Pwned Labs certifications are earned inside a live cloud account by working a full attack chain against real services. Pass, and you earn a verifiable Credly badge that hiring managers can check.
Your certification path
Everyone starts somewhere. Begin with the cloud you work in, prove you can operate across all three, then move into specialized and expert tradecraft.
Professional · Cloud
AWS Red Team Certification (ACRTP)Attack and defend live AWS: IAM enumeration and privilege escalation, credential theft from metadata, and lateral movement across accounts.View certification →
Azure Red Team Certification (MCRTP)Attack and defend live Azure, Entra ID and Microsoft 365: identity attacks, token and consent abuse, and hybrid on-prem to cloud tradecraft.View certification →
GCP Red Team Certification (GCRTP)Attack and defend live Google Cloud and Workspace: service account impersonation, IAM escalation, and workload compromise.View certification →
Earn all three to be awarded the M-CRTP3
A single credential proving red team capability across AWS, Azure and Google Cloud.
Explore the M-CRTP3 path →Professional · Specialized
Kubernetes Red Team Certification (KRTP)Kubernetes attack, defense and container escape: from RBAC abuse and workload compromise through to node takeover.View certification →
AI Systems Red Team Certification (AISRTP)AI systems attack and defense: prompt injection, tool and function abuse, and model-layer attacks on real deployments.View certification →Expert
Why a hands-on certification?
Employers hiring for cloud penetration testing want evidence you can build, break and fix real cloud environments, not another multiple-choice pass. Because every Pwned Labs exam runs in a live account, the tools, log sources and API calls you use are the ones you use on the job. That makes the credential difficult to fake and easy for an employer to trust, and it is why our students have used it both to land their first role in the industry and to progress in the one they already hold.
Training or certification?
Training and certification are two ends of the same path. The bootcamp teaches the tradecraft through guided, hands-on sessions in live cloud accounts. The certification is the proof: a single practical exam, assessed on whether you reached the objective, not whether you memorized a control name. Most people train first and certify when they are ready. Prefer to build the skills before an exam? Explore per-provider training in Azure, GCP and AI, or training for teams.
Which certification should you start with?
Start with the provider you already work in. That is where a certification converts to opportunities fastest, and where you can apply the tradecraft immediately.
Choosing from scratch? Market share is a fair proxy for where the roles are: AWS leads at roughly 29 percent, Azure follows near 20 percent, and Google Cloud around 13 percent. AWS and Azure are the two most common places to start. Two caveats matter. Market share is global, but hiring is local, so check which providers dominate in your region and whether you are aiming for local or remote roles. And wherever an organization already runs Microsoft, Active Directory, Microsoft 365 and Windows Server, Azure is the default, which is a very large share of enterprises.
The tradecraft is not siloed either. Identity, storage and logging attacks follow the same shape on every provider, which is why practitioners who certify in one cloud add the others in a fraction of the time.