CRTP
Certified Red Team Professional
Hands-on Active Directory attacker — Kerberos abuse, trust attacks, and lateral movement against a real multi-domain forest.
› Quality score
Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.
› Market signals
public, citable inputs to the recognition scoreVendor doesn't publish exact holder counts; estimate based on community indicators.
› Built for these roles
› Exam format
24-hour hands-on lab exam against a multi-domain Windows AD forest, followed by 48 hours to submit a written report. Five flag captures required across enumeration, privilege escalation, and cross-domain compromise.
› Recertification
Credential is permanent — no recertification or AMF.
› NICE Framework work roles
The NIST NICE work-role IDs this cert maps to. NICCS lookup.
› Core domains covered
The 2 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.
Methodology (OSSTMM, PTES), web/network/mobile pentesting, social engineering, purple teaming.
AuthN/AuthZ, SSO, MFA, PAM, RBAC/ABAC, identity governance, FIDO2/passkeys, plus non-human identity: service accounts, workload identity, agent / plugin identities.
› Also touched
Present in the blueprint but not the primary focus — you’ll be introduced but shouldn’t expect depth.
Firewalls, IDS/IPS, network segmentation, DNS security, SD-WAN, VPN, traffic analysis, wireless security.
SIGMA/YARA/Suricata rule writing, hypothesis-driven hunting, log deep-dives, detection gap analysis.
AI-assisted pentesting, automated recon, AI-generated phishing/social engineering, deepfake attacks.
› Prerequisites
Comfort with Windows command line, PowerShell, and basic AD concepts. Prior pentesting exposure recommended but not strictly required — the course covers fundamentals.
- Active Directory objects, trusts, and Kerberos
- PowerShell scripting basics
- Windows privilege model and tokens
› Progression
requiredrecommendedWhere this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.
No vendor-gated prereqs.
No certs require this one.
› Careers that commonly pursue this cert
External-first role: inventories what an attacker can see, tracks what's new, and drives closure through the org. The outside-in counterpart to vuln management.
See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.