CRTP and CRTO sound like rivals: both are hands-on Active Directory red-team certifications, both are popular in India, and both cost a fraction of OffSec's prices. But they sit at different layers of the same engagement. CRTP teaches you to break into and escalate through an Active Directory forest. CRTO teaches you to run a Cobalt Strike operation through that forest without getting caught. For most people the honest answer is not either/or: it is CRTP first, then CRTO.
- Cost: $249 for a 30-day lab, about ₹23,800 — the cheapest serious red-team cert
- Focus: Active Directory attacks — Kerberoasting, AS-REP roasting, ACL and GPO abuse, domain and forest escalation
- Exam: 24-hour hands-on lab, then a report
- Level: beginner-friendly, no prior red-team experience assumed
- Best for: your first credible AD-attack credential
- Cost: £399, about ₹51,700 (per independent reviews — verify current pricing)
- Focus: adversary simulation with Cobalt Strike — malleable C2 profiles, BOFs, opsec and evasion
- Exam: 48-hour hands-on, assumed-breach, flag-based, no separate report
- Level: assumes you already know AD attacks
- Best for: moving into red-team operator work
They are not the same tier
The most common mistake is treating CRTP and CRTO as two options for the same slot on a CV. They are two layers of one engagement. CRTP is the get-in-and-escalate layer: from a low-privilege foothold, enumerate the domain, abuse Kerberos, ACLs and GPOs, and climb to domain and forest admin. CRTO is the run-the-operation layer: deploy and operate a Cobalt Strike C2, write malleable profiles and Beacon Object Files, and move through the same kind of AD environment while staying under the defenders' radar. You use CRTP skills to own the forest; you use CRTO skills to do it as a controlled, evasive adversary simulation.
Which one first?
Take CRTP first. It is a quarter of the price, it assumes no prior red-team experience, and the Active Directory attack chain it drills is the foundation CRTO quietly expects you to already have. Move to CRTO once you are heading into actual operator work — running C2, worrying about opsec and evasion, simulating a named threat actor. If you already hold OSCP or have real AD-attack experience, you can go straight to CRTO and skip CRTP; the reverse rarely works, because CRTO's assumed-breach exam is unforgiving if the AD fundamentals are shaky.
| Dimension | CRTP | CRTO |
|---|---|---|
| Vendor | Altered Security | Zero-Point Security |
| Price (India) | $249, about ₹23,800 | £399, about ₹51,700 (per reviews) |
| Lab | 30 days ($379/60, $499/90) | Lab access bundled with the course |
| Exam | 24h hands-on + report | 48h hands-on, assumed-breach, flags |
| Skill layer | Break in and escalate in AD | Operate C2 and evade |
| Tooling | Native AD tradecraft, PowerShell | Cobalt Strike, BOFs, malleable C2 |
| Prerequisites | None assumed | AD-attack fluency assumed |
| India hiring signal | Common first AD add-on | Respected by mature red teams |
CRTP vs CRTO — side by side (2026, India)
What each costs in India (2026)
CRTP is the cheapest credible red-team certification on the market: $249 for a 30-day lab, roughly ₹23,800, with 60- and 90-day tiers at $379 and $499 and lifetime access to the course material. CRTO is listed at £399, about ₹51,700 — but treat that as an estimate. When we last checked, Zero-Point Security's own pricing page was intermittently unreachable and independent reviews disagreed on exactly what the fee includes, so confirm the current figure and inclusions before you pay. For the full six-certification cost table see our red team certifications in India cost breakdown; if you are weighing the Altered Security ladder, CRTP vs CRTE covers the next step up; and if OffSec is in the mix, read CRTO vs OSCP alongside what OSCP actually costs in India.
On hiring: in India, CRTP is a common first add-on for pentesters moving toward Active Directory work, and CRTO is genuinely respected by the mature red teams at the top private banks, big-3 IT-services internal red teams, and MDR providers. Neither yet clears an HR keyword filter the way OSCP does, so if a job description is the target, OSCP is still the default ask and these two are the depth behind it.
Macksofy runs red-team training and mentors engineers through the Active Directory and C2 tradecraft both exams test. Tell us where you are and we will map the fastest honest path.