Real environments. Every flag or it doesn't count.

A 3-day hands-on certification. A private two-service corporate network is provisioned on booking: enumerate, exploit and pivot through 16 tasks covering SQL injection, IDOR, command injection, LFI, XXE, SSRF, JWT forgery and secret leakage. Passing the practical (70%) then requires a written penetration-test report that an examiner reviews before certification is granted.

A 3-day hands-on certification. A private fintech REST API and its internal service are provisioned on booking. Complete 16 tasks across the OWASP API Security Top 10 (BOLA, mass assignment, SSRF, SQLi, BFLA, JWT attacks and more). Passing the practical (70%) then requires a written report that an examiner reviews before certification.

A competency-based assessment covering digital evidence handling, filesystem analysis, Windows registry artifacts, memory acquisition and reporting. Passing issues the Digital Forensics Analyst credential — a professional certificate, publicly verifiable and mapped to recognised forensic standards.

A competency-based assessment covering passive reconnaissance, DNS and infrastructure discovery, search techniques, metadata and open-source tooling. Passing issues the OSINT Intelligence Practitioner credential — a professional certificate, publicly verifiable and mapped to recognised skill standards.

A competency-based assessment covering reconnaissance, web application exploitation, network attacks and privilege escalation. Passing issues the Penetration Testing Professional credential — a professional certificate, publicly verifiable and mapped to recognised skill standards.