--- title: Certifications · avantguard cyber security description: Certifications in Cyber Security --- [Skip to content](https://avantguard.io/en/certifications#main) [![avantguard cyber security](https://avantguard.io/hs-fs/hubfs/LogoInverted.png?width=128&height=61&name=LogoInverted.png)](https://avantguard.io/en?hsLang=en) - [Services](https://avantguard.io/en/services?hsLang=en) - [About Us](https://avantguard.io/en/about-us?hsLang=en) - [Experience](https://avantguard.io/en/experience?hsLang=en) - [Career](https://avantguard.io/de/karriere?hsLang=en) - [Research](https://avantguard.io/en/blog?hsLang=en) - [Contact](https://avantguard.io/en/contact?hsLang=en) [DE](https://avantguard.io/zertifizierungen) EN [Request an offer](https://avantguard.io/en/request-an-offer?hsLang=en) [DE](https://avantguard.io/zertifizierungen) EN [Request an offer](https://avantguard.io/en/request-an-offer?hsLang=en) Team # Certifications Our team keeps learning. These certifications are held within the team. [Meet the team](https://avantguard.io/en/about-us?hsLang=en) ## Certifications in the team ![OffSec Certified Expert³ (OSCE³)](https://149546176.fs1.hubspotusercontent-eu1.net/hubfs/149546176/certifications/osce3.svg) ### OffSec Certified Expert³ (OSCE³) OSCE³ is awarded once the three advanced OffSec certifications OSEP, OSWE and OSED have been passed. It proves in-depth knowledge of penetration testing hardened environments, web application security and exploit development. **Exam:** OSEP, OSWE and OSED passed [Learn more about OffSec Certified Expert³ (OSCE³)](https://www.offsec.com/blog/osce3-certification/) ![Offensive Security Experienced Penetration Tester (OSEP)](https://149546176.fs1.hubspotusercontent-eu1.net/hubfs/149546176/certifications/osep.svg) ### Offensive Security Experienced Penetration Tester (OSEP) OSEPs have the expertise necessary to conduct pentests against hardened systems. They’ve proven their ability to identify intrusion opportunities and execute advanced, organized attacks in a focused manner. OSEPs can bypass security defenses, perform advanced attacks while avoiding detection, & compromise systems configured with security in mind. They are able to assess systems and execute penetration tests at a higher level than an OSCP. **Exam:** 48 h practical and 24 reporting [Learn more about Offensive Security Experienced Penetration Tester (OSEP)](https://www.credential.net/group/353911) ![OffSec Web Expert (OSWE)](https://149546176.fs1.hubspotusercontent-eu1.net/hubfs/149546176/certifications/oswe.svg) ### OffSec Web Expert (OSWE) OSWEs find and chain vulnerabilities in web applications by analysing their source code (white box). They have proven that they can bypass authentication and turn several vulnerabilities into a complete exploit up to remote code execution. **Exam:** 48 h practical and 24 h reporting [Learn more about OffSec Web Expert (OSWE)](https://www.offsec.com/courses/web-300/) ![OffSec Exploit Developer (OSED)](https://149546176.fs1.hubspotusercontent-eu1.net/hubfs/149546176/certifications/osed.svg) ### OffSec Exploit Developer (OSED) OSEDs write their own exploits for Windows applications. They master reverse engineering, writing shellcode and bypassing protections such as DEP and ASLR. **Exam:** 48 h practical and 24 h reporting [Learn more about OffSec Exploit Developer (OSED)](https://www.offsec.com/courses/exp-301/) ![OffSec Web Assessor (OSWA)](https://149546176.fs1.hubspotusercontent-eu1.net/hubfs/149546176/certifications/oswa.svg) ### OffSec Web Assessor (OSWA) OSWAs assess web applications from an attacker's point of view (black box). They find and exploit common vulnerabilities such as cross-site scripting, SQL injection, SSRF and server-side template injection. **Exam:** 24 h practical and 24 h reporting [Learn more about OffSec Web Assessor (OSWA)](https://www.offsec.com/courses/web-200/) ![Offensive Security Certified Professional (OSCP)](https://149546176.fs1.hubspotusercontent-eu1.net/hub/149546176/hubfs/certifications/oscp.png?width=400&name=oscp.png) ### Offensive Security Certified Professional (OSCP) An OSCP has demonstrated the ability to use persistence, creativity, and perceptiveness to identify vulnerabilities and execute organized attacks under tight time constraints. OSCP holders have also shown they can think outside the box while managing both time and resources. **Exam:** 24 h practical and 24 reporting [Learn more about Offensive Security Certified Professional (OSCP)](https://www.credential.net/group/353836) ![OffSec Wireless Professional (OSWP)](https://149546176.fs1.hubspotusercontent-eu1.net/hub/149546176/hubfs/certifications/oswp.png?width=400&name=oswp.png) ### OffSec Wireless Professional (OSWP) OSWPs analyse and compromise wireless networks. They have proven that they can attack Wi-Fi encryption and enterprise configurations and recover the network key. **Exam:** 4 h practical and 24 h reporting [Learn more about OffSec Wireless Professional (OSWP)](https://www.offsec.com/courses/pen-210/) ![Burp Suite Certified Practitioner (BSCP)](https://149546176.fs1.hubspotusercontent-eu1.net/hubfs/149546176/certifications/bscp.svg) ### Burp Suite Certified Practitioner (BSCP) The certification from PortSwigger, the maker of Burp Suite, proves practical web application testing skills. In the exam, two web applications have to be fully compromised: from a user account to admin access to reading files on the server. **Exam:** 4 h practical [Learn more about Burp Suite Certified Practitioner (BSCP)](https://portswigger.net/web-security/certification) ![Certified Red Team Lead (CRTL)](https://149546176.fs1.hubspotusercontent-eu1.net/hub/149546176/hubfs/certifications/crtl-2025.png?width=400&name=crtl-2025.png) ### Certified Red Team Lead (CRTL) Holders of the Red Team Lead badge have demonstrated their knowledge of building secure C2 infrastructure, writing custom tooling, circumventing Windows hardening configurations, and bypassing EDR. **Exam:** 72 h practical [Learn more about Certified Red Team Lead (CRTL)](https://eu.badgr.com/public/badges/gwM0NmzISLyqmcqDScDX3w) ![Certified Red Team Operator (CRTO)](https://149546176.fs1.hubspotusercontent-eu1.net/hub/149546176/hubfs/certifications/crto-2025.png?width=400&name=crto-2025.png) ### Certified Red Team Operator (CRTO) Students who obtain this badge have demonstrated the ability to execute all phases of a Red Team assessment, from OSINT to full domain compromise and data exfiltration. **Exam:** 48 h practical [Learn more about Certified Red Team Operator (CRTO)](https://badgr.com/public/badges/TgH86o9zQsSqDOJ5MLREIQ) ![Certified Red Team Specialist (CRTS)](https://149546176.fs1.hubspotusercontent-eu1.net/hub/149546176/hubfs/certifications/crts.png?width=400&name=crts.png) ### Certified Red Team Specialist (CRTS) This certification from CyberWarFare Labs proves that holders can run a red team assessment in an Active Directory environment, from initial access through lateral movement to domain compromise. **Exam:** practical, with report [Learn more about Certified Red Team Specialist (CRTS)](https://cyberwarfare.live/product/red-team-specialist-crts/) ![Certified Red Team Professional (CRTP)](https://avantguard.io/hs-fs/hubfs/CRTP.png?width=400&name=CRTP.png) ### Certified Red Team Professional (CRTP) CRTP is a completely hands-on certification. To be certified, a student must solve practical and realistic challenges in our fully patched Windows infrastructure labs containing multiple Windows domains and forests with Server 2016 and above machines within 24 hours and submit a report. The certification challenges a student to compromise Active Directory by abusing features and functionalities without relying on patchable exploits. A certification holder has demonstrated the skills to understand and assess security of an Active Directory environment. **Exam:** 24 h practical and 48 reporting [Learn more about Certified Red Team Professional (CRTP)](https://www.credential.net/group/140735) ![Certified Az Red Team Professional (CARTP) ](https://avantguard.io/hs-fs/hubfs/CARTP.png?width=400&name=CARTP.png) ### Certified Az Red Team Professional (CARTP) CARTP is a completely hands-on certification. To be certified, a student must solve practical and realistic challenges in a live multi-Tenant Azure environment.  The exam for CARTP is a 24 hours hands-on exam. The student needs to compromise all the resources across tenants and submit a report. A certification holder has demonstrated the skills to understand and assess security of an Azure environment. **Exam:** 24 h practical and 48 reporting [Learn more about Certified Az Red Team Professional (CARTP)](https://www.credential.net/group/283019) ![HTB Certified Active Directory Pentesting Expert (HTB CAPE)](https://149546176.fs1.hubspotusercontent-eu1.net/hub/149546176/hubfs/certifications/cape.png?width=400&name=cape.png) ### HTB Certified Active Directory Pentesting Expert (HTB CAPE) HTB CAPE is Hack The Box's advanced Active Directory certification. Holders master attacks on Kerberos and NTLM, misconfigurations in ADCS, WSUS, Exchange and domain trusts, and post-exploitation with C2 frameworks. **Exam:** practical in a multi-domain environment, with a professional report [Learn more about HTB Certified Active Directory Pentesting Expert (HTB CAPE)](https://www.hackthebox.com/blog/htb-cape-announcement) ![AWS Red Team Expert (ARTE)](https://149546176.fs1.hubspotusercontent-eu1.net/hub/149546176/hubfs/certifications/arte.png?width=400&name=arte.png) ### AWS Red Team Expert (ARTE) ARTE from HackTricks Training proves advanced attack techniques against Amazon Web Services. In the exam, a full attack chain from external access to privilege escalation has to be built in a vulnerable AWS organisation. **Exam:** practical [Learn more about AWS Red Team Expert (ARTE)](https://www.hacktricks-training.com/courses/arte) ![eLearnSecurity Mobile Application Penetration Tester (eMAPT)](https://149546176.fs1.hubspotusercontent-eu1.net/hubfs/149546176/certifications/emapt.svg) ### eLearnSecurity Mobile Application Penetration Tester (eMAPT) eMAPTs test mobile applications for Android and iOS with static and dynamic analysis, from reverse engineering to manipulating the app at runtime. **Exam:** practical [Learn more about eLearnSecurity Mobile Application Penetration Tester (eMAPT)](https://ine.com/security/certifications/emapt-certification) ![Practical Mobile Pentest Associate (PMPA)](https://149546176.fs1.hubspotusercontent-eu1.net/hub/149546176/hubfs/certifications/pmpa.png?width=400&name=pmpa.png) ### Practical Mobile Pentest Associate (PMPA) PMPAs compromise mobile applications with static and dynamic analysis, for example by extracting stored secrets and bypassing SSL pinning. The exam is a realistic test of an Android app without flags or multiple choice. **Exam:** 2 days practical and 2 days reporting [Learn more about Practical Mobile Pentest Associate (PMPA)](https://certifications.tcm-sec.com/pmpa/) ![Practical IoT Pentest Associate (PIPA)](https://149546176.fs1.hubspotusercontent-eu1.net/hub/149546176/hubfs/certifications/pipa.png?width=400&name=pipa.png) ### Practical IoT Pentest Associate (PIPA) PIPAs test embedded devices and their firmware. They master hardware interfaces such as UART and SPI, firmware extraction, and firmware analysis and reverse engineering. **Exam:** 2 days practical and 2 days reporting [Learn more about Practical IoT Pentest Associate (PIPA)](https://certifications.tcm-sec.com/pipa/) ![OSSTMM Professional Security Tester (OPST)](https://avantguard.io/hs-fs/hubfs/opst.png?width=400&name=opst.png) ### OSSTMM Professional Security Tester (OPST) An OPST is a Penetration Tester / Ethical Hacker who has the skills and knowledge to accurately and efficiently test the security posture of an organization, network or product. **Exam:** 3 h Multiple Choice [Learn more about OSSTMM Professional Security Tester (OPST)](https://www.isecom.org/opst.pdf) ![Certified Pro Lab Red Team Operator Level 2 (Cybernetics)](https://avantguard.io/hs-fs/hubfs/cybernetics.png?width=400&name=cybernetics.png) ### Certified Pro Lab Red Team Operator Level 2 (Cybernetics) Cybernetics Pro Lab is an immersive Windows Active Directory environment that has undergone various pentest engagements in the past. Therefore, the operating systems have been updated, all patches applied, and the underlying operating systems hardened. **Exam:** Collecting all 25 flags in the lab [Learn more about Certified Pro Lab Red Team Operator Level 2 (Cybernetics)](https://www.hackthebox.com/hacker/pro-labs) ![Certified Pro Lab Red Team Operator Level 3 (APTLabs)](https://avantguard.io/hs-fs/hubfs/aptlabs.png?width=400&name=aptlabs.png) ### Certified Pro Lab Red Team Operator Level 3 (APTLabs) APTLabs simulates a targeted attack by an external threat agent against an MSP (Managed Service Provider). APTLabs consists of fully patched servers, prevalent enterprise technologies, a simulated WAN network, and much more. **Exam:** Collecting all 20 flags in the lab [Learn more about Certified Pro Lab Red Team Operator Level 3 (APTLabs)](https://www.hackthebox.com/hacker/pro-labs) ![VIRTUAL HACKING LABS Certificate of Completion](https://avantguard.io/hs-fs/hubfs/vhl2-png.png?width=400&name=vhl2-png.png) ### VIRTUAL HACKING LABS Certificate of Completion The Virtual Hacking Labs is a full penetration testing lab that is designed to learn the practical side of vulnerability assessments and penetration testing in a safe environment. **Exam:** Get root/administrator access on at least 20 lab machines (beginner or advanced) and provide documentary proof of that achievement [Learn more about VIRTUAL HACKING LABS Certificate of Completion](https://www.virtualhackinglabs.com/labs/penetration-testing-lab/) ![VIRTUAL HACKING LABS Advanced+ Certificate of Completion](https://avantguard.io/hs-fs/hubfs/vhl2-png-1.png?width=400&name=vhl2-png-1.png) ### VIRTUAL HACKING LABS Advanced+ Certificate of Completion The Virtual Hacking Labs is a full penetration testing lab that is designed to learn the practical side of vulnerability assessments and penetration testing in a safe environment **Exam:** Get root/administrator access on at least 10 lab machines (advanced+) and provide documentary proof of that achievement [Learn more about VIRTUAL HACKING LABS Advanced+ Certificate of Completion](https://www.virtualhackinglabs.com/labs/penetration-testing-lab/) ![Hack The Box](https://149546176.fs1.hubspotusercontent-eu1.net/hubfs/149546176/certifications/htb-dark.svg) ### Hack The Box Hack The Box is an online platform for testing penetration testing skills and sharing ideas and methods with other members. The platform contains several challenges that are constantly updated. Some of them simulate real-world scenarios, while others are more CTF-style. **Exam:** 45% ownership of all active boxes and challenges. [Learn more about Hack The Box](https://www.hackthebox.com/) ![Certified Information Security Manager (CISM)](https://149546176.fs1.hubspotusercontent-eu1.net/hub/149546176/hubfs/certifications/cism.png?width=400&name=cism.png) ### Certified Information Security Manager (CISM) ISACA's CISM is aimed at professionals who build and run an information security programme. It covers governance, risk management, security programme development and incident management, and requires at least five years of work experience. **Exam:** 4 h, 150 questions [Learn more about Certified Information Security Manager (CISM)](https://www.isaca.org/credentialing/cism) ![Check Point Certified Security Administrator (CCSA)](https://149546176.fs1.hubspotusercontent-eu1.net/hub/149546176/hubfs/certifications/ccsa.png?width=400&name=ccsa.png) ### Check Point Certified Security Administrator (CCSA) CCSAs install, configure and run Check Point security gateways and their management, including security policies, NAT, VPN and traffic monitoring. **Exam:** multiple choice [Learn more about Check Point Certified Security Administrator (CCSA)](https://www.checkpoint.com/training-and-certification/) ## How secure are your systems really? Tell us about your project. We will get back to you with a non-binding offer. [Request an offer](https://avantguard.io/en/request-an-offer?hsLang=en) [+41 55 253 30 30](tel:+41552533030) [![avantguard cyber security](https://avantguard.io/hs-fs/hubfs/LogoInverted.png?width=140&height=66&name=LogoInverted.png)](https://avantguard.io/en?hsLang=en) avantguard cyber security AG Neue Jonastrasse 52 8640 Rapperswil-Jona, Switzerland [+41 55 253 30 30](tel:+41552533030) [info@avantguard.io](mailto:info@avantguard.io) ## Company - [Services](https://avantguard.io/en/services?hsLang=en) - [About us](https://avantguard.io/en/about-us?hsLang=en) - [Experience](https://avantguard.io/en/experience?hsLang=en) - [AI at avantguard](https://avantguard.io/en/how-we-use-ai?hsLang=en) - [Careers](https://avantguard.io/en/careers?hsLang=en) - [Research](https://avantguard.io/en/blog?hsLang=en) - [Contact](https://avantguard.io/en/contact?hsLang=en) ## Services - [Penetration Testing](https://avantguard.io/en/penetration-test?hsLang=en) - [Red Teaming](https://avantguard.io/en/red-teaming?hsLang=en) - [Attack Simulation](https://avantguard.io/en/attack-simulation?hsLang=en) - [FINMA-regulated pentesting](https://avantguard.io/en/finma-regulated-pentesting?hsLang=en) - [AD Security Improvement](https://avantguard.io/en/ad_improvement?hsLang=en) - [mesher](https://avantguard.io/en/mesher?hsLang=en) - [All services](https://avantguard.io/en/services?hsLang=en) ## Research - [All posts](https://avantguard.io/en/blog?hsLang=en) © 2026 avantguard cyber security AG - [Privacy policy](https://avantguard.io/en/privacy-policy) - [Deutsch](https://avantguard.io/)