Certified Red Team Manager

Exam format

CREST logo

Certified Red Team Manager Exam Format

CCRTM

Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The CREST Certified Red Team Manager (CRTM) certification is an advanced, practitioner-focused credential designed for experienced cybersecurity professionals who lead or aspire to lead offensive security operations. It validates a deep understanding of how to plan, manage, and execute sophisticated red team engagements within a structured governance framework. Unlike entry-level penetration testing certifications, CRTM focuses on the managerial, strategic, and technical leadership aspects of red teaming. Candidates must demonstrate mastery in adversary emulation, threat intelligence integration, cross-functional collaboration with defensive teams, and the application of legal and ethical frameworks. The certification is recognized globally as a mark of excellence for senior red team leaders, often required by consulting firms and large enterprises for roles such as Red Team Lead, Director of Offensive Security, and Principal Security Consultant. CRTM holders prove they can align offensive operations with business objectives, communicate complex findings to executives, and drive continuous improvement in an organization's security posture.

60 questions
66% to pass
6 domains

Exam facts at a glance

The published specifications for this certification.

SpecificationValue
Questions60
Time limitNot published by the vendor
Passing score66% — Multiple choice: 'candidates must achieve at least two thirds or 40 marks'; long form: 'at least two thirds or 80 marks'; scenario exam: 'at least two thirds or 120 marks' - 'Passing one of the sections but failing the other one will result in a failure overall'
Domains6
LevelExpert
Question bank here60 questions
Published formatNot published by the provider as a total question count; official format: multiple-choice test of 60 questions (1 hour) plus 4 long-form questions worth 30 marks each (2 hours) - 3 hours total - and a separate 3-hour written scenario exam, each with 15 minutes reading time
SourceOfficial exam specification, published by the vendor

Official domain weights

The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.

DomainWeightTopicsPractice Qs
Red Team Management and Leadership25%
  • Defining red team objectives and scope aligned to business risk
  • Building and managing a high-performance red team
  • Operational planning, resource allocation, and team motivation
  • +2 more
15
Technical Attack Lifecycle Management20%
  • Planning and executing advanced persistent threat (APT) simulations
  • Managing multi-stage attack chains (initial access, persistence, C2, exfiltration)
  • Leveraging advanced tools, custom implants, and living-off-the-land techniques
  • +1 more
12
Threat Intelligence and Adversary Emulation20%
  • Integrating threat intelligence into red team operations
  • Adversary profiling and TTP (Tactics, Techniques, Procedures) mapping
  • Designing realistic attack scenarios and kill chain simulations
  • +1 more
12
Defensive Engagement and Blue Team Integration15%
  • Collaborating with blue teams and SOC (Security Operations Center)
  • Purple teaming methodologies and knowledge transfer
  • Measuring detection and response effectiveness through red team results
  • +1 more
9
Communication, Deconfliction, and Professionalism10%
  • Managing crisis communication during live operations
  • Deconfliction procedures to prevent operational incidents
  • Writing professional reports, executive summaries, and technical annexes
  • +1 more
6
Governance, Risk, and Compliance (GRC) for Red Teams10%
  • Understanding regulatory requirements (GDPR, PCI DSS, ISO 27001) and red team impact
  • Rules of engagement (RoE) and legal documentation
  • Risk assessments, reporting, and executive presentation of findings
  • +1 more
6

The heaviest domain is Red Team Management and Leadership at 25%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.

Note from the vendor record: Issuer confirmed as CREST (International); the credential is active and was formerly titled CREST Certified Simulated Attack Manager (CCSAM). CREST states there are no prerequisites to the exam, though prior experience leading red-team engagements in a regulated environment is recommended; delivery is at Pearson VUE centres (written components) and the qualification is valid for three years. The exam is described as recognised by governments, regulators and intelligence-led frameworks and as 'a critical requirement by the Bank of England as part of the CBEST accreditation process'. Caveat: CREST's pricing page groups this exam under a single Certified-level price rather than publishing a per-exam fee. Official exam page

More about the Certified Red Team Manager exam

Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.

Related certifications

Explore other certifications in the same category and see how they stack up.

Frequently asked questions

Everything you need to know about the Certified Red Team Manager exam.