CRTO

Passed the Certified Red Team Operator on June 15, 2026. Verifiable credential.

the cert

CRTO is Zero-Point Security’s red team course and exam, built around Cobalt Strike as the C2. It covers the full chain: initial access, host and Active Directory enumeration, privilege escalation, lateral movement, persistence, and exfil. The AD tradecraft is the heart of it, Kerberos abuse, delegation, trusts, and AD CS.

the exam

Hands-on in a live Windows domain. No multiple choice, no theory. You get lab access and a set of objectives, and you work the environment until you’ve pulled what the exam asks for. It’s less about knowing the commands and more about keeping a foothold and moving laterally without tripping over your own tooling.

CRTL was the obvious next step.