A cloud pentesting certification is worth exactly as much as the skill it proves. The question a hiring manager or a client actually cares about is simple: can you land in a live AWS, Azure or Google Cloud environment, find the identity mistakes and exposed services that lead to compromise, and safely show the impact? A certificate earned by answering multiple-choice questions does not answer that. One earned by doing the work in a real environment does.
That is the line Pwned Labs certifications are built around. Every one of them is assessed hands-on, in live cloud accounts with realistic misconfigurations and telemetry, drawn from the same techniques we use on the AWS, Azure and GCP assessments we run for clients. You are not certified for recognizing an attack path on paper. You are certified for walking it.
What a cloud pentesting certification should test
Cloud environments break differently from on-premises networks, and a certification should reflect where the risk actually sits. Identity is the center of gravity: over-permissioned roles, service accounts that can impersonate more powerful identities, weak conditional access, and keys that end up somewhere they should not. Around that sit exposed storage, metadata endpoints that hand out credentials, secrets buried in code and pipelines, and, increasingly, AI and agentic workloads that most teams have never had anyone test.
A meaningful exam puts you in front of those problems and asks you to chain them together the way a real attacker would: recon the surface, recover a credential, gain access, build situational awareness, escalate, move laterally, and demonstrate impact inside the rules of engagement. Then it asks you to document it the way a client engagement requires. If a certification never makes you touch a live environment, it is testing your reading, not your testing.
Choose your certification by cloud platform
Cloud pentesting rewards depth in the platform you actually work in, so rather than one generalist exam, Pwned Labs certifies per provider. Each certification is backed by a structured bootcamp (guided labs, walkthroughs, and instructor support) that prepares you for a hands-on exam.
ACRTP: AWS. For pentesters and red teamers working in Amazon Web Services. Covers IAM privilege escalation, S3 and data-layer exposure, instance metadata and credential theft, lateral movement across accounts, and detection evasion. AWS Cloud Attack and Defense Bootcamp →
MCRTP: Microsoft Azure & M365. For offensive work across Entra ID, Azure and Microsoft 365: identity enumeration, token and consent abuse, conditional access weaknesses, managed identity attacks, and hybrid paths from cloud back to on-premises Active Directory. Microsoft Cloud Attack and Defense Bootcamp →
GCRTP: Google Cloud & Workspace. For GCP and Google Workspace: service account impersonation, IAM binding abuse, Cloud Storage exposure, metadata token theft, and escalation through project and organization structure. Google Cloud Attack and Defense Bootcamp →
MCRTE: Microsoft, Expert. The advanced track for experienced operators: multi-tenant attack paths, complex identity abuse, and full real-world scenarios in Microsoft estates. Microsoft Cloud Attack and Defense Bootcamp, Expert Edition →
Every track includes dedicated AI and agentic security labs, because assessing those workloads is quietly becoming part of the job rather than an optional extra.
Why hands-on assessment matters more now
The gap between an initial breach and full escalation and data exfiltration has collapsed from days to minutes. The cloud provider APIs are exhaustively documented, and attackers script and test against them long before they touch a real target, so the moment they hold a valid credential, enumeration, escalation and exfiltration can fire as one automated chain. A certification that only checks whether you can recognize the steps is a poor proxy for whether you could keep pace with that. Being assessed in a live environment, against realistic telemetry, is the closest a certification gets to the real thing.
How Pwned Labs certifications fit the wider landscape
Several respected organizations certify cloud penetration testers (GIAC's GCPN, SANS course tracks, and OffSec's cloud learning paths among them), and they differ in format, platform depth and price. Many practitioners hold more than one. What sets the Pwned Labs certifications apart is platform-specific depth, a dedicated track for each provider rather than a single generalist exam, and assessment that happens entirely in live environments rather than on paper. Choose based on the cloud you work in and how you want your skills measured.
How the main cloud penetration testing certifications compare
Cloud penetration testing certifications differ in the clouds they cover, how they assess skill, what they cost, and how long they stay valid. The table below sets out the main options as published on each provider's website in September 2026. Prices exclude local taxes and can vary by region and exam sitting.
| Certification | Provider | Clouds | Format and assessment | Price (as listed) | Validity |
|---|---|---|---|---|---|
| ACRTP | Pwned Labs | AWS | Self-paced bootcamp with a 24-hour hands-on exam in a live AWS account | $399, two exam attempts | Does not expire |
| MCRTP | Pwned Labs | Azure and Microsoft 365 | Self-paced bootcamp with a 24-hour hands-on exam in a live tenant | $399, two exam attempts | Does not expire |
| GCRTP | Pwned Labs | Google Cloud and Workspace | Self-paced bootcamp with a 24-hour hands-on exam in a live Google Cloud environment | $399, two exam attempts | Does not expire |
| M-CRTP3 | Pwned Labs | AWS, Azure and Microsoft 365, Google Cloud | The three professional bootcamps above, each with its own 24-hour hands-on exam | $999 for the bundle | Does not expire |
| MCRTE | Pwned Labs | Microsoft cloud and hybrid Active Directory | Self-paced program with a 24-hour hands-on exam in an enterprise-scale environment | $2,500, or $2,000 for MCRTP alumni | Does not expire |
| SEC588 with the GCPN exam | SANS and GIAC | AWS, Azure, Microsoft 365 and Kubernetes | Six-day course, or 36 hours on demand, with labs; the GIAC GCPN exam is a separate proctored test of 75 questions over two hours | Course from $8,780; GCPN exam $999 | GCPN valid for four years |
| CARTP | Altered Security | Azure, including hybrid identity | Lab subscription with a 24-hour hands-on exam and a written report | From $449 for 30 days of lab access | Three-year validity |
| CARTE | Altered Security | Azure, advanced | Lab subscription with a 48-hour hands-on exam and a written report | From $499 for 30 days of lab access | Three-year validity |
| BlackSky cloud labs | Hack The Box | AWS, Azure and Google Cloud | Enterprise labs subscription; each scenario awards a completion certificate; no proctored exam | Not publicly listed; enterprise, by contact | Not listed |
| Cloud Penetration Testing Boot Camp, leading to CCPT | Infosec Institute | AWS and Azure | Five-day boot camp with labs and a proctored CCPT exam of 50 questions in 60 minutes | $4,599, including the exam voucher | Recertification suggested every three years |
Details as published on each provider's website in September 2026: sans.org, giac.org, alteredsecurity.com, hackthebox.com and infosecinstitute.com. Figures can change, so check the provider before you register.
From beginner to certified
You do not need to be certified to start. Pwned Labs has more than 30 free hands-on labs, so you can practice real techniques against live environments before committing to a track. If you are new to the field, the Cloud Penetration Testing beginner's guide walks through the methodology and the attack paths that show up on almost every engagement, and the Cloud Security Engineer Roadmap maps the skills to build and the order to build them in.
When you are ready to prove those skills, pick the bootcamp for your platform and work toward the certification exam. And if it is your organization that needs the assurance, our team also runs cloud penetration testing engagements directly.
Ready to get certified?
Pick the platform you work in and train toward a hands-on exam in live cloud environments.
Choose your bootcampor try the free labs first.Frequently asked questions
Is there a certification for cloud penetration testing? Yes. Alongside generalist options like GIAC's GCPN, Pwned Labs offers platform-specific certifications: ACRTP for AWS, MCRTP for Microsoft Azure and M365, GCRTP for Google Cloud, and MCRTE for expert-level Microsoft work. Each is earned by completing a hands-on exam in a live cloud environment.
Which cloud pentesting certification should I start with? Start with the platform you work in most. AWS-focused roles suit ACRTP, Microsoft environments suit MCRTP, and Google Cloud suits GCRTP. Experienced operators in Microsoft estates can progress to MCRTE.
Do I need prior experience? The bootcamps assume basic security fundamentals and comfort on the command line. The guided labs build the platform-specific skills from there, and the free labs are a good way to gauge where you stand before you enroll.
Are the exams hands-on? Yes. Every Pwned Labs certification is assessed in live cloud environments, and there are no multiple-choice exams.
Does the training cover AI security? Yes. Dedicated AI and agentic security labs and scenarios are part of the curriculum across the certification tracks.
Start your certification
Browse the bootcamps to pick your platform, or explore the free labs to see the training style first. You do not have to learn alone. The Pwned Labs Discord is an active community where beginners and seasoned pros swap help and walkthroughs.