CPTS in 2026, at a glance
If you’ve been hanging around pentest forums or LinkedIn lately, you’ve probably seen people posting their shiny new CPTS badge and wondered: what exactly is this thing, and should you care? Fair question. Five years ago almost nobody in India had heard of it. Today it’s one of the first certifications our students ask about after OSCP.
Here’s the short version. CPTS stands for Certified Penetration Testing Specialist. It’s Hack The Box’s flagship pentest certification, and it’s built around a 10-day, fully practical exam where you attack a realistic corporate network and then write a report a real client would accept. No multiple choice. No brain dumps. You either compromise the environment and document it properly, or you don’t pass.
| Full form | Certified Penetration Testing Specialist |
| Issued by | Hack The Box (HTB Academy) |
| Prerequisite | Complete 100% of the HTB Academy “Penetration Tester” job-role path (28 modules) |
| Exam length | 10 days, fully hands-on |
| Exam target | A realistic enterprise network, from external foothold to internal Active Directory |
| To pass | Capture enough flags to meet the passing threshold and submit a commercial-grade pentest report |
| Attempts | One voucher covers a second attempt if the first one fails (taken within the retake window) |
| Exam voucher | About US$210 (roughly ₹20,400), also bundled into HTB Academy annual plans |
What does CPTS stand for, and who is behind it?
CPTS is short for Certified Penetration Testing Specialist, issued by Hack The Box, the same platform a lot of you already use for retired machines and Pro Labs. HTB Academy is its structured-learning side, and CPTS is the certification that sits at the end of its Penetration Tester path.
What makes it different from most entry-to-mid certifications is the philosophy. HTB designed CPTS around how a real engagement actually runs: you start with reconnaissance, find a way in, move laterally, escalate, and then you have to explain all of it in writing. In our experience, that last part, the reporting, is exactly where Indian candidates coming from MCQ-style exams struggle the most. CPTS forces you to get good at it.
CPTS syllabus: what the Penetration Tester path covers
You can’t book the exam until you’ve completed the entire Penetration Tester job-role path, all 28 modules. That’s a deliberate gate, and honestly, it’s a good one. The path is the syllabus. Here’s how we explain it to students, grouped into the stages you’d follow on a real job:
1. Process and reconnaissance. Penetration Testing Process, Getting Started, Network Enumeration with Nmap, Footprinting, Information Gathering – Web Edition and Vulnerability Assessment. This is where you learn to map a target properly instead of firing exploits blindly.
2. Getting a foothold. File transfers, Shells & Payloads, Using the Metasploit Framework, Password Attacks and Attacking Common Services. Practical, everyday tooling you’ll use on almost every engagement.
3. Web application attacks. Using Web Proxies, Attacking Web Applications with Ffuf, Login Brute Forcing, SQL Injection Fundamentals, SQLMap Essentials, Cross-Site Scripting, File Inclusion, File Upload Attacks, Command Injections, Web Attacks and Attacking Common Applications. If you’ve read our Burp Suite for beginners guide, this is where that knowledge gets stretched hard.
4. Moving through the network. Pivoting, Tunneling & Port Forwarding, plus Active Directory Enumeration & Attacks. This is the heart of the exam. Weak AD skills are the number one reason people fail, which is why we always point students to our Windows AD attack cheatsheet early.
5. Privilege escalation. Linux Privilege Escalation and Windows Privilege Escalation.
6. Reporting and the capstone. Documentation & Reporting, then Attacking Enterprise Networks, a full mock engagement that’s the closest thing to a dress rehearsal for the exam.
The CPTS exam: 10 days that feel like a real engagement
Ten days sounds generous. It isn’t. The exam drops you into a multi-host enterprise environment and you work it like a client engagement: external enumeration, a foothold, lateral movement, Active Directory compromise, and flags along the way that prove how far you got.
Then comes the part people underestimate. You have to submit a commercial-grade penetration test report: findings, evidence, risk ratings and remediation, written for a client. HTB grades the report, not just your flags. Plenty of candidates who capture enough flags still have to go again because the report wasn’t good enough.
Our advice? Treat the first two or three days as recon only, take notes like you’re already writing the report, and leave at least two full days at the end for writing. Students who do that almost always tell us the report was easier than they feared.
How much does CPTS cost in India?
The standalone exam voucher is about US$210 (roughly ₹20,400). HTB also bundles a voucher into its annual Academy plans: the Silver Annual plan (around US$490 a year) includes the modules you need plus one CPTS voucher. Student plans are cheaper but need a verified student email and don’t include a voucher.
Either way, CPTS is a fraction of what OSCP costs. We’ve broken the numbers down side by side, including total prep cost in rupees, in our CPTS vs OSCP cost comparison, so we won’t repeat all of it here.
Is CPTS worth it in India? Our honest take
It depends on what you need the certificate to do for you.
If you need to clear HR filters at Indian service companies, Big 4 firms or government tenders, OSCP and CEH are still the names that get recognised automatically. CPTS is growing fast, but a lot of recruiters here still don’t know it yet.
If you want genuine skill, especially in Active Directory, web attacks and reporting, CPTS is one of the best-value learning paths available right now. Many of our students now do CPTS before OSCP: it builds the methodology cheaply, and the OSCP exam feels far less intimidating afterwards.
If you’re already working in security, CPTS is a strong, affordable way to prove hands-on ability to technical interviewers, who absolutely do know what it is.
Not sure where it fits in your path? Our guide to becoming a penetration tester in India lays out the full ladder.
How to prepare for CPTS (and how long it takes)
Most people take somewhere between six and nine months to go from comfortable-with-Linux to exam-ready, studying around a job or college. A few practical tips from what we’ve seen work:
Don’t rush the path. Do every skills assessment properly; the exam assumes you actually absorbed it.
Practise outside the path. Retired HTB machines, Pro Labs and other platforms help a lot. Our best cybersecurity labs guide ranks the options.
Build a note system early. A searchable set of commands and techniques will save you hours on exam day.
Write practice reports. Pick any lab you’ve finished and write it up as if a client will read it. It’s the single most under-practised exam skill.
Frequently asked questions
What is the full form of CPTS?
CPTS stands for Certified Penetration Testing Specialist. It’s a practical penetration testing certification issued by Hack The Box through HTB Academy.
Is CPTS harder than OSCP?
Many candidates find CPTS broader and more demanding: it runs for 10 days, covers a full enterprise network including Active Directory, and requires a commercial-grade report. OSCP is shorter and more time-pressured. They test overlapping skills in different ways.
How much does CPTS cost in India?
The CPTS exam voucher costs about US$210 (roughly ₹20,400). It’s also included in HTB Academy’s Silver Annual plan, which costs around US$490 a year and includes the required modules.
Do I need to finish the HTB Penetration Tester path before the CPTS exam?
Yes. You must complete 100% of the Penetration Tester job-role path, all 28 modules, before you can start the CPTS exam.
Is CPTS recognised by employers in India?
Technical interviewers and security teams increasingly recognise CPTS, but OSCP and CEH are still better known to HR filters at Indian service companies and in government tenders. Many candidates use CPTS to build skill, then add OSCP for recognition.
References & further reading
- HTB Certified Penetration Testing Specialist (CPTS)
- HTB Academy Penetration Tester job-role path
- OffSec PEN-200 (OSCP)
Ready to start your CPTS journey?
CPTS rewards patience and methodology more than raw talent. Work through the path properly, practise your reporting, and you’ll come out a noticeably better pentester, whether or not you go on to OSCP. If you want the full cost picture, see our CPTS vs OSCP comparison; if you’re weighing other options, our ranking of the best cybersecurity certifications in India will help.
At Macksofy Trainings we mentor candidates through practical exams like OSCP and CRTP in classroom (BKC Mumbai) and live online formats. Let’s talk about your pentest learning path.
Disclaimer: prices are approximate, converted at about ₹97 per US dollar, and based on publicly available Hack The Box pricing as of October 2026. Hack The Box may change pricing, exam format or requirements at any time. Macksofy Trainings is not affiliated with or endorsed by Hack The Box. CPTS and Hack The Box are the property of their respective owners.
About the author — Yasir Arafat
Founder and Lead Instructor, Macksofy Trainings
Yasir designs OSCP, CEH v13 and SOC-200 curriculum at Macksofy Trainings, an EC-Council Accredited Training Center in Mumbai, and mentors candidates through practical certification exams.
