CRTL (RTO II) - Zero-Point Security - 2026

Introduction

On March 27, 2026, I successfully achieved the Certified Red Team Leader (CRTL or CRTO II) certification by Zero Point Security, finally closing the loop. Thus, following my tradition with previous certifications, and due to the lack of reviews that exists out there, I want to share my experience check and if "This course provides you with the knowledge and skills necessary to operate against modern defences".

Let's get one thing out of the way: The certification is called Red Team Leader, and that name will set expectations this course isn't designed to meet. There's no coverage of engagement management, team coordination, or the kind of broad tradecraft depth the title implies. Go in knowing you're buying a focused, advanced operator course built around Cobalt Strike; because that's what it is, and judged on those terms, it holds up

What You're Actually Paying For

If you are about to buy the course at £449, at the moment of writing this review, you are going to receive the following:

Lifetime access to the course material, including its updates.
Labs included at no extra cost. No separate subscription, no add-on fee. They're just there, but with some caveats (more on that later).
Free exam attempts, with a 7-day cooldown between them (more on that below).

One thing to be upfront about before you buy: this course lives and breathes Cobalt Strike. It's built around the Crystal Palace aggressor kit, and almost everything you do in the labs ties back to Beacon. If you're not a Cobalt Strike user, a significant chunk of the practical value evaporates. That's not a criticism, it's just the reality of what you're buying.

Theory

The syllabus runs nine chapters:

C2 Infrastructure
EDR Telemetry
Load-Time Evasion
Runtime Evasion
Post-Exploitation Evasion
User Impersonation & Lateral Movement
Vulnerable Drivers
App Control for Business
Credential Guard

After inspecting all of them, this is my honest opinion of them:

C2 Infrastructure

This chapter is about setting up redirectors so your C2 server doesn't get burned the moment a blue team pokes at your infrastructure. The fundamentals are covered well, and it's genuinely useful knowledge. My only gripe is that I wanted more, a CRTL-level operator should probably know this topic deeply, and the section feels a bit light for that ambition. But as a foundation, it does the job.

The Evasion Chapters (2–5)

This is where I need to calibrate your expectations, because I went in hoping for something closer to a malware development course and that's not what this is. You're not building implants from scratch. What you are doing is learning how evasion techniques work, the real mechanics behind them, and then seeing how those techniques are implemented in Crystal Kit before enabling them in your setup.

Just don't go in expecting a Malware Academy course. This is a different course with a different goal.

The Windows Defence Chapters (6–9)

This is where you learn to deal with the stuff that actually bites you on real engagements, token abuse in an EDR-monitored environment, lateral movement that doesn't trigger kernel callbacks, using vulnerable drivers to quietly disable telemetry, reading and working around App Control for Business policies, and understanding why Credential Guard makes your usual Kerberos tricks fall apart.

The Labs

The labs are browser-based, cloud-hosted, and spin up in about 3–5 minutes. There's a side pane with step-by-step instructions and auto-type support, which is a nice quality-of-life feature. You can save and resume, but only one lab can be saved at a time.

Here's what I'd warn you about before you start:

The once-per-day rule: Each lab can only be launched once a day. Click on a lab section by accident and it fires up immediately, and if you weren't ready to do it today, you're waiting until tomorrow. Learn from my mistakes and be deliberate about which lab you open.

The time limits are tight but manageable. The longest labs give you around an hour. That's enough to complete the guided exercises, but it doesn't leave much room to experiment or go off-script. Which brings me to the bigger issue:

There's no free-roam practice environment before the exam. This is my biggest frustration with the course. The labs guide you through everything step by step, which is great for learning, but when exam time comes, you're on your own with your toolchain and there was nowhere to properly rehearse that. I felt that gap.

The Exam

he exam gives you a 24-hour active session that you can pause. Once launched, you have up to one week to finish it; so you're not forced to do it all in one sitting, but you can't just leave it open indefinitely either. There's a 7-day cooldown between attempts. This isn't punitive; it's there to make sure people are genuinely attempting the exam rather than treating launches as practice runs. Respect it and treat every launch as the real thing.

The environment is an Active Directory network. You get an objective at the start, and you need to compromise the domain to complete it. If you've done CRTO I, the what will feel familiar. The difference is the how. This exam cares deeply about how you operate.

The Scoring - This Is Important

Maximum score: 18 points. Passing score: 16.

10 points come from completing the operational objective.
8 points come from your OPSEC discipline throughout.

Notice that 10 alone doesn't pass you. You need at least 6 of those 8 OPSEC points, which means getting detected isn't just embarrassing; it's failing. The OPSEC score is deducted based on:

Module loads from suspicious memory regions
Suspicious remote memory allocations
Threads pointing to suspicious memory
Suspended processes from suspicious memory
Suspicious lateral movement indicators

My biggest piece of advice: before you touch anything in the exam environment, make sure your entire setup is ready. Crystal Palace hooks loaded, aggressor scripts verified, a checklist of every OPSEC technique from the course sitting in front of you. The exam doesn't reward improvisation.

My exam experience

I'll be honest, my exam did not start smoothly. I spent a frustrating amount of time trying to get my Beacon working on my attacker machine before delivering the payload, and it just wouldn't fire. No obvious reason, no clear error. I started doubting everything. Then I delivered it to the foothold machine anyway, and it worked perfectly.

After that, the rest of the exam flowed well, with one moment where I nearly stalled because I hadn't enumerated carefully enough. The answer was there; I just had to slow down and look properly.

When I finally submitted and hit that button, I had to sit through what genuinely felt like the longest five minutes of my life. The platform is evaluating your OPSEC, going through every detection event, tallying the deductions. And then the result came back. Passed 18/18!

The feedback it gives you is actually one of the best parts: you can see exactly which OPSEC checks you missed. Even if you didn't pass, that breakdown tells you precisely where to go back in the course material and study harder. That's a thoughtful design.

Who Should Take This?

If you hold CRTO I, use Cobalt Strike on real engagements, and you've started asking yourself why your techniques are getting caught rather than just looking for the next bypass, this course is for you. It's not going to make you a malware developer or a full OPSEC expert in one go, but it gives you a genuine conceptual foundation and some immediately usable tradecraft. Think of it as the beginning of that journey, not the end.

However, if you're looking for training that prepares you to lead a red team: manage operators, scope engagements, write deliverables, communicate findings to stakeholders, handle the strategic side of a long-running operation. This course doesn't touch any of that. Not one chapter. The "Leader" in the title is not reflected in the content, so it is not for you.

If you haven't done CRTO I yet, go do that first. Seriously. I'd even recommend reading through it again before you attempt the CRTL exam, because the objective structure leans heavily on that foundational knowledge.

Final Thoughts

I bought this course because I wanted to finish what I started with CRTO I. The content is honest, the labs are included at no extra cost, and the course material gets updated; so what you buy today isn't going to become stale. At £449, whether it's the right call for you depends on where you are in your career.

But let's be clear about been a Red Team Lead entitles, a "Certified Red Team Leader" implies a level of seniority, breadth, and operational leadership that the course does not deliver. You will not come out of this ready to lead a team or run an engagement end to end. You will not come out as a tool-agnostic expert who can adapt to any environment on the fly.

What you get is a sharper operator, someone who understands the mechanics behind evasion rather than just running the playbook. That's worth paying for. But it's essentially CRTO II, and "Advanced Red Team Operator" would be a far more accurate name for what this course actually delivers.