PNPT
Practical Network Penetration Tester · TCM Security
The PNPT simulates a real engagement from start to finish: OSINT, external access, Active Directory compromise, then a professional report and an oral debrief, which very few exams require. It is very popular among self-taught testers and juniors and increasingly cited in job ads, though large firms and HR departments still give more weight to the OSCP. Its strength is realism at a low price; its limit is recognition that is still mostly within the community.
- Exam
- Five days to test a realistic network (OSINT, external access, then internal Active Directory), two more days to write a professional report, then a live 15-minute debrief with the assessors.
- Exam price
- $499Exam voucher with one free retake and 12 months of access to 45+ hours of on-demand training. 20% off for students, teachers, military and first responders.
- Required experience
- No formal prerequisite (candidates must be 18 or over). TCM Security advises those without professional experience to take the PJPT first.
- Validity and maintenance
- No expiry: since 17 April 2023 the PNPT is valid for life, with no maintenance fee.
- Format
- Hands-on
Who is it for?
Juniors and career changers aiming for a pentest job, and administrators who want to understand how an attacker takes over an Active Directory domain.
Domains covered
- Open-source intelligence (OSINT)
- External network access
- Active Directory enumeration and exploitation
- Antivirus and egress filtering bypass
- Lateral and vertical movement
- Domain controller compromise
- Professional report writing
- Oral debrief of the findings
Nestor’s take
Information checked on 2 October 2026 against the official site. Prices exclude tax and training, and may change.
The certification names mentioned are trademarks of their respective owners. KrakenShield is not affiliated with any certification body and does not reproduce any exam question.
