CRTO: Certified Red Team Operator

What CRTO is and who runs it

Certified Red Team Operator (CRTO) is the certification earned by passing the exam for Zero-Point Security’s “Red Team Ops” course, created by Daniel Duggan (Rasta Mouse). It teaches adversary simulation and command-and-control tradecraft — the full attack lifecycle from initial compromise through to full domain takeover, data hunting, and exfiltration. Its standout feature is that students get hands-on time with a licensed copy of Cobalt Strike inside the labs, which is otherwise an expensive commercial tool most learners never touch.

Cost and what’s included

Zero-Point Security lists Red Team Ops at £399 (GBP). That buys the course materials with free ongoing updates, access to more than 20 hands-on labs (described as having no expiry or extensions), the licensed Cobalt Strike lab environment, and exam attempts. The exam policy is unusually generous: the vendor states you can take as many attempts as you need to pass, with no financial penalty for failing. Additional lab runtime can be purchased separately if you want more practice before the exam.

Time: the exam and the report

The exam is a practical, CTF-style, assumed-breach scenario driven by a provided threat profile. You get a maximum of 48 hours of runtime usable within a four-day window, and you can stop the VMs at any time to preserve runtime for a break. Each machine holds a flag submitted on a scoreboard, and you must capture at least 6 of the 8 flags (75%) to pass. Access is through a Guacamole interface with no VPN or internet. Unlike PNPT and CRTP, there is no separate written report — passing is purely flag-based.

How hard it is, honestly

CRTO is well regarded and considered approachable relative to its depth. The challenge is less about raw difficulty and more about operating cleanly with a C2 framework: managing beacons, moving laterally, and understanding how your actions look to defenders. Reviewers repeatedly praise the clarity of the teaching. The 48-hours-across-four-days format, the assumed-breach starting point, and unlimited free retakes together make it far less punishing than a 6-of-8-flags threshold might sound.

Is it worth it — and for whom

It targets aspiring and working red teamers who want structured, practical experience with Cobalt Strike and modern tradecraft — experience that is otherwise costly and hard to come by. It is one of the most recommended courses in the field. If you need vendor-neutral coverage or bleeding-edge EDR-evasion depth, treat CRTO as a foundation rather than an endpoint; but for the price, the teaching quality, and the licensed C2 access, it is very hard to beat as a first real red-team certification.

How to prepare

Work through the course labs thoroughly and get genuinely comfortable with Cobalt Strike’s workflow before booking — beacon management, pivoting, and basic OPSEC are exactly what the exam exercises. Once booked, read the provided threat profile so you know the TTPs expected of you. Practice the Active Directory attack chain end to end, and keep notes you can execute quickly, since the exam is a multi-day, stop-start effort where efficiency matters more than speed.

SourcesZero-Point Security — Red Team Ops courseZero-Point Security — Red Team Ops exam