The PNPT is TCM Security's attempt to make a certification exam look like a real engagement. You get five full days to work from open-source research on the outside to the exam network's domain controller, two more days to write a professional report, and then a 15-minute live debrief in front of TCM's assessors. There are no flags and no multiple-choice questions. Since April 17, 2023, the certification doesn't expire.
Who should take the PNPT
TCM calls it a professional-level exam and lists penetration tester, network pentester and red team operator as the jobs it prepares you for. It fits someone who can already compromise single machines and wants to show they can run a whole engagement, from external reconnaissance to writing for a client and explaining findings out loud.
Beginners should wait. TCM recommends that anyone without professional hacking experience take its Practical Junior Penetration Tester (PJPT) exam first; INE's eJPT covers similar ground. If you need a credential that recruiters filter for by name, OSCP remains the one to compare, with a proctored 24-hour exam. Hack The Box's CPTS is the closest match in format, with 10 days and a commercial-grade report.
The PNPT at a glance
| PNPT | |
|---|---|
| Format | Practical network penetration test; no flags, no multiple choice |
| Time | Five days for the engagement, two days for the report, then a 15-minute live debrief |
| Passing criteria | Compromise the exam domain controller, submit a professional report and pass the debrief |
| Price (US) | $499: voucher, one free retake and 12 months of on-demand training |
| Voucher | Valid 12 months from purchase |
| Delivery | Online, cloud-hosted lab; no proctor, network traffic monitored |
| Prerequisites | None; PJPT first recommended without professional experience; under-18s need parental consent |
| Validity | Does not expire (since April 17, 2023) |
TCM gives a 20% discount to current and former military, first responders, students and educators who email proof of status. Its Enterprise Penetration Testing learning path bundles the PJPT, the Practical OSINT Research Professional (PORP) and the PNPT exams with 79 hours of training for $995, with two years of access. At the top end, the $2,999 Ethical Hacker Bootcamp adds more than 28 hours of live online instruction and 50 hours of post-training labs to PJPT, PORP and PNPT attempts.
What the exam tests
TCM doesn't publish domain weights. It publishes pass requirements instead, and they describe the shape of the engagement: start with open-source intelligence (OSINT) to find a way in, work through an Active Directory environment that includes antivirus and egress controls, move laterally and vertically, and compromise the domain controller. Then report and debrief.
Three details matter for planning. OSINT is part of the attack path, so research carries real weight. The report is graded, and you get only two days for it after five days of testing. And the debrief tests whether you can explain your findings to people who know the subject, which no multiple-choice or flag-based exam checks.
TCM says the included training is designed to be enough to pass. It's five on-demand courses (Practical Ethical Hacking, Windows Privilege Escalation, Linux Privilege Escalation, Open-Source Intelligence Fundamentals and External Pentest Playbook), more than 45 hours in all.
AI tools are allowed. TCM's May 2026 policy permits large language models and code assistants during the exam if you disclose in your report where, why and how you used them. Using AI to generate answers in place of your own understanding is not allowed, and neither is help from another person.
Preparing for the test, the report and the debrief
Start with the bundled courses, beginning with Practical Ethical Hacking, which sits in the first step of TCM's learning path. The training uses hands-on local labs, so check your machine first; TCM's minimum spec is 8GB of RAM and 256GB of disk.
Plan your time in three parts. Put roughly half into Active Directory and privilege escalation, since compromising the domain controller is the pass condition. Give a quarter to OSINT and the external playbook, because without a foothold from outside you can't start. Spend the last quarter on reporting: write at least one full report from a practice lab, with an executive summary, findings, evidence and remediation, and time yourself.
Then rehearse the debrief. Explain a practice engagement to a colleague in 15 minutes, covering how you got in, what you found and what the client should fix first. TCM's FAQ links a first-attempt account by Alex Olsen on its blog.
If you use AI tools, decide in advance how you'll log their use, since the report has to disclose it.
No renewal, and where to go next
There's nothing to renew: no continuing education credits, no annual fee. The retake comes with the voucher, and both attempts must fall inside the voucher's 12 months.
Next steps:
- OSCP, for the name recognition and a proctored, time-boxed test of similar skills.
- CPTS, for a longer engagement and a heavier report.
- OSEP, once evasion and advanced Active Directory work interest you.
Our view
The PNPT is the best-value report-based penetration test exam we know of. It tests the whole engagement, including the report and a live conversation about it, for $499 with training included, and it never expires. The criticisms are fair, though. It isn't proctored, and since May 2026 it permits AI assistance with disclosure, so a hiring manager has to take more on trust than with a proctored exam. If you want to prove you can do the work and explain it, take the PNPT. If a specific employer asks for OSCP, take that.
Sources
- TCM Security: PNPT: format, pass requirements, price, inclusions, voucher validity, retake, discounts, proctoring, system requirements, non-expiry, PJPT recommendation, checked October 2026
- TCM Security: Enterprise Penetration Testing learning path: $995 bundle, 79 hours, two years of access, checked October 2026
- TCM Security: AI tools and certification exams: AI disclosure policy, May 2026, checked October 2026
- TCM Security: How to pass the PNPT exam the first time: Alex Olsen's account, checked October 2026
- OffSec PEN-200 (OSCP): 24-hour proctored exam, checked October 2026
- Hack The Box: CPTS: 10-day exam, commercial-grade report, checked October 2026