Engagement workflow, real diagrams, and exam prep — a fully practical network penetration test: OSINT → external → Active Directory → report → a live debrief.
Warning
Educational & authorized use only. Offensive techniques are explained conceptually for understanding, methodology, and defense — no weaponized step-by-step playbooks or exploit code. Use them only against systems you own or are explicitly authorized in writing to test. See the CEH hub's legal & ethics.
Note
Unofficial & no fabrication. Not affiliated with or endorsed by TCM Security. Exam specifics are from TCM's official PNPT page; volatile items (price, exact structure, voucher terms) should be re-checked there. Compiled 2026-06-21.
| Item | Detail |
|---|---|
| Provider | TCM Security · vendor-neutral |
| Exam | 5-day practical assessment + 2-day report + a live 15-minute debrief |
| Style | Fully practical — no multiple choice, no capture-the-flag flags |
| Signature | The live debrief: present & defend your methodology like a consultant |
| Included | 1 attempt + 1 free retake, bundled training; non-expiring (verify on TCM) |
Full details: exam structure.
| Section | Contents |
|---|---|
| Overview | What is PNPT · Exam structure |
| Engagement phases | The PNPT workflow, phase by phase |
| Exam prep | Study plan — lab build, workflow practice, the debrief |
| # | Phase | Page |
|---|---|---|
| 1 | OSINT & reconnaissance | 01-osint-and-reconnaissance.md |
| 2 | External penetration testing | 02-external-penetration-testing.md |
| 3 | Active Directory exploitation | 03-active-directory-exploitation.md |
| 4 | Lateral movement & pivoting | 04-lateral-movement-and-pivoting.md |
| 5 | Reporting & the debrief | 05-reporting-and-the-debrief.md |
The PNPT is the budget-friendly, engagement-style practical cert:
- A realistic lead-in or alternative to OSCP; more report- and consultant-focused than the knowledge-based CEH.
- Defender's mirror → its AD-compromise and lateral-movement focus is exactly what the attack → defense matrix and WALLIX / PAM hub exist to prevent and audit.
PNPT, PJPT and TCM Security are trademarks of TCM Security, used here for identification and educational purposes only.