CRTE: Certified Red Team Expert

What CRTE is and who runs it

Certified Red Team Expert (CRTE) is an advanced Active Directory attack certification from Altered Security, the training company built around Nikhil Mittal’s courses. It sits above the entry-level CRTP: where CRTP teaches you to abuse a single domain, CRTE drops you into a multi-domain, multi-forest enterprise and asks you to climb from a low-privileged user to enterprise admin. The focus is deliberate — abusing built-in Windows and AD features (Kerberos, delegation, LAPS, gMSA, AD CS, cross-forest trusts) rather than firing memory-corruption exploits. It is on-prem AD, not cloud; the cloud equivalents are CARTP and CARTE.

Cost and what’s included

Altered Security prices CRTE by lab duration, and every tier bundles the course, the lab, and one exam attempt. The official tiers are $299 for 30 days, $499 for 60 days, and $699 for 90 days (USD). You keep lifetime access to the learning material including future updates, plus 14+ hours of video with English captions. If you run out of lab time, a 30-day extension is $249; an extra exam attempt is $99. There is no exam-only SKU — the lab bundle is the product, which makes CRTE unusually cheap for the depth on offer.

Time: the exam and the report

The exam is a 48-hour hands-on assessment in your own dedicated AD environment. You start as a non-admin user and work attack paths across domains and forests toward full compromise. It is not a hunt for disconnected flags — you enumerate, chain misconfigurations, and document as you go. After the hands-on window you submit a report: detailed solutions to each challenge plus practical mitigations, which is closer to real consulting output than a proof-dump. The vendor page states the 48-hour figure but does not publish the post-exam report window or a numeric pass mark, so treat those as check-vendor-page.

How hard it is, honestly

CRTE is intermediate-to-advanced, not brutal. Reviewers who did the labs thoroughly tend to describe the exam as fair and very passable — the 48-hour clock is generous and the environment mirrors what the course teaches. The difficulty is breadth: you need to be comfortable pivoting across trusts, reading AD relationships, and knowing which feature to abuse when. If you skipped the learning objectives it bites; if you completed them, most people clear it without drama. Prior CRTP knowledge, or equivalent AD experience, makes it far smoother.

Is it worth it — and for whom

For anyone doing internal pentests or red teaming against Windows enterprises, CRTE is strong value. At $299 to start, the lab alone justifies the cost, and the cert signals genuine multi-forest AD skill rather than tool-clicking. It suits pentesters, red teamers, and blue-teamers who want to understand the attack paths they defend. It is not a beginner cert and it is not cloud — if your work is Azure/Entra, CARTP fits better. The three-year validity and cheap $29 renewal exam keep upkeep low.

How to prepare

Do the course end to end and complete every learning objective in the lab — that is the exam preparation. Build a methodical enumeration workflow (BloodHound plus manual checks) and keep notes you can turn straight into report content. Practise cross-forest and cross-domain escalation, certificate-services abuse, and delegation attacks until they are routine. Coming from CRTP is the natural on-ramp; if you are rusty on AD fundamentals, shore those up first. Because the report is graded, rehearse writing clean, reproducible steps with mitigations, not just capturing proof.

SourcesAltered Security — CRTE (Red Team Lab)