Offensive Security Training Opportunities - Part 3

banner

Intro

Welcome back to the series Offensive Security Training Opportunities in 2025. In Parts 1 and 2, we explored foundational pentesting platforms and specialized tracks in web, API, and mobile application security.

In this third installment, weĺl turn our attention to red team and blue team training opportunities, including advanced offensive operations, adversary emulation, detection engineering, incident response, and other operational security skills. Whether you’re looking to enhance your attack-side capabilities or strengthen your defensive posture, the following trainings will definitely help you on your way.

This post is Part 3 of the Offensive Security Training Opportunities in 2025. You can find the other posts in the links below:

Disclaimer: The opinions stated in this article are solely my own and do not necessarily reflect those of my employer or other affiliations I have. Next to that, courses are not listed in a specific order (this is no ranking by any means). Just because a course is listed in my post does not mean I have actively taken or bought the course, although I have participated in many of these and plan on taking more from this list.

TL;DR

Again if you are only interested in the summary, I have included a table at the end of every chapter with the necessary information.

Red Team Overview
Blue Team Overview

Red Team

Trainings in this section focus on offensive operations, emulating adversaries, exploiting vulnerabilities, and testing environments from the attacker’s perspective. The resources listed here will help you build or advance your capabilities in threat emulation and adversary simulation. Although some offerings are entry-level, foundational pentesting knowledge is required to proceed.

Altered Security

Formerly known as Pentester Academy, Nikhil Mittal founded Altered Security. Part of Pentester Academy was sold to INE Security. Their well-known red team certifications remain available under the Altered Security name. Altered Security is known for their excellent labs like the Global Central Bank.

Certified Red Team Professional (CRTP)

CRTP focuses on entry-level Active Directory penetration testing from a Windows perspective. Although the course is fully taught from the Windows perspective, lab walkthroughs using a C2 (Sliver) are also provided.

Cost

The training is available in 3 options:

$249 (excl. VAT) for 30 day lab access + lifetime access to course material + 1 exam attempt
$379 (excl. VAT) for 60 day lab access + lifetime access to course material + 1 exam attempt
$499 (excl. VAT) for 90 day lab access + lifetime access to course material + 1 exam attempt

Note: They offer regular discounts on their trainings (20-25%).

Certified Red Team Expert (CRTE)

The CRTE contains Advanced Active Directory penetration testing knowledge. The training course is known for its elaborate lab, which includes eight forests to compromise.

Cost

The training is available in 3 options:

$299 (excl. VAT) for 30 day lab access + lifetime access to course material + 1 exam attempt
$499 (excl. VAT) for 60 day lab access + lifetime access to course material + 1 exam attempt
$699 (excl. VAT) for 90 day lab access + lifetime access to course material + 1 exam attempt

Note: They offer regular discounts on their trainings (20-25%).

Certified Red Team Master (CRTM)

This training, formerly known as PACES or Global Central Bank, is the most advanced Active Directory training offered by Altered Security.

Cost

The training is available in 3 options:

$399 (excl. VAT) for 30 day lab access + lifetime access to course material + 1 exam attempt
$599 (excl. VAT) for 60 day lab access + lifetime access to course material + 1 exam attempt
$749 (excl. VAT) for 90 day lab access + lifetime access to course material + 1 exam attempt

Note: They offer regular discounts on their trainings (20-25%).

Certified Evasion Techniques Professional (CETP)

The Evasion lab (Certified Evasion Techniques Professional) is the latest addition to the Altered Security Training catalog. It is designed to equip information security professionals with the expertise needed to bypass defenses in modern enterprise environments. This course delves deep into the techniques and methodologies used to bypass endpoint countermeasures like EDRs.

Cost

The training is available in 3 options:

$449 (excl. VAT) for 30 day lab access + lifetime access to course material + 1 exam attempt
$649 (excl. VAT) for 60 day lab access + lifetime access to course material + 1 exam attempt
$849 (excl. VAT) for 90 day lab access + lifetime access to course material + 1 exam attempt

Note: They offer regular discounts on their trainings (20-25%).

Altered Security Bootcamps

From time to time Altered Security offers Bootcamps for their certifications where they give 4 live virtual training sessions covering the topics of said bootcamp. During these bootcamps, you will have access to live instruction and are able to ask questions.

Zero-Point Security

Red Team training provider by Daniel Duggan aka RastaMouse. Known for delivering the most value for money Red Team trainings on the market. They recently updated their platform and pricing method to make their courses more accessible in diverse countries.

Certified Red Team Operator (CRTO)

The most well-known Red Team Training out there. Covers all necessary topics to excel in performing adversary simulation and emulation exercises. Recently updated to a new version (May 2025). The course includes labs and is focused on active directory attacks and uses the Cobalt Strike C2 framework. The course teaches good OPSEC and the mindset that is needed to perform red team engagements.

Cost

The course costs £399* (excl. VAT) and includes labs and unlimited exam attempts. You will have lifetime access to the course material, including course updates.

* Price may differ in your region due to Purchasing Power Parity (PPP).

Certified Red Team Lead (CRTL)

The CRTL is the continuation on the CRTO course, often referred to as CRTO 2. The course provides advanced OPSEC and defense bypass strategies. Students will cover topics such as programming with Windows APIs leading into writing custom tooling, PPID Spoofing, in-memory obfuscation, exploiting AS and WDAC, Bypassing AV and EDR by circumventing ETW, userland hooking and kernel callbacks.

Currently the course and labs are not available for purchase as it is undergoing a rework and migration to their new training platform.

Cost

Normally, the course costs £399* (excl. VAT) and includes 1 exam attempt. However pricing can change on the new platform.

If the course following the same principles as CRTO, you will have lifetime access to the course material, including course updates and will have access to the labs and unlimited exam attempts.

* Price may differ in your region due to Purchasing Power Parity (PPP).

OffSec

Offensive Security Experienced Professional (OSEP)

The OSEP is OffSec’s advanced penetration testing course. The course covers evasion techniques and custom exploitation. This is most often seen as the follow-up course to the OSCP.

Cost

The course is available in different pricing:

Standalone course: including 1 exam attempt, including 90 days lab access ($1.749) (excl. VAT)
Learn One annual subscription: including fundamental courses, KLCP and OSWP ($2.749) (excl. VAT)
Learn Unlimited annual subscription: including access to all of OffSec courses and unlimited exam attempts ($6.099) (excl. VAT)

Hack The Box

HTB ProLabs

The ProLabs offering from HTB puts you in multiple simulated organizational network environments. They offer multiple labs ranging from beginner to expert level. In the HTB ProLabs you are being put in a realistic environment where you need to simulate real world cyber attacks to gain full access to the organizational network. Each ProLab offers a certificate of completion.

Cost

ProLabs costs €44/month or €440/year (excl. VAT). This gives access to every Pro Lab in their catalog.

HTB Certified Active Directory Pentesting Expert (HTB CAPE)

This is HTB latest certification (as of this moment). This certification focuses on exploiting advanced Active Directory (AD) vulnerabilities. The certification is presented as a follow up to the CPTS.

Cost

To access the CAPE course, a gold subscription is required. This costs €1.055/year (excl. VAT), including 1 exam voucher + 1 free retake

White Knight Labs

White Knight Labs is a training provider that comes with a unique proposition. Self-managed labs. They offer a range of offensive training options each with their own set of lab scripts to deploy the labs in your own cloud environment. Their training offering mainly consists of offensive operations and development.

Advance Red Team Operations Certification (ARTOC)

The ARTOC is a self-paced cybersecurity course built for experienced professionals. Participants dive deep into offensive operations using tools like Cobalt Strike in an immersive, AWS-hosted lab environment. Students gain access to Cobalt Strike, Havoc, red team infrastructure templates, redirectors, and a collection of custom tooling to support real-world simulation and training. You’ll build and manage your own infrastructure by deploying labs into your AWS account, with optional environments available in Azure and GCP.

Cost

The course comes in On-Demand and live instructed (Virtual) format.

The On-Demand course costs $700 (excl. VAT)
The Live training course costs $1200 (excl. VAT)

Note: Lab costs (AWS, Azure, GCP) is not included

Offensive Development Practitioner Certification (ODPC)

The ODPC is a course that focuses on advanced offensive development techniques such as process injection, custom payload creation, and C2 framework usage. Throughout the course you’ll work in AWS environments and engage with live instruction to build and deploy offensive tools while bypassing modern defenses.

Cost

The course comes in On-Demand and live instructed (Virtual) format.

The On-Demand course costs $700 (excl. VAT)
The Live training course costs $1200 (excl. VAT)

Note: Lab costs (AWS, Azure, GCP) is not included

SpecterOps

The creators of Bloodhound, Ghostwriter and many offensive security other tools. Also known for their cutting edge research like ADCS, SCCM and many other security topics. SpecterOps provides advanced level training courses in the red and blue team domain taught by their experts in the field.

SpecterOps Adversary Tactics: Red Team Operations (RTO)

The Red Team operations is a live in-person 4-day training course taught by multiple SpecterOps instructors. This course is heavily hands-on focused as you get access to a custom lab where you can apply the Red Team Tactics and Techniques that are being taught in the course, while you are actively being hunted by a live Blue Team. In my opinion, this is one of the best courses teaching you Red Team techniques while also giving you important OPSEC knowledge. The course does not offer any certification or exam. However, you do receive a certificate of completion and a special course coin.

Cost

Training live or virtual costs $4.500* (excl. VAT) However, they usually offer early bird pricing and returning student discounts (25%). They also offer private training.

*The cost is based on the ticket price for their live training during SOCON 2026

SpecterOps Adversary Tactics: Identity-driven Offensive Tradecraft (IDOT)

The IDOT course is considered the follow up course on the RTO. The course offers an in-depth look on identity-driven attacks, targeting both on-premises and hybrid identities. The course adopts the Clean Source Principle and explains it very well with attacks on Kerberos, NTLM, ADCS, SCCM, Entra and even external identity providers. If you want to improve your offensive skills to the next level, this is a must have course!

Cost

Training live or virtual costs $4.500* (excl. VAT) However, they usually offer early bird pricing and returning student discounts (25%). They also offer private training.

*The cost is based on the ticket price for their live training during SOCON 2026

SANS

SEC565: Red team Operations and Adversary Emulation (GRPT)

Develop and improve Red Team operations for security controls in SEC565 through adversary emulation, cyber threat intelligence, Red Team tradecraft, and engagement planning. Learn how to execute consistent and repeatable Red Team engagements that are focused on the effectiveness of the people, processes, and technology used to defend environments.

Cost

The in-person training costs €8.230 + €905 for the On-Demand bundle. (or $8.780 + $999) Totaling €9.135 (or $9.779) (excl. VAT).

The On-Demand bundle grants 4 months access and costs $8.780 (excl. VAT)

The exam costs $999 (excl. VAT).

SEC670: Red Teaming Tools - Developing Windows Implants, Shellcode, Command and Control

Students engage in intensive hands-on lab experiences, creating custom-compiled programs that navigate contemporary defenses. Hands-on exercises introduce techniques employed by sophisticated threat actors, strengthening students’ expertise in leveraging Windows APIs, process injection, and persistence mechanisms. Through strategic application of C++ programming, analysts develop the capacity to craft tailored implants, manipulate shellcode, and establish covert command channels—skills that fundamentally elevate organizational security posture.

Cost

The in-person training costs €8.230 + €905 for the On-Demand bundle. (or $8.780 + $999) Totaling €9.135 (or $9.779) (excl. VAT).

The On-Demand bundle grants 4 months access and costs $8.780 (excl. VAT)

Synacktiv

Synacktiv is a Cyber security company founded by 2 IT security experts from France. It has grown to be one of the established names in the cyber security industry. They only recently added Live/Virtual training’s to their portfolio of services. Their training’s are delivered on-site in their Paris office, but only in French. However, the online sessions are taught in English. You can find their training schedule on their training page.

Active Directory Intrusion Tactics: Entry Level

During this five-day training, you will learn the skills necessary to perform an in-depth Active Directory penetration test. By following the five course modules, students will learn the methodology and techniques used by synacktiv’ experts during an intrusion, from anonymous access to the complete compromise of the environment and the persistence of access within it. To illustrate new concepts, learners will be guided through two comprehensive corporate environments. This training is offered in English (online) and in French (on-site).

Cost

€4.500 (excl. VAT) for In-Person or Virtual training of 5 days

Active Directory Intrusion Tactics: Advanced Level

During this five-day training, you will deepen your intrusion skills in an Active Directory environment. Guided by our experts, study advanced techniques of reconnaissance, lateral movements, elevation of privileges, extraction of secrets and persistence. To illustrate new concepts, the learners will be put in situation on two complete company environments derived from real-world scenarios.

Cost

€4.500 (excl. VAT) for In-Person or Virtual training of 5 days

Overview

Training Name	Certification Name	Vendor	Training Format	Certification	Level	Cost (excl. VAT)	info	Link
Certified Red Team Professional	Certified Red Team Professional (CRTP)	Altered Security	Lifetime access course, Videos, Labs	Non-proctored exam, 24 hours, Hands-on lab + report	Entry-level	$249 - $499	Cost depends on lab time, includes 1 exam attempt	Course Link
Certified Red Team Expert	Certified Red Team Expert (CRTE)	Altered Security	Lifetime access course, Videos, Labs	Non-proctored exam, 48 hours, Hands-on lab + report	Intermediate	$299 - $699	Cost depends on lab time, includes 1 exam attempt	Course Link
Certified Red Team Master	Certified Red Team Master (CRTM)	Altered Security	Lifetime access course, Videos, Labs	Non-proctored exam, 48 hours, Hands-on lab + report	Expert	$399 - $749	Cost depends on lab time, includes 1 exam attempt	Course Link
Certified Evasion Techniques Professional	Certified Evasion Techniques Professional (CETP)	Altered Security	Lifetime access course, Videos, Labs	Non-proctored exam, 48 hours, Hands-on lab + report	Expert	$399 - $749	Cost depends on lab time, includes 1 exam attempt	Course Link
Red Team Ops	Certified Red Team Operator (CRTO)	Zero-Point Security	Lifetime access course, On-Demand Labs	Non-proctored exam, 48 hours (spread over 4 days), Hands-on Lab	Intermediate	£399	Lifetime access, unlimited exam attempts	Course Link
Red Team Ops II	Certified Red Team Lead (CRTL)	Zero-Point Security	Lifetime access course, On-Demand Labs	Non-proctored exam, 72 hours (spread over 5 days), Hands-on Lab	Intermediate / Expert	£399	Course is currently undergoing rework!, normally includes: Lifetime access, unlimited exam attempts	Course Link (old course link)
PEN-300: Advanced Evasion Techniques and Breaching Defenses	OffSec Experienced Penetration Tester (OSEP)	OffSec	On-Demand course, Videos, Labs	Proctored exam, 48 hours (+24 hours), Hands-on lab + report	Expert	$1.749	3 month lab access 1 exam attempt	Course Link
HTB ProLabs	Multiple	Hack The Box	On-Demand Labs	No	Entry-level - Expert	€440	Annual subscription, each ProLab offers a certificate of completion	Labs Link
Active Directory Penetration Tester Job-Role Path	HTB Certified Active Directory Pentesting Expert (HTB CAPE)	Hack The Box	On-Demand course, Labs	Non-proctored exam, 10 days, Hands-on lab + report	Intermediate / Expert	€1.055	Annual subscription, 1 exam attempt + retake, 100% course completion required	Course Link
Advance Red Team Operations	Advance Red Team Operations Certification (ARTOC)	White Knight Labs	On-Demand course, Live virtual	Hands-on lab (no info)	Intermediate	$700 or $1.200	Lifetime access, 1 exam attempt, excluding Lab costs	Course Link
Offensive Development Practitioner	Offensive Development Practitioner Certification (ODPC)	White Knight Labs	On-Demand course, Live virtual	Hands-on lab (no info)	Intermediate	$700 or $1.200	Lifetime access, 1 exam attempt, excluding Lab costs	Course Link
Adversary Tactics: Red Team Operator	X	SpecterOps	Live in-person/virtual	No	Intermediate	$4.500	4 day in-person or virtual course, SOCON 2026 price	Course Link
Adversary Tactics: Identity Driven Offensive Tradecraft	X	SpecterOps	Live in-person/virtual	No	Expert	$4.500	4 day in-person or virtual course, SOCON 2026 price	Course Link
SEC565: Red Team Operations and Adversary Emulation™	GIAC Red Team Professional (GRTP)	SANS	Live in-person/virtual	Proctored exam, 2 hours, Multiple-choice	Expert	€9.135 or $9.779 + $999 (exam)	6 day in-person or virtual training + 4 Months On-Demand bundle	Course Link Certification Link
SEC670: Red Teaming Tools - Developing Windows Implants, Shellcode, Command and Control	X	SANS	Live in-person/virtual	No	Expert	€9.135 or $9.779	6 day in-person or virtual training + 4 Months On-Demand bundle	Course Link
Active Directory Intrusion Tactics: Entry Level	X	Synacktiv	Live in-person/virtual	No	Intermediate	€4.500	5 day in-person (French) or virtual course (English)	Course Link
Active Directory Intrusion Tactics: Advanced Level	X	Synacktiv	Live in-person/virtual	No	Expert	€4.500	5 day in-person (French) or virtual course (English)	Course Link

Blue Team

While this blog post series focuses on offensive trainings I am convinced that it is necessary to include blue team content as it is very important to understand both sides of the playing field as an attacker as well as a defender. This section covers defensive operations, identifying, detecting, responding to, and recovering from cyber-attacks. The trainings included will help you strengthen your skills as a attacker to better understand how the defensive side works.