CREST CRT
CREST Registered Penetration Tester
The CREST Registered Penetration Tester is a practical, UK-oriented certification that has established itself as an important industry standard for penetration testers, particularly in the UK market and for organizations with CHECK requirements. Unlike purely theory-based certifications, the CRT exam includes a technical, partially practical component in a controlled test environment. The combination of multiple-choice, flags, and short answers distinguishes CRT from pure CTF formats like OSCP. Outside the UK and Australia, market penetration is limited; internationally, OSCP is significantly better known. However, for testers seeking to work in the UK public sector or at CREST-accredited firms, CRT is effectively mandatory.
› Quality score
Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.
› Exam format
Practical-based: Infrastructure penetration test in controlled environment + multiple-choice. 1 day.
30-day wait typical. Practical components may require longer waits.
› Recertification
Valid for 3 years. Renewal via proof of current activity + CPD.
› NICE Framework work roles
The NIST NICE work-role IDs this cert maps to. NICCS lookup.
› Core domains covered
The 1 domain this cert is centrally about. Passing the exam demonstrates working knowledge of each.
› Prerequisites
CREST CPSA or equivalent. Recommended: 2+ years pentest experience.
› Careers that commonly pursue this cert
Analyze adversary behavior, track threat actors, and produce actionable intelligence that drives defensive decisions.
See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.