| Category | Rating |
|---|---|
| Course Quality | ⭐⭐⭐⭐⭐ |
| Lab environment | ⭐⭐⭐⭐ |
| Exam Fairness | ⭐⭐⭐⭐⭐ |
| Value For Money | ⭐⭐⭐⭐⭐ |
| Career Impact | ⭐⭐⭐⭐ |
| Overall | 4.6/5 |
Every few months, someone in a Discord server asks the same question: Should I do CRTP or just go straight to OSCP? I used to scroll past those threads. Then, I did CRTP, and now I have considerably more to say about it. The trust is that the Certified Red Team Professional (CTRP) certification is probably the most underrated IT certification in offensive security right now. Not because it carries the name recognition of OSCP, but because it teaches you something that most pentesting courses treat as an afterthought: Active Directory. The technology sits at the center of almost every enterprise network on the planet, and the one that shows up in the majority of real-world breaches.
I went in expecting a solid beginner course. I came out with a fundamentally different way of thinking about enterprise environments. That gap between expectation and outcome is exactly what this review is about. I will cover the course content, the lab experience, the exam, how it compares to OSCP and PNPT, and whether it actually does anything useful for your career.
What Is The CRTP Certification?
CRTP, or Certified Red Team Professional, is a beginner-level hands-on red team certification by Altered Security built entirely on one thing: Active Directory security. Not web apps, not cloud infrastructure, not binary exploitation. Just AD, and it goes very deep.
The CRTP Course
The course is built and taught by Nikhil Mittal, the author of Nishang and a speaker at DEF CON and Black Hat. That pedigree matters more than it might seem. This is not a certification assembled by a content team chasing market demand. It was built by someone who has spent years doing Active Directory penetration testing at a serious level and who understands, with real precision, where enterprise environments break and why.
And what I did not expect going in was how much the course would change my thinking rather than just my toolset. Most certifications hand you a toolkit and show you how to swing it. CRTP explains the underlying mechanism behind every technique, which means you actually understand what you are doing.
Who Should Take CRTP And Who Should Wait?
While the CRTP certification may be beginner-friendly, it still isn’t a good choice for everyone. Here is a breakdown of who I think should pursue this certification and who shouldn’t:
Take CRTP if you:
- Have basic Windows and AD knowledge and want structured, lab-based learning
- Are working toward OSCP, CRTE, or PACES, and want a solid AD foundation before you get there
- Work in or want to move into enterprise pentesting, where AD is the environment, not the exception
- Want a certification that reflects real-world conditions rather than a CTF environment built around outdated exploits.
Hold off if you:
- Have zero IT background. Start with eJPT or CompTIA Security+ and come back.
- Want C2 framework training with tools like Cobalt Strike
- Need a certification that HR keyword filters will recognize at a compliance-heavy organization. This is still CEH territory, for better or worse.
The prerequisites list on the official page is short. The implied prerequisites are a bit longer. If you have never heard of a domain controller or cannot explain what Kerberos does on a basic level, spend a week on the fundamentals first. You will get dramatically more out of every module if you do.
Read More: Information Security vs Cyber Security: Which One is Best
What Does The CRTP Course Actually Cover?
Here is where your $249 USD goes. The CRTP course content is built around one core insight: enterprises do not get compromised because someone found and unpatched a CVE on the perimeter. They get compromised because of how Active Directory was configured and misconfigured over the years of organic growth and rushed deployments. Every module reflects that reality.
➔ Domain Enumeration With PowerView and BloodHound
You cannot attack what you cannot see. CRTP spends serious time here before a single exploit runs. BloodHound maps the big picture: trust relationships, attack paths, accessible machines. PowerView handles the granular querying that BloodHound does not visualize. I will be honest, I underestimated this part of the course going in. Enumeration may feel unglamorous compared to the attack techniques. But the discipline of mapping before moving is what separates clean, confident engagements from messy ones, and CRTP drills it in early.
➔ Kerberaosting, AS-REP Roasting and Lateral Movement
Service accounts with weak passwords are practically a tradition in enterprise AD. Kerberoasting exploits exactly that, offline, with no special privileges required. What makes the CRTP treatment stand out is that Nikhil explains the Kerberos authentication flow behind each technique. Unconstrained delegation tripped me up the first time. CRTP is the first resource that actually made it click.
➔ DCSync, Trust Attacks, and Persistence
Domain trust attacks across ulti forest environments, DCSync without touching the domain controller, Golden and Silver Ticket persistence; this is where the course starts feeling advanced. It also happens to be where real enterprise engagement is won or lost.
➔ Active Directory Certificate Service Abuse
This one genuinely caught me off guard. ACDS abuse covering ESC1 through ESC8 is one of the most underappreciated attack surfaces in enterprise security right now, and I was not expecting a $249 certification to go this deep into it. That module alone made the course worth it for me.
The CRTP Lab: What Is It Actually Like?
The lab is honestly where CRTP earns its money. You can watch every video and follow along perfectly, but the real learning kicks in when you are an hour deep into a lab session, something is not working, and you have to think your way through it. That friction is intentional. It is also the best exam preparation you can get.
The environment itself is a multi-domain setup. Think of it as a simulated company network, with multiple departments and offices that all connect to each other. It runs on Windows Server 2022, which is the same software most enterprise companies use today. Everything you need is pre-installed and ready to go the moment you connect. No spending your first evening trying to get tools to work.
The One Heads Up Nobody Mentions
The VPN connection, which is the tunnel that connects you to the lab, can be a little temperamental at times. Nothing that will derail your learning, but keep a local copy of your notes and commands rather than relying on copy and paste inside the lab sessions. Learned that one the mildly frustrating way.
How Long Should You Buy The Lab For?
You get three options: 30, 60, or 90 days. Here is the honest guidance:
- 30 days works only if you can dedicate serious, focused time every single day. Tight for anyone with a job or other commitments.
- 60 days is the sweet spot. Enough time to be thorough without so much breathing room that you lose momentum.
- 90 days sounds comfortable, but that comfort can quietly become your enemy. Too easy to drift.
Most people who pass pick 60 days. That recommendation holds up, considering that’s what I chose as well. I actually finished with about a week to spare, which I used entirely for exam run-throughs rather than new material. That buffer felt valuable.
On-Demand or Bootcamp: Which One Should You Pick?
The on-demand option at $249 USD gives you full course access at your own pace. It suits people who are self-disciplined and prefer to work on their own schedule. I went with the on-demand route, and it worked well, but I will say there were moments where being able to ask a question in real-time would have saved me a solid hour of going in circles.
The bootcamp at $299 USD adds four instructor-led weekends with Nikhil himself. That extra $50 gets you live sessions, real-time Q&A, and a cohort of peers going through it alongside you. If accountability is something you struggle with when learning solo, the bootcamp is worth every penny of the difference. If I were starting over, I would probably go bootcamp just for the peer interaction alone.
The Module Most People Skip
The blue team modules, which are sections that show you how defenders, meaning the security teams trying to catch attackers, actually see your activity. I almost skipped these on my first pass through the course. I am genuinely glad I did not.
Understanding what alerts you trigger when you run certain techniques completely changes how you approach them. It is a level of awareness that most offensive security courses at this price point do not offer, and it is one of the reasons CRTP produces better practitioners.
The CRTP Exam Experience
Here is what the CRTP exam actually looks like in practice.
What The CRTP Exam Looks Like
You get a 24-hour window. Inside that window, you have one starting machine and five target machines to work through. Your goal on each target is to get operating system-level access, meaning enough control over that machine to run commands on it. No multiple choice questions, no theory. Just you and the network.
Nothing in the exam requires finding software vulnerabilities or unpatched bugs. Every path through it comes from misconfigurations, which is exactly what the lab trains you on. Walking into the exam after proper lab time, the environment felt less like an unknown and more like a familiar type of problem. That familiarity is everything.
The Part Everyone Forgets About
After your 24 hours end, you get an additional 48 hours to write and submit your report. This catches a lot of people off guard because they spend the whole exam focused on the technical side and then suddenly have a report to write with tired eyes and a foggy head.
The fix? Take clean notes throughout the exam as you go, screenshot everything that matters, and the report mostly writes itself at the end. I structured my notes during the exam as if I was already writing the report. By the time my session ended, I had maybe two hours of actual writing left rather than starting from scratch.
CRTP vs OSCP vs PNPT: Which One Is Right For You?
| CRTP | OSCP | PNPT | |
| Main Focus | Active Directory attacks | Broad pentesting | Practical network pentesting |
| Price | $249 | $1,600 | $499 |
| Exam Length | 24 Hours | 24 Hours + Report | 5 days |
| Beginner-friendly | Yes | Moderate | Yes |
| HR Recognition | Growing fast | Industry standard | Growing |
Discover More: PNPT VS OSCP: Which one to pursue in 2026?
➔ Pick CRTP
If you want the deepest possible foundation in Active Directory at the lowest possible cost. It is also the best preparation for OSCP that exists at this price point since the skills you build here carry over directly, and you will feel it when you get there.
➔ Pick OSCP
If you need a single certification that opens doors at big consultancies or enterprise security teams. It is the industry standard for a reason. It is also six times the price of CRTP and covers Active Directory at a noticeably shallower level, which surprised me when I compared the two curriculum side by side.
➔ Pick PNPT
If you want a well-rounded, practical certification, and Active Directory depth is not your main goal right now. It sits in a solid middle ground and is growing in recognition quickly. Good option, just a different destination.
My Suggestion
If you are early in your offensive security career, do CRTP first. The foundation it builds makes you better at OSCP, better at PNPT, and better on real engagements. It is not the budget option for people who cannot afford the others. It is genuinely the right starting point for anyone whose work involves enterprise Windows environments, which is most corporate security work when you actually look at what engagements involve day to day.
If you later want to get into C2 frameworks, tools like Cobalt Strike that advanced red teams use to manage complex attack operations, look at CRTO after CRTP. These two complement each other well, and the progression feels natural.
To learn more about OSCP, check out:
OSCP+ Guide: Proven Strategies to Elevate Your Cybersecurity Skills In 2026
How Much Does The OSCP Certification Cost In 2026?
The Lucrative Career Path: Unlocking the OSCP Salary Potential
Does CRTP Actually Help Your Career?
I believe it depends on what you are expecting it to do for you.
If you are hoping CRTP alone gets you a senior red team role at a Big 4 consultancy, it will not. That is not a knock on the certification. It’s just not what it is designed for. CRTP is a foundation, and foundations work best when you build on them deliberately.
What The Job Market Actually Says
Here is something worth knowing. CRTP shows up in job listings next to OSCP and OSCE, certifications that cost significantly more and carry significantly more name recognition. For $249, that is a remarkable company to keep, and it tells you something real about how the market perceives the skillset this course builds.
Roles that specifically ask for Active Directory attack skills, such as penetration tester, red team analyst, offensive security engineer, sit somewhere between $80,000 and $180,000 USD, depending on where you are, how senior you are, and whether clearance is involved. That range has stayed strong because the underlying problem has not gone away. Over 90% of large enterprises run Active Directory. The attack surface is not shrinking, and neither is the demand for people who understand it properly.
5 Things I Wish I Knew Before Starting CRTP Certification
Build Your Notes
The exam is open-note. I treated my notes like a personal reference guide from day one. Every technique, every dead end, every command that worked, and why. By exam day, my notes were doing half the work. The people who struggle are rarely short on skill. They are short on organized documentation.
Map The Environment Before Touching Anything
Run BloodHound first, every single time. I skipped this early in the lab because I was impatient to get to the attack techniques. I spend an embarrassing amount of time going in circles that four minutes of BloodHound would have resolved entirely.
Sixty Days Is The Sweet Spot
Thirty days is tight. Ninety days creates so much breathing room that drifting becomes easy. I finished sixty days with about a week to spare and used it entirely for exam run-throughs. That buffer made a real difference when walking into the exam.
Do Not Skip The Defense Modules
Understanding how defenders see your activity changes how you execute attacks. You become quieter, more deliberate, more effective. I almost skipped these on my first pass. Genuinely glad I did not.
The Exam Rewards Methodology
I hit a wall about six hours in where one target was not cooperating. The temptation to piral was real. Going back to the methodology the course builds and working through it step by step is what got me through. It works. Trust it.
My Verdict On The CRTP Certification
What I Think CRTP Gets Right
The course is built by someone who genuinely does this work at a high level, and that shows throughout. The AD depth at this price is unmatched. The exam is fair and practical. The ADCS module alone, covering a track path that appears constantly in real enterprise environments, is worth the price on its own.
Where I Feel It Could Improve
Lab connectivity can be unreliable at times, which is frustrating when hands-on practice is the entire point. The scope is also narrow by design, since it’s purely AF and has no web apps or cloud.
Final Rating: 4.6 out of 5
At $249, CRTP is the best value Active Directory certification available right now. It is not trying to be everything, but it tries to build a deep, practical understanding of how enterprise environments get compromised. It does that better than anything else at this price point.
The only thing cheaper than doing CRTP is doing nothing. In this field, that is genuinely the most expensive option of all.
Frequently Asked Questions (FAQs)
Is the CRTP Certification Worth It In 2026?
Yes. At an affordable price, the depth of Active Directory training is unmatched at this price point. The only exception is if you have zero IT background.
How hard is the CRTP exam?
The CRTP exam is harder than you expect if you skipped the labs. It can be more manageable if you spend sufficient time with labs. The difficulty is almost entirely determined by how seriously you treated the lab phase.
Can a beginner take CRTP?
You can, but you will get far more out of it with basic Windows and networking knowledge first. The course builds on foundations rather than creating them.
