CRTE
Certified Red Team Expert
Multi-forest AD compromise — cross-trust abuse, advanced delegation, and persistence in hardened enterprise environments.
› Quality score
Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.
› Market signals
public, citable inputs to the recognition scoreVendor doesn't publish exact counts; conservative estimate from community cohort signals.
› Built for these roles
› Exam format
48-hour hands-on lab exam against a multi-forest enterprise environment with EDR-style controls. Report submission within 48 hours of lab close. Multiple flags across forest trusts and tier-0 compromise required.
› Recertification
Credential is permanent — no recertification or AMF.
› NICE Framework work roles
The NIST NICE work-role IDs this cert maps to. NICCS lookup.
› Core domains covered
The 2 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.
Methodology (OSSTMM, PTES), web/network/mobile pentesting, social engineering, purple teaming.
AuthN/AuthZ, SSO, MFA, PAM, RBAC/ABAC, identity governance, FIDO2/passkeys, plus non-human identity: service accounts, workload identity, agent / plugin identities.
› Also touched
Present in the blueprint but not the primary focus — you’ll be introduced but shouldn’t expect depth.
Firewalls, IDS/IPS, network segmentation, DNS security, SD-WAN, VPN, traffic analysis, wireless security.
SIGMA/YARA/Suricata rule writing, hypothesis-driven hunting, log deep-dives, detection gap analysis.
AI-assisted pentesting, automated recon, AI-generated phishing/social engineering, deepfake attacks.
› Prerequisites
Solid AD-attack fundamentals — CRTP-level knowledge or equivalent operational experience. Familiarity with multiple C2 frameworks helpful.
- Active Directory trusts, ADCS, and delegation
- Lateral movement and persistence techniques
- Bypassing common Windows security controls (AMSI, AppLocker)
› Progression
requiredrecommendedWhere this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.
No vendor-gated prereqs.
No certs require this one.
No follow-on certs reference this one yet.
See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.