InfoSecHub

home / certifications / crest-crt

// Offensive security

CRT
CREST Registered Penetration Tester

The CRT is CREST's intermediate penetration testing exam, a 2.5-hour practical at Pearson VUE centres covering infrastructure and web application testing. The UK NCSC accepts it for CHECK Team Member status, and it's valid for 3 years.

CRESTIntermediateIssued on Credly
Official page at crest-approved.orgVerify a holder

Overview

The CREST Registered Penetration Tester (CRT) is an intermediate exam from CREST, the international body that accredits penetration testing companies and certifies individual testers. It tests whether a candidate can assess operating systems, common network services, and simple web applications, find known vulnerabilities, and exploit them to recover data. Candidates must already hold the CPSA. CREST describes successful candidates as qualified for hands-on penetration testing roles, indicative of 3 or more years of experience.

In the UK, the NCSC accepts CRT for CHECK Team Member status, and CREST says governments and regulators elsewhere recognize it too. The exam is a 2.5-hour practical at Pearson VUE centres, using a provided Kali Linux machine with no internet access, and it's marked automatically. That's a different format from the OSCP's 24-hour exam and written report. CREST also runs an equivalency route that grants CRT to candidates with a recent OSCP or OSCP+ and a CPSA pass, though CRT gained that way can't be used for CHECK. The next CREST level is CCT.

What the exam covers

The exam is a practical assessment worth 160 marks, split between an infrastructure section (100 marks) and a web application section (60 marks), answered through multiple-choice, flag, and short-form questions.

Part
Network awareness (infrastructure), identifying hosts and services on an IP network
Vulnerability assessment (infrastructure) and exploitation of scanner-type findings
Simple exploitation (infrastructure) to obtain data such as emails, passwords, or database records
Desktop lockdown (infrastructure), bypassing a restricted desktop environment
Routing manipulation (infrastructure) to reach otherwise inaccessible systems
Web application assessment of multiple simple web applications on Windows and Unix platforms

Requirements

A valid CREST Practitioner Security Analyst (CPSA) certification is required before booking. CREST describes the level as indicative of 3 or more years of hands-on penetration testing experience.

Format
Practical exam with multiple-choice, flag, and short-form answers, using a provided Kali Linux machine
Questions
160 marks (infrastructure 100, web application 60)
Time
2.5 hours, plus 15 minutes of reading time
Passing score
At least 60% in both the infrastructure and web application sections
Delivery
Selected Pearson VUE test centres

Candidates sign the CREST Code of Conduct and an NDA when booking, can pre-upload files through CRESTDrive, and may retake after 8 weeks. CREST also grants CRT by equivalency (GBP 100 fee) to holders of a CPSA and an OSCP or OSCP+ passed within 3 years, but CRT gained that way can't be used for the UK CHECK scheme.

Cost

Exam fee: GBP 600. Prices exclude VAT, GST, or other applicable tax, and CREST also accepts USD, EUR, AUD, HKD, and SGD. Prices change, so confirm on the issuer's site. Checked 2026-10-12.

Keeping it current

Cycle
3 years from the date the exam was sat
Continuing education
No CPE program published. Renewal is by passing the exam again, and CRT gained by equivalency is revalidated every 3 years with CPSA plus OSCP, OSCP+, or the CRT exam.
Fees
No annual fee published

How to verify that someone holds it

CREST issues CRT as a Credly digital badge, which anyone can click to check its details and authenticity. Use the issuer’s verification page.

On InfoSecHub, a CRT listed on a profile shows Verified by Credly only when a current Credly badge issued to that person confirms it.

Typical roles

  • Penetration tester
  • Security consultant
  • Vulnerability assessor

Related frameworks

Official resources

From CREST. Links open the issuer’s site.

References

  1. CREST Registered Penetration Tester (CRT), CREST
  2. CRT FAQs, CREST
  3. Certifications pricing and booking, CREST
  4. Certification Equivalency Recognition Programme, CREST
  5. CREST digital badges, CREST

Reviewed 2026-10-12. Exam details, prices, and renewal rules change. Confirm them on the CREST website before you register. InfoSecHub is not affiliated with CREST.