortra: Fortra acquisition of Zero-Point Security
- Altered Security: Attacking and Defending Active Directory Lab (CRTP)
- TCM Security: Practical Network Penetration Tester (PNPT)
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Cybersecurity Careers Guide · Red Teaming Guide · OSCP Certification Guide