Skip to content
CertGPS

Certified Red Team Operator

Proves you can run adversary simulation with Cobalt Strike; the £399 course includes unlimited free exam attempts

AdvancedZero-Point Security

The exam

Exam cost
$529
Study time
3-6 months
Passing score
Not published publicly
Valid for
Does not expire

Before you book

  • None published by Zero-Point Security
  • Course pitched at CREST Practitioner level (0–2 years' experience)
  • Exam available 7 days after purchase

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

    • Director of Red Team
    • VP of Offensive Security

Where it leads

  1. OffSec Certified Professional

    Advanced

    Comes before. Builds exploitation and Active Directory basics before you learn to run them through C2

  2. Certified Red Team Operator

    You are here

Study guide

Last updated

CRTO Study Guide: Red Team Ops on Its New Platform, Now Part of Fortra

The Certified Red Team Operator (CRTO) is the certification attached to Red Team Ops, Zero-Point Security's course in adversary simulation with Cobalt Strike. The course has moved from its old training site to www.zeropointsecurity.co.uk, so old links fail, and in 2026 Fortra, which also owns Cobalt Strike, bought Zero-Point Security. The price is £399, with as many exam attempts as you need.

Who should take it

Red Team Ops suits penetration testers who can already compromise an Active Directory network and want to learn how a red team runs the same attack through a command-and-control (C2) framework while staying quiet. It also suits SOC and detection engineers who want to see Cobalt Strike from the operator's seat. Zero-Point Security rates the course at its Practitioner level, which it aligns with CREST and describes as foundation level for people with zero to two years' experience. It doesn't publish formal prerequisites.

That label undersells it if you've never attacked Active Directory. In that case, start with CPTS or OSCP and come back. If you want to bypass hardened defences in depth and need a better-known credential, OSEP goes further on evasion. Red Team Ops II, Zero-Point's next course, leads to its Red Team Lead certification.

CRTO at a glance

CRTO
FormatPractical lab exam run with Cobalt Strike (Zero-Point doesn't publish the format on its public site)
Price£399 for course, labs and exam, adjusted at checkout for purchasing power parity (about $529 at mid-October 2026 rates); £765 bundled with Red Team Ops II
AttemptsUnlimited and free; the first can't be taken until 7 days after purchase
CourseAbout 20 hours of study and more than 20 hands-on labs, with a licensed copy of Cobalt Strike provided
AccessLifetime access to the course and its updates, with no lab expiry
PrerequisitesNone published; Practitioner level (0 to 2 years)
ValidityDoes not expire

What the course and exam cover

Zero-Point Security describes the course in one sentence, as the skills "to excel in performing adversary simulation and emulation exercises with Cobalt Strike", and doesn't post a syllabus or domain weights publicly. Ashok Chapagai's May 2026 review of the current course lists its sections: a red teaming primer with legal considerations, initial access, reconnaissance, post-exploitation, privilege escalation, persistence, lateral movement, domain dominance and trust abuse, and defence evasion.

The exam format has changed. Jeffrey Bencteux's 2022 review describes the old format: 48 hours of lab time over four days, with six of eight flags needed to pass. Reviews of the current version, by Chapagai and by a reviewer writing on raynus.wordpress.com in April 2026, describe 24 hours of lab time that can be paused within a seven-day window, no flags, and a 100-point score split evenly between completing the objective and operational security (OPSEC). Both report a pass mark of 85. Zero-Point Security doesn't confirm these figures publicly, so check the exam instructions you receive after purchase before you plan around them.

If the reviewers are right, the scoring changes how you should work. Reaching domain admin noisily can't pass on its own, since half the marks are for how few alerts you trigger. Learn each technique twice, once to make it work and again to make it work quietly.

How to prepare

Start with the 20 hours of course content, but plan for several times that in the labs. Each lab is worth repeating until you can complete it from your notes alone. Keep a runbook that pairs every Cobalt Strike command you use with what it leaves behind on the target: the process it spawns, the logon type it creates, the files it writes. That runbook is what protects the OPSEC marks the reviewers describe.

A sensible order:

  • Course chapters in sequence, with each lab done the day you read its chapter.
  • A second pass through the labs focused only on stealth: change Beacon behaviour, choose quieter lateral movement, and avoid touching the local security authority process the obvious way.
  • The challenge labs Chapagai describes at the end, timed, as a rehearsal for the exam.

Unlimited attempts change the risk calculation. A failed attempt costs time, not money, so there's little to gain from waiting until you feel fully ready once the challenge labs go cleanly. Lab instances run in several regions, including London, Ashburn, Seattle and Singapore, picked by your IP address. Zero-Point warns that using a VPN while launching a lab will slow it down.

After you pass

CRTO doesn't expire, and there's no renewal fee or continuing education. Because course access is lifetime, you keep receiving content updates, which matters for a subject where detection changes quickly.

Where to go next:

  • Red Team Ops II, for operating against modern defences, and its Red Team Lead certification.
  • OSEP, OffSec's evasion course, for a second, better-known credential in the same area.
  • Zero-Point's BOF Development & Tradecraft and UDRL and Sleepmask Development courses, if you want to write your own Cobalt Strike tooling.

Our view

CRTO is respected for teaching Cobalt Strike hands-on, with a licensed copy in the labs, at a price most people can pay themselves and with no penalty for failing. The OPSEC scoring reviewers describe would make it more honest than flag-counting exams. On the downside, it's tied to one commercial C2 framework, the public site says little about the exam, and Fortra's ownership raises a fair question about whether a course owned by Cobalt Strike's vendor will stay candid about how defenders catch it. For a working tester moving toward red team roles, £399 is easy to justify. If you need a credential that HR recognises without explanation, OSEP is the safer purchase.

Sources