CNPen vs CRTP vs CPTS, at a glance
There isn’t one winner here, because these three certifications do different jobs. If you can only start with one, take CRTP if Active Directory is where you want to get good, take CPTS if you want a full pentest methodology and real report-writing practice, and treat CNPen as a cheap, 4-hour benchmark you can sit along the way.
That’s the honest version of the answer we give learners who ask us this. Below, we break down what each exam actually tests, what it really costs (list prices checked on 11 November 2026), how hard each one is, and the order we’d take them in, plus where OSCP fits if that’s the name on the job ads you’re reading.
| CNPen | CRTP | CPTS | |
|---|---|---|---|
| Issued by | The SecOps Group | Altered Security | Hack The Box |
| List price | £250 (about US$334), exam only | US$249 with a 30-day lab, course and one attempt | US$210 exam voucher (2 attempts), plus access to the course path |
| Exam | 4 hours, 15 practical challenges | 24 hours hands-on (+1 hour to set up) | 10 days, including the report |
| Report | None | Detailed solutions with mitigations | Commercial-grade pentest report |
| Focus | Network: Linux/Unix, Windows Active Directory, cloud weaknesses | Active Directory only | Web, external and internal (Active Directory) testing |
| Level (vendor’s own words) | Intermediate | Beginner-friendly | Intermediate |
| Expires? | No | After 3 years (free renewal exam before expiry) | No |
Which one should you take first?
Here’s how we’d decide, based on where you are today:
| Your situation | Start with | Why |
|---|---|---|
| You already practise on lab machines and want a quick, cheap credential | CNPen | Four hours, £250 list price, a free retake, and results straight after the exam |
| You want to specialise in Active Directory or move towards red teaming | CRTP | An Active Directory-only course, lab and 24-hour exam that Altered Security itself calls beginner-friendly |
| You want to learn a complete pentest methodology, including reporting | CPTS | A 28-module learning path, then a 10-day exam that ends with a client-grade report |
| The job ads you’re targeting ask for OSCP | OSCP (or CPTS, then OSCP) | Most Indian pentest job ads still ask for OSCP by name (see below) |
One thing surprises people: the vendors’ own difficulty labels don’t follow the price. The SecOps Group calls CNPen an intermediate exam and recommends two years of pentesting or bug bounty experience, while Altered Security calls the CRTP lab beginner-friendly. So “cheapest” doesn’t mean “easiest”.
CNPen: the 4-hour network pentest exam
The Certified Network Pentester (CNPen) from The SecOps Group is a short, practical exam: 4 hours to solve 15 challenges, find and exploit vulnerabilities and capture flags. You can take it online, on demand, from anywhere, over the exam VPN. There’s no report to write, and you get your result as soon as you finish. Score over 60% to pass, or over 75% to pass with merit.
The syllabus is broad for a 4-hour exam: OSINT and network mapping, Linux and Unix flaws, Windows Active Directory attacks such as Kerberoasting, Golden and Silver Tickets, credential dumping and lateral movement, and common weaknesses in cloud services. Web applications aren’t part of it; The SecOps Group points people to a separate exam for that.
Two things to know before you buy. First, it’s an exam only: The SecOps Group says plainly that it doesn’t provide training for it, so you prepare on your own. Second, all purchases are final, but one free retake is included, and there’s a free mock exam you can try first. That mock exam is the smartest way to find out whether you’re ready.
Where it fits: CNPen is a cheap, fast way to check your skills under time pressure. Because there’s no training and no report, it isn’t a learning journey on its own, so we see it as a checkpoint rather than a starting point.
CRTP: the Active Directory specialist
Certified Red Team Professional (CRTP) comes from Altered Security’s “Attacking and Defending Active Directory” course. Unlike CNPen, you’re buying a full package: video lessons (14+ hours), two lab manuals, access to a practice lab and one exam attempt.
It’s Active Directory from start to finish: enumeration, local and domain privilege escalation, Kerberos attacks, domain trusts and cross-forest attacks, persistence, Active Directory Certificate Services (AD CS) abuse, and getting past Microsoft Defender for Endpoint and Defender for Identity.
The exam is 24 hours of hands-on work, with an extra hour to account for start-up time, and it isn’t proctored. When you finish, you submit detailed solutions to the challenges along with practical mitigations. Altered Security doesn’t publish a pass mark; it evaluates your report and the flags you submit together. If you fail, a re-attempt costs US$99 after a one-month cool-down.
Two practical points. You can start your lab any time within 90 days of buying it, and you can sit the exam within 90 days of your lab ending. And unlike the other two, CRTP expires after three years, though the renewal exam is free if you take it before the certificate expires.
For a deeper look at CRTP and its advanced sibling, see our CRTP vs CRTE guide, and for the commands themselves, our Windows AD attack cheatsheet.
CPTS: the full engagement, report and all
Hack The Box’s Certified Penetration Testing Specialist (CPTS) is the most demanding of the three, and the most complete. You can’t even book the exam until you’ve finished the entire Penetration Tester job-role path on HTB Academy: 28 modules covering web, external and internal testing, pivoting, privilege escalation and reporting.
The exam itself runs for 10 days against a realistic Active Directory network, reached over VPN. Those 10 days include writing your report, and the report matters: you need enough points and a commercial-grade report to pass. HTB doesn’t publish the exact pass mark for CPTS. Results arrive within 20 business days.
Each US$210 voucher includes two attempts and is valid for a year from purchase. One catch: you only get the second attempt if you submitted a report for the first one. And once you’ve earned CPTS, it doesn’t expire.
Our full CPTS guide walks through the path module by module.
Side-by-side: exam format and difficulty
| CNPen | CRTP | CPTS | |
|---|---|---|---|
| Exam length | 4 hours | 24 hours (+1 hour setup) | 10 days, including the report |
| What you hand in | Flags only (no report) | Flags plus detailed solutions and mitigations | A commercial-grade pentest report |
| How you pass | Over 60% (75% for merit) | Report and flags evaluated together (no published pass mark) | Enough points plus an acceptable report (no published pass mark) |
| Results | Immediately | Not stated | Within 20 business days |
| Proctored | Not stated | No | Not stated |
| Training included | No | Yes: video course, lab manuals and lab | Yes, through an HTB Academy subscription |
| Prerequisite | None required (2 years’ experience recommended) | Basic Active Directory and Windows command-line skills | The full 28-module Penetration Tester path |
| Retake | 1 free retake included | US$99, after a one-month cool-down | Second attempt included in the voucher |
| Valid for | No expiry | 3 years (free renewal exam before expiry) | No expiry |
How hard is each one? Honestly, the length tells you a lot. CNPen tests whether you can move fast under pressure for four hours. CRTP tests whether you really understand Active Directory, over 24 hours. CPTS tests whether you can run a whole engagement and explain it to a client, over 10 days. In our experience, the report is where people coming from multiple-choice exams struggle most, which is why CPTS and CRTP stretch you in ways CNPen doesn’t.
What each one really costs (prices checked on 11 November 2026)
All prices below are the vendors’ list prices on 11 November 2026, converted at about ₹97 to the US dollar. All three vendors run discounts fairly often, so check before you buy, but don’t plan your budget around a sale.
| CNPen | CRTP | CPTS | |
|---|---|---|---|
| Cheapest way in | £250 (about US$334, ₹32,400): exam only | US$249 (about ₹24,100): 30-day lab, course and one attempt | US$210 voucher (about ₹20,400) plus course access, e.g. Silver Monthly at US$30 a month (about ₹2,900) |
| Bigger packages | None | 60-day lab US$379 (about ₹36,800); 90-day lab US$499 (about ₹48,400) | Silver Annual US$550 a year (about ₹53,400), which includes one Specialist-tier voucher such as CPTS |
| If you fail | One free retake included | US$99 (about ₹9,600) per re-attempt | Second attempt included; after that, a new US$210 voucher |
| Extra lab time | Not applicable | US$199 (about ₹19,300) for 30 more days, with one exam attempt | Comes with your subscription |
A realistic CPTS budget depends on how fast you work through the path. As an example, six months of Silver Monthly (US$180) plus the voucher (US$210) comes to US$390, or about ₹37,800. HTB also lists a cheaper Student plan at US$10 a month if you qualify. Note that HTB raised Silver Annual from US$490 to US$550 on 12 October 2026, and some of its own pages still show the old price.
CNPen’s price needs a word of explanation too: its page headline talks about a cert “under $100”, but the list price on the same page is £250 (about US$334). The lower figure only applies when a discount code is running.
Where does OSCP fit?
A lot of people searching this comparison are really asking whether any of these can stand in for OSCP. Our answer: they’re excellent preparation, but they don’t replace it if your target employers ask for OSCP by name.
In our sample of 200 Indian pentest job ads from Q1 2026 (Naukri, LinkedIn and Hirist), 78% listed OSCP as required or strongly preferred. In a separate Q1 2026 sample of Indian red team job ads, CRTP was named in about 18%, usually as “CRTP, CRTO or equivalent AD experience”. That’s why our usual advice for India is to use CRTP or CPTS to build real skill, then sit OSCP for the hiring filter.
OSCP is also the most expensive route: OffSec’s Course & Cert bundle is US$1,749 (about ₹1.7 lakh, one attempt) and Learn One is US$2,749 a year (about ₹2.67 lakh, two attempts). For the full head-to-head, read our CPTS vs OSCP comparison and our OSCP cost breakdown for India.
The order we’d take them in
If you’re early in your pentest career and want all three over time, here’s the sequence we’d suggest:
- Start the CPTS path (HTB Academy) to learn the methodology properly. You don’t have to book the exam straight away.
- Take CRTP once the Active Directory modules click, so you go deep on AD while the material is fresh.
- Use CNPen as a checkpoint whenever you want a quick, low-cost test of your skills under time pressure. Try the free mock exam first.
- Sit the CPTS exam when your notes and reporting are solid, then decide whether OSCP is your next step for the job market.
Already comfortable with Active Directory? Skip ahead to CRTO and OSEP, or see what comes after OSCP.
Frequently asked questions
Is CNPen worth it?
As a quick, low-cost benchmark, yes. It’s a 4-hour practical exam with a free retake, a free mock exam to try first, and a certificate that doesn’t expire. It doesn’t include training or a report, so it won’t teach you a methodology the way CRTP or CPTS will.
Is CRTP harder than CPTS?
No. CRTP is narrower and shorter: 24 hours of Active Directory work, and Altered Security calls its lab beginner-friendly. CPTS is broader and longer: a 28-module path, then a 10-day exam covering web, external and internal testing, with a commercial-grade report.
CNPen or CRTP for Active Directory?
CRTP. CNPen includes Active Directory challenges within a 4-hour network exam, but CRTP is an Active Directory-only course, lab and 24-hour exam, so it teaches and tests AD in much more depth.
Which of the three is cheapest?
On paper, the CPTS voucher (US$210) is the cheapest single item, but you also need HTB Academy access to complete the required path. CRTP at US$249 includes the course, a 30-day lab and an exam attempt. CNPen’s list price is £250 (about US$334) for the exam alone, with one free retake.
Do CNPen, CRTP and CPTS expire?
CNPen and CPTS don’t expire. CRTP expires after three years, but Altered Security’s renewal exam is free if you take it before your certificate expires.
Can CPTS or CRTP replace OSCP?
They build the same practical skills, but many Indian employers still ask for OSCP by name: 78% of the 200 Indian pentest job ads in our Q1 2026 sample listed it as required or strongly preferred. If your target roles ask for OSCP, plan for it.
References & further reading
- The SecOps Group: Certified Network Pentester (CNPen)
- The SecOps Group: CNPen vs OSCP
- Altered Security: Attacking and Defending Active Directory (CRTP)
- Altered Security: certification renewal process
- Hack The Box: Certified Penetration Testing Specialist (CPTS)
- Hack The Box: Academy subscriptions and exam vouchers
- Hack The Box: new Academy pricing (2026)
- OffSec: pricing
Not sure which one fits you?
Tell us where you are today and what kind of role you’re aiming for, and we’ll suggest an order that fits your budget and timeline, even if that means starting somewhere we don’t teach. If OSCP is on your list, our OSCP (PEN-200) bootcamp is ₹1,45,000, live online or in our Mumbai classroom; the OffSec course-and-exam bundle is bought separately.
Get a recommendation See the OSCP bootcamp or call +91 99308 24239
Ready to pick your first practical certification?
Whichever you choose, the skills overlap more than the names suggest: Active Directory, careful enumeration and clear writing will carry you through all three. Pick the one that matches your next step, not the one with the most buzz this month.
If Active Directory is your focus, our Active Directory pentest guide goes deeper, and at Macksofy Trainings we run a custom 4-domain red team lab and an AD CS workshop for learners building these skills. Let’s talk about your pentest learning path.
Prices are vendor list prices checked on 11 November 2026, converted at about ₹97 per US dollar (CNPen uses The SecOps Group’s own US-dollar figure). Vendors change prices, exam formats and requirements, and often run discounts. Macksofy Trainings is not affiliated with or endorsed by The SecOps Group, Altered Security, Hack The Box or OffSec. CNPen, CRTP, CPTS and OSCP are the property of their respective owners.
