CRTO — Certified Red Team Operator Preparation Training

About this course map

CRTO — Certified Red Team Operator — is Zero-Point Security's course, and it is the one that teaches red teaming as an operation rather than a penetration test. The difference matters. A penetration test finds vulnerabilities; a red team tests whether a defended organisation can detect and respond to a realistic adversary. CRTO is built around a command-and-control framework, and its whole emphasis is on operating quietly against a monitored environment with a modern EDR watching.

It has become one of the most respected practical red-team certifications precisely because it is honest about the modern defensive stack. You do not just get a shell; you get a shell past defences that are designed to catch shells, and you keep it while blending into the noise. The tradecraft — sleep, jitter, in-memory execution, avoiding the telemetry EDR watches — is the actual subject.

The exam is a practical against a defended Active Directory lab, where reaching the objective means doing so without being trivially caught.

Module 01 — Red-team operations and infrastructure

The frame and the plumbing before the attack.

Module 02 — Initial access and payload delivery

Getting the first beacon into a defended environment.

Module 03 — Host reconnaissance and defence awareness

Learning the environment without alerting it.

Module 04 — Evading endpoint detection

The core skill: doing what you need while EDR watches.

Module 05 — Privilege escalation and credential access

Escalating without tripping the sensors that watch for exactly this.

Module 06 — Active Directory attack and lateral movement

Moving through the domain as an operator, quietly.

Module 07 — Persistence and acting on objectives

Staying in, and completing the mission.

Module 08 — Operating as a team

Red teaming is rarely solo — the operational discipline of it.