Certified Red Team Professional (CRTP)
The Certified Red Team Professional (CRTP) course equips security analysts and penetration testers with advanced Active Directory attack skills to address the critical shortage of hands-on red team expertise, with 90% of Fortune 1000 companies relying on AD. It delivers practical mastery in domain privilege escalation, cross-forest attacks, and defense bypassing through a real-world lab environment.
Prepare for the hands-on CRTP certification exam with lifetime access to course materials and 30-day lab access. Koenig’s Guaranteed-to-Run scheduling ensures timely training, empowering professionals to validate elite red team skills and advance into senior offensive security roles.
Training Formats & Pricing
100% Happiness Guarantee · Free Rescheduling · Secure Payment
Course Overview
The Certified Red Team Professional (CRTP) by Open Source is a hands-on cybersecurity certification designed for penetration testers, red team operators, and offensive security engineers seeking mastery in Active Directory exploitation. This course prepares candidates for the CRTP certification exam, which challenges them to compromise a fully patched enterprise environment using feature abuse rather than traditional exploits. With over 90% of Fortune 1000 companies relying on Active Directory, demand for professionals with validated red team skills continues to grow, making this certification highly relevant for roles focused on adversary emulation and enterprise security assessments.
Students engage with a realistic lab environment built on Server 2022 and SQL Server 2017, accessible via browser or VPN, where they perform attacks using tools like BloodHound, PowerView, Mimikatz, and Sliver C2. The curriculum emphasizes "Living Off the Land" techniques, teaching students to leverage trusted OS features such as .NET and PowerShell for enumeration, privilege escalation, and persistence. A key hands-on component involves achieving OS-level command execution across five target servers within a multi-domain Active Directory infrastructure, simulating real-world red team operations including Kerberoasting, ACL abuse, trust attacks, and bypassing defenses like Windows Defender and Microsoft Defender for Endpoint.
Earning the Certified Red Team Professional (CRTP) certification validates practical skills recognized by government agencies, defense contractors, and major consulting firms. Professionals holding this credential see an average salary increase of 10%, with roles such as red team analyst and offensive security engineer commanding between $80,000 and $180,000 annually. At Koenig Solutions, learners benefit from official courseware, Guaranteed-to-Run batches, and expert-led training that builds directly on CRTP’s foundational attack lifecycle—equipping them to advance into senior red team and enterprise security specialist roles with confidence.
Prerequisites
- To succeed in the Certified Red Team Professional (CRTP) by Pentester Academy, students must possess a strong foundation in Active Directory concepts, including Kerberos delegation, GPO abuse, and ACL misconfigurations.
- Proficiency in Windows command-line environments is required, specifically for executing native tools and leveraging utilities like Mimikatz and PowerView for post-exploitation.
- Advanced experience with PowerShell scripting is essential for automating complex attack chains and interacting with Active Directory environments during lab exercises.
- A solid understanding of TCP/IP, DNS, and Windows networking is vital for navigating the lab environment, which utilizes Windows 10 and Windows Server 2019 systems.
- Familiarity with the MITRE ATT&CK framework is necessary to effectively map and execute adversary techniques covered throughout the CRTP curriculum.
- Practical experience with penetration testing methodologies and tools, such as BloodHound for domain reconnaissance and path analysis, is required to identify and exploit security weaknesses within the lab.
Certification Exam
Everything you need to know about the Certified Red Team Professional (CRTP) certification exam
What's Included in Your Training
Every enrollment comes packed with resources to maximise your learning and exam success
Exam Preparation Materials
Practice Test Questions (200+)
Certificate of Completion
Post-Training Support (30 days)
Session Recording Access
Free Rescheduling (7+ days notice)
Career Outcomes
of Certified Red Team Professional (CRTP) certified professionals report career advancement within 6 months
Salary Impact
Average salary increase reported after obtaining the Certified Red Team Professional (CRTP) certification
*Source: Glassdoor / LinkedIn 2025
Job Roles
- Certified Red Team Professional (CRTP) Operator
- Professional Penetration Tester
- Offensive Security Engineer
- Adversary Emulation Specialist
- Red Team Analyst
- Active Directory Security Specialist
Companies Hiring
and 5,000+ organizations worldwide seeking Certified Red Team Professional (CRTP) certified professionals
Course Student Reviews
Real results from IT professionals who trained with Koenig — rated 4.9/5 from 18,400+ verified reviews.
-
★★★★★
“Passed AZ-104 on first attempt. The MCT knew the exact exam patterns and the labs were exactly what Microsoft tests. Worth every penny.”
AZ-104 Certified ✓ Verified -
★★★★★
“I trained 15 of my team members for SC-200. Koenig's on-site delivery was seamless and all 15 passed within 3 months.”
Enterprise Client ✓ Verified -
★★★★★
“The 1-on-1 format was a game changer. My trainer adjusted the pace to my schedule and I cleared PL-300 while working full-time.”
PL-300 Certified ✓ Verified -
★★★★★
“From AZ-900 to AZ-305 in 6 months. Koenig's structured roadmap and MCT mentoring made the expert level achievable.”
AZ-305 Expert ✓ Verified -
★★★★★
“As an L&D head I've used 5 training vendors. Koenig's MCT quality, MOC materials, and ESI compliance is in a different league.”
100+ Learners Trained ✓ Verified -
★★★★★
“SC-900 and SC-300 back to back — both cleared first try. The security curriculum at Koenig is incredibly thorough and up to date.”
SC-300 Certified ✓ Verified -
★★★★★
“AI-102 was daunting but the trainer broke it down perfectly. Real Azure OpenAI labs made the difference. Highly recommend.”
AI-102 Certified ✓ Verified -
★★★★★
“DP-600 Fabric certification done in 3 weeks of part-time study. The customised schedule around my timezone was a lifesaver.”
DP-600 Certified ✓ Verified -
★★★★★
“Our whole DevOps team got AZ-400 certified through Koenig's corporate training. Smooth logistics and top-tier MCTs throughout.”
AZ-400 Team Training ✓ Verified -
★★★★★
“Passed AZ-104 on first attempt. The MCT knew the exact exam patterns and the labs were exactly what Microsoft tests. Worth every penny.”
AZ-104 Certified ✓ Verified -
★★★★★
“I trained 15 of my team members for SC-200. Koenig's on-site delivery was seamless and all 15 passed within 3 months.”
Enterprise Client ✓ Verified -
★★★★★
“The 1-on-1 format was a game changer. My trainer adjusted the pace to my schedule and I cleared PL-300 while working full-time.”
PL-300 Certified ✓ Verified -
★★★★★
“From AZ-900 to AZ-305 in 6 months. Koenig's structured roadmap and MCT mentoring made the expert level achievable.”
AZ-305 Expert ✓ Verified -
★★★★★
“As an L&D head I've used 5 training vendors. Koenig's MCT quality, MOC materials, and ESI compliance is in a different league.”
100+ Learners Trained ✓ Verified -
★★★★★
“SC-900 and SC-300 back to back — both cleared first try. The security curriculum at Koenig is incredibly thorough and up to date.”
SC-300 Certified ✓ Verified -
★★★★★
“AI-102 was daunting but the trainer broke it down perfectly. Real Azure OpenAI labs made the difference. Highly recommend.”
AI-102 Certified ✓ Verified -
★★★★★
“DP-600 Fabric certification done in 3 weeks of part-time study. The customised schedule around my timezone was a lifesaver.”
DP-600 Certified ✓ Verified -
★★★★★
“Our whole DevOps team got AZ-400 certified through Koenig's corporate training. Smooth logistics and top-tier MCTs throughout.”
AZ-400 Team Training ✓ Verified
-
★★★★★
“Passed AZ-104 on first attempt. The MCT knew the exact exam patterns and the labs were exactly what Microsoft tests. Worth every penny.”
AZ-104 Certified ✓ Verified -
★★★★★
“I trained 15 of my team members for SC-200. Koenig's on-site delivery was seamless and all 15 passed within 3 months.”
Enterprise Client ✓ Verified -
★★★★★
“The 1-on-1 format was a game changer. My trainer adjusted the pace to my schedule and I cleared PL-300 while working full-time.”
PL-300 Certified ✓ Verified -
★★★★★
“Passed AZ-104 on first attempt. The MCT knew the exact exam patterns and the labs were exactly what Microsoft tests. Worth every penny.”
AZ-104 Certified ✓ Verified -
★★★★★
“I trained 15 of my team members for SC-200. Koenig's on-site delivery was seamless and all 15 passed within 3 months.”
Enterprise Client ✓ Verified -
★★★★★
“The 1-on-1 format was a game changer. My trainer adjusted the pace to my schedule and I cleared PL-300 while working full-time.”
PL-300 Certified ✓ Verified
-
★★★★★
“From AZ-900 to AZ-305 in 6 months. Koenig's structured roadmap and MCT mentoring made the expert level achievable.”
AZ-305 Expert ✓ Verified -
★★★★★
“As an L&D head I've used 5 training vendors. Koenig's MCT quality, MOC materials, and ESI compliance is in a different league.”
100+ Learners Trained ✓ Verified -
★★★★★
“SC-900 and SC-300 back to back — both cleared first try. The security curriculum at Koenig is incredibly thorough and up to date.”
SC-300 Certified ✓ Verified -
★★★★★
“From AZ-900 to AZ-305 in 6 months. Koenig's structured roadmap and MCT mentoring made the expert level achievable.”
AZ-305 Expert ✓ Verified -
★★★★★
“As an L&D head I've used 5 training vendors. Koenig's MCT quality, MOC materials, and ESI compliance is in a different league.”
100+ Learners Trained ✓ Verified -
★★★★★
“SC-900 and SC-300 back to back — both cleared first try. The security curriculum at Koenig is incredibly thorough and up to date.”
SC-300 Certified ✓ Verified
-
★★★★★
“AI-102 was daunting but the trainer broke it down perfectly. Real Azure OpenAI labs made the difference. Highly recommend.”
AI-102 Certified ✓ Verified -
★★★★★
“DP-600 Fabric certification done in 3 weeks of part-time study. The customised schedule around my timezone was a lifesaver.”
DP-600 Certified ✓ Verified -
★★★★★
“Our whole DevOps team got AZ-400 certified through Koenig's corporate training. Smooth logistics and top-tier MCTs throughout.”
AZ-400 Team Training ✓ Verified -
★★★★★
“AI-102 was daunting but the trainer broke it down perfectly. Real Azure OpenAI labs made the difference. Highly recommend.”
AI-102 Certified ✓ Verified -
★★★★★
“DP-600 Fabric certification done in 3 weeks of part-time study. The customised schedule around my timezone was a lifesaver.”
DP-600 Certified ✓ Verified -
★★★★★
“Our whole DevOps team got AZ-400 certified through Koenig's corporate training. Smooth logistics and top-tier MCTs throughout.”
AZ-400 Team Training ✓ Verified
Frequently Asked Questions
Everything you need to know about the Certified Red Team Professional (CRTP) training course
Is the Certified Red Team Professional (CRTP) certification exam included in the course fee, and what is the cost?
What training formats does Koenig offer for the Certified Red Team Professional (CRTP), and is there a Guaranteed-to-Run option?
How long is lab access provided for the Certified Red Team Professional (CRTP), and what type of environment is used?
What is the rescheduling and cancellation policy for the Certified Red Team Professional (CRTP) exam?
What is the format, duration, and passing requirement of the Certified Red Team Professional (CRTP) exam?
How long is the Certified Red Team Professional (CRTP) certification valid, and what is the renewal process and cost?
What post-training support is available after completing the Certified Red Team Professional (CRTP) course?
What are the prerequisites or recommended experience levels for attempting the Certified Red Team Professional (CRTP)?
What salary increase or career advancement can professionals expect after earning the Certified Red Team Professional (CRTP)?
How does the Certified Red Team Professional (CRTP) compare to self-study in terms of skill development and certification readiness?
Still have questions?
Chat with a Training Advisor →Happiness Guarantee
We are so confident in the quality of our training that we offer a full money-back guarantee. Not satisfied? Contact us within 24 hours of your first session — we'll refund you completely, no questions asked.