What the course covers
About this course map
CRTO — Certified Red Team Operator — is Zero-Point Security's course, and it is the one that teaches red teaming as an operation rather than a penetration test. The difference matters. A penetration test finds vulnerabilities; a red team tests whether a defended organisation can detect and respond to a realistic adversary. CRTO is built around a command-and-control framework, and its whole emphasis is on operating quietly against a monitored environment with a modern EDR watching.
It has become one of the most respected practical red-team certifications precisely because it is honest about the modern defensive stack. You do not just get a shell; you get a shell past defences that are designed to catch shells, and you keep it while blending into the noise. The tradecraft — sleep, jitter, in-memory execution, avoiding the telemetry EDR watches — is the actual subject.
The exam is a practical against a defended Active Directory lab, where reaching the objective means doing so without being trivially caught.
Module 01 — Red-team operations and infrastructure
The frame and the plumbing before the attack.
Module 02 — Initial access and payload delivery
Getting the first beacon into a defended environment.
Module 03 — Host reconnaissance and defence awareness
Learning the environment without alerting it.
Module 04 — Evading endpoint detection
The core skill: doing what you need while EDR watches.
Module 05 — Privilege escalation and credential access
Escalating without tripping the sensors that watch for exactly this.
Module 06 — Active Directory attack and lateral movement
Moving through the domain as an operator, quietly.
Module 07 — Persistence and acting on objectives
Staying in, and completing the mission.
Module 08 — Operating as a team
Red teaming is rarely solo — the operational discipline of it.
Exam & certification
- 1Train with us instructor-led preparation, labs and practice questions.
- 2Sit the official examExam voucher sold separately. We buy it from the certification body on your behalf and send you the code — you book your own exam date.
- 3Get certifiedThe certification is awarded by Zero-Point Security when you pass their exam.
What you receive
- Zero-Point Security certification — issued by Zero-Point Security after you pass, and verifiable with them.
- Hacky Security certificate of completion — for the training itself, with a unique ID.
- Checkable by employers — anyone can confirm our certificate on the Verify page.
This course is Hacky Security’s own preparation training. The certification itself is awarded by Zero-Point Security, not by us.
Similar courses
Independent preparation training delivered from Hacky Security's own curriculum. Hacky Security is not affiliated with or endorsed by the certification body named above. Certification names and codes are the trademarks of their respective owners and are used only to describe what this course prepares you for.
