The PNPT (Practical Network Penetration Tester) is a rapidly growing, fully hands-on penetration testing certification from TCM Security. Created by Heath Adams (TheCyberMentor), the PNPT has gained massive popularity as a practical, affordable alternative to the OSCP. The exam requires candidates to perform a full external and internal network penetration test against a realistic corporate environment, write a professional report, and present findings in a live debrief — mirroring exactly what professional pentesters do on real engagements.

Certification Structure

Exam format: 5-day (120-hour) penetration test against a live network environment
Phase 1: External penetration test — compromise the external-facing network (OSINT, phishing, external exploitation)
Phase 2: Internal penetration test — pivot into the internal Active Directory environment, escalate privileges, achieve domain admin
Phase 3: Professional penetration test report (executive summary + technical findings + remediation recommendations)
Phase 4: Live 15-minute debrief with a TCM Security assessor — present findings and answer questions as if briefing a client
Passing criteria: Successfully achieve objectives in each phase + acceptable report + successful debrief

What Makes PNPT Unique

Full engagement simulation: Unlike other exams that test isolated box-by-box hacking, PNPT simulates a complete real-world pentest engagement from start to finish
OSINT and phishing included: The only major cert that tests Open Source Intelligence gathering and social engineering (phishing) as part of the exam
Live debrief: Tests your ability to communicate findings to stakeholders — a critical skill that no other cert exam tests
Active Directory focused: Heavy emphasis on AD attacks (Kerberoasting, AS-REP Roasting, Pass-the-Hash, Golden Ticket) which dominate real-world corporate networks

TCM Security Training Courses (Recommended Preparation)

Practical Ethical Hacking (PEH): The flagship course — 25+ hours covering networking, Linux, Python, enumeration, exploitation, AD attacks, web apps, wireless, and reporting
Open-Source Intelligence (OSINT) Fundamentals: OSINT methodology, tools, and techniques for reconnaissance
External Pentest Playbook: External network testing methodology
Windows Privilege Escalation for Beginners: Comprehensive Windows privesc techniques
Linux Privilege Escalation for Beginners: Comprehensive Linux privesc techniques
Movement, Pivoting, and Persistence: Post-exploitation techniques for network navigation

Cost

PNPT exam voucher: $399 (includes one free retake)
TCM Security Academy subscription: $30/month or $300/year — includes ALL TCM Security courses (PEH + OSINT + privesc + AD attacks + more)
Individual course purchases: $0–$30 each on TCM Academy
Total recommended path: $399 (exam) + $300/year (all courses) = $699 total

Study Timeline

With IT/security experience: 2–4 months of preparation
Career changers (starting from PEH course): 4–6 months
Pass rate: Estimated 60–70% on first attempt; free retake included

Career Impact

Average salary: $90,000–$130,000 for PNPT holders
Target roles: Junior penetration tester ($70K–$100K), penetration tester ($90K–$140K), red team operator ($100K–$160K), security consultant ($95K–$150K)
Growing recognition: PNPT is increasingly accepted by employers as proof of practical pentesting ability; many hiring managers now list PNPT alongside OSCP in job requirements
Freelance/consulting: PNPT skills enable freelance pentesting — engagements typically $5,000–$25,000 for small/medium businesses
Stepping stone: Excellent preparation for OSCP — many candidates use PNPT → OSCP as their certification progression

PNPT vs. OSCP vs. CEH

PNPT: Most realistic engagement simulation; includes OSINT + phishing + live debrief; most affordable ($399–$699); includes free retake; growing recognition
OSCP: Longest-standing practical cert; most widely recognized; harder (no OSINT/phishing but more technical depth); more expensive ($1,649+); no free retake
CEH: Multiple-choice exam; broadest name recognition with HR; least technical depth; most expensive ($2,199+); best for resume filtering
Best path: PNPT first (affordable, practical, includes retake) → OSCP (deepens skills, maximum recognition) → CEH optional (if needed for specific job requirements)

Who It Is For

Aspiring penetration testers who want to prove real-world hacking skills at an accessible price point; career changers using TCM Security's Practical Ethical Hacking course as their entry into offensive security; Security+ holders ready to move into hands-on pentesting; OSCP candidates who want practical exam experience before attempting the more expensive OSCP; bug bounty hunters who want a formal credential validating their skills; IT professionals who want to transition into offensive security through the most affordable quality training path available.

Pnpt — practical network penetration tester by tcm security

What users say

Rate this Education

Related Tools

Related Moonlites

Related Creators

About