PNPT: Practical Network Penetration Tester

What PNPT is and who runs it

The Practical Network Penetration Tester (PNPT) is a certification from TCM Security, the training company founded by Heath Adams. It tests whether you can run a full external-to-internal network penetration test the way a junior consultant would on a real engagement: open-source intelligence, gaining an external foothold, pivoting internally, and compromising an Active Directory domain. There is no multiple-choice section and it is not a capture-the-flag box hunt. It is deliberately built to mirror a client assessment from start to finish, including the parts most certs skip — the writing and the talking afterwards.

Cost and what’s included

The official PNPT page lists the certification at $499 (USD), and that price bundles the exam voucher with more than 45 hours of on-demand training across five courses: Practical Ethical Hacking, Windows and Linux Privilege Escalation, Open-Source Intelligence, and the External Pentest Playbook, with 12 months of access to the material. TCM explicitly includes one free retake with every voucher — unusual in this industry — which takes much of the financial sting out of failing a first attempt.

Time: the exam and the report

You get five full days of hands-on testing, then an additional two days to write a professional penetration-test report. The report is graded, not an afterthought, and it feeds into the exam’s signature step: a live 15-minute debrief where you present your findings to TCM assessors as if you were briefing a client. Candidates routinely note the call is relaxed and often runs past the scheduled 15 minutes into a genuine conversation about the attack path.

How hard it is, honestly

PNPT sits at beginner-to-intermediate rather than OSCP-level. The technical bar is real but fair: if you have worked through the bundled courses and can pivot and attack AD, the targets are achievable in the generous time window. The parts that actually trip people up tend to be documentation quality and the debrief, not the exploitation itself. Many reviewers pass on the first try, and the free retake lowers the stakes considerably.

Is it worth it — and for whom

It is aimed at people breaking into penetration testing, or moving from isolated labs toward something that resembles real consulting work. The realism and the debrief are the features reviewers keep coming back to. If you already hold OSCP or work as a red teamer day to day, PNPT will feel gentle. But if you are early-career and want defensible proof that you can run and, crucially, communicate an engagement, it delivers that well and cheaply.

How to prepare

Work all the way through the bundled courses rather than jumping straight to the voucher — the External Pentest Playbook and the privilege-escalation courses map directly onto exam tasks. Build a repeatable methodology and a report template before exam day, drill OSINT and AD attacks in practice labs, and rehearse explaining an attack path out loud. Treat the debrief like a real client meeting: know your findings, their business impact, and the remediation you would recommend.

SourcesTCM Security — official PNPT page