CEPT | Certified Enterprise Penetration Tester
Prove you can plan and execute a full-scope enterprise penetration test, attack internal and external assets, pivot through networks, and deliver a client-ready report that leadership can act on.
What CEPT Proves
CEPT is a hands-on enterprise penetration testing certification designed for people who want to move beyond “tool running” and into full-scope, methodical offensive operations.
You will be expected to:
- Enumerate and compromise externally exposed and internal services.
- Attack and abuse Active Directory and Windows domain environments.
- Pivot between networks, escalate privileges, and prove real business impact.
- Communicate findings clearly to both technical and executive audiences.
If you want to work as a penetration tester, red teamer, or offensive-security consultant, CEPT is built to mirror that role.
Fast Facts
Core Topics & Curriculum
CEPT training walks you from structured fundamentals into full kill-chain operations against realistic enterprise targets.
- Assessment planning, scoping, and rules of engagement.
- Reconnaissance and enumeration for external and internal targets.
- Web application and infrastructure exploitation in enterprise contexts.
- Windows and Linux privilege escalation paths you’ll actually use.
- Active Directory attacks: Kerberoasting, delegation abuse, misconfig exploitation.
- Pivoting, tunneling, and lateral movement across segmented networks.
- Maintaining access and avoiding unnecessary detection.
- Evidence collection and professional penetration test report writing.
Training is self-paced and on-demand, so you can revisit modules as many times as you need before scheduling the exam.
Lab Environment
The CEPT labs and exam are built to feel like a compressed, high-signal enterprise environment rather than a simple CTF.
- Per-student dedicated lab environments during the exam.
- Realistic internal networks, domain-joined hosts, and multiple attack paths.
- Services, misconfigurations, and credentials that reward proper enumeration.
- Windows & Linux systems designed to require chained exploitation, not single-click wins.
Your 7-day exam window includes both lab access and time to complete your report—no surprise “hard stops” in the middle of the engagement.
Exam Snapshot
The CEPT exam is a 7-day remote practical. You’ll receive VPN access to an enterprise-style network and a clearly defined scope.
- Enumerate and compromise multiple in-scope systems.
- Attack domain infrastructure and demonstrate meaningful escalation.
- Collect evidence and screenshots as you work.
- Submit a professional pentest report before your exam window ends.
Full details are on the Exam Structure & Requirements page.
How to Prepare & Prerequisites
CEPT assumes you’re comfortable with basic networking and OS usage, but you do not need to be an expert to start.
- Basic familiarity with Linux and Windows command line.
- Understanding of TCP/IP, ports, and common network services.
- Willingness to learn tools like Nmap, Burp, and tunneling frameworks.
- Comfort reading documentation and adapting examples to new situations.
For a step-by-step prep roadmap, including mindset and practice reporting tips, use the dedicated How To Prepare page.
Custom Labs That Build Toward the Final Capstone
CEPT does not leave you to jump from videos straight into a final exam. You progress through custom-built environments that increase in scope and complexity, so every lab strengthens the methodology, judgment, and reporting skills required for the final enterprise capstone.
Guided Skill Labs
Build confidence through focused practice in discovery, exploitation, privilege escalation, Active Directory, pivoting, tunneling, and evidence collection.
Scenario Labs
Work through multi-system engagements that require chained attacks, route decisions, scope discipline, and recovery when the obvious path does not work.
Capstone Readiness Runs
Complete timed practice engagements that combine technical execution with clean notes, proof, remediation context, and executive-ready reporting.
Final Enterprise Capstone
Lead an independent, full-scope engagement across an enterprise-style network and finish with a professional report built for a real client.
- Custom-built environments, not recycled public walkthroughs
- Progressive difficulty with realistic enterprise context
- Repeatable practice supported by lifetime training access
- Methodology and reporting emphasized as heavily as exploitation
The Kind of CEPT Labs You’ll Get Your Hands On
CEPT is designed around isolated, purpose-built environments—not passive demonstrations or one-click CTF shortcuts. You will move from controlled skill practice into multi-system enterprise scenarios where enumeration, judgment, persistence, evidence, and reporting all matter.
Build the Target Picture
Profile a simulated company, map exposed services, fingerprint live hosts across multiple subnets, and uncover web routes, APIs, and hidden attack surfaces before choosing your entry point.
Break More Than a Demo App
Work against custom vulnerable applications and services covering modern web attack classes, exploit selection, payload delivery, session handling, and post-exploitation across connected targets.
Find the Path to Domain Control
Collect and analyze directory relationships, identify attack paths, abuse Kerberos weaknesses, move laterally, escalate privileges, and connect individual findings into a complete domain-compromise chain.
Turn a Foothold Into Control
Escalate on Windows and Linux through realistic misconfigurations, then practice persistence, credential access, token abuse, scheduled execution, and disciplined post-exploitation.
Navigate the Enterprise Network
Traverse segmented environments with multiple subnets, isolated zones, and a DMZ. Build tunnels, route tools through compromised systems, and reach assets that were never directly exposed.
Operate From Briefing to Boardroom
Combine reconnaissance, initial access, lateral movement, privilege escalation, evidence collection, and impact validation—then turn the operation into an executive and technical report a client can act on.
Your training converges in one complete engagement.
Inside the seven-day CEPT exam window, you will face an isolated enterprise-style network with Windows and Linux systems, Active Directory, a web application stack, segmented routes, and intentionally vulnerable services. You must discover the attack path, achieve defined objectives, preserve proof, and submit a professional penetration-test report—without a walkthrough telling you what to do next.
What You’ll Walk Away With
Passing CEPT is more than a badge — it’s proof you can operate like a professional enterprise penetration tester.
- A digital CEPT certificate and verification details for employers and clients.
- Hands-on experience executing a full engagement from recon to reporting.
- A refined personal methodology you can reuse on real-world assessments.
- Confidence that you can explain and defend your findings to both technical and non-technical stakeholders.