VAPT & Offensive
Security Certification
Roadmap
Muhammad Noman Khalid
VAPT PK Group
The Beginner Path: Foundations in
Penetration Testing
Title: Path 1: Beginner – Foundational VAPT Skills
Experience Level: 0 - 2 Years
Target Roles: Security Analyst, Junior Pentester, SOC Analyst, VAPT Trainee.
Core Skills: Networking (TCP/IP), Linux/Windows Basics, Scripting
(Python/Bash), Vulnerability Scanning, Basic Exploit Theory.
Cert / Provider Certification Name Focus Area Cost Est. (USD)
eJPTv2 (Junior Practical Black-Box
INE Penetration Web & Network $125 - $250
Tester) Pentesting
Practical Junior Practical Black-Box
TCM Penetration Web & Network $249
Tester (PJPT) Pentesting
Broad, Conceptual
CEH (Certified
EC-Council Hacking Tools & $500
Ethical Hacker)
Methodology
Foundational
Cybersecurity
CompTIA Security+ $392
Concepts &
Defense
The Mid-Level Path: Core Penetration
Testing
Experience Level: 2 - 5 Years
Target Roles: Penetration Tester, Security Consultant, VAPT Specialist.
Core Skills: Advanced Enumeration, Privilege Escalation (Windows/Linux),
Active Directory Attacks, Web Application Testing (OWASP Top 10), Anti-Virus
Bypass.
The Mid-Level Path: Core Penetration
Testing
Cert / Provider Certification Name Focus Area Cost Est. (USD)
Industry Standard -
OSCP (Certified
OffSec Network & AD $1,749+
Professional)
Exploitation
Real-world black-box
CPTS (Certified
Web, External, and AD $210 (Exam only) +
Hack The Box Penetration Testing
Pentesting (10-day Academy Access
Specialist)
exam)
Enterprise Penetration
GPEN (GIAC
SANS Testing, Methodology, $2,500+ (Training)
Penetration Tester)
Open-book Exam
Advanced topics,
eCPPTv2 (Certified
INE Pivoting, Exploit Dev, $400 (Subscription)
Professional PT)
Buffer Overflows
PNPT (Practical OSINT, Full AD
TCM Network Penetration Compromise, Live $400 (Exam/Training)
Tester) Debrief & Report
The Advanced Path: Red Teaming &
Specialization
Title: Path 3: Advanced – Red Teamer & Offensive Specialist
Experience Level: 5+ Years
Target Roles: Red Team Operator, Advanced Security Researcher, Exploit
Developer, Offensive Security Engineer.
Core Skills: Adversary Emulation, C2 Infrastructure (Cobalt Strike, Covenant),
Detection Evasion, Advanced Exploit Development, Web/Cloud/Wireless
Specialization.
The Advanced Path: Red Teaming &
Specialization
Cert / Provider Certification Name Focus Area Cost Est. (USD)
Advanced Evasion &
OSEP (Experienced
OffSec Active Directory $1,749+
Pentester)
Attacks
Modern Adversary
CRTO (Certified Red
Altered Security Simulation, C2 & $400 (Exam only)
Team Operator)
Evasion
OSWE (Web Expert) Code Review &
OffSec OR OSED (Exploit Exploit Dev (Web or $1,749+
Developer) Binary)
GXPN (Exploit
Advanced Exploit
SANS Researcher & $8,000+ (Course)
Dev, Fuzzing, Memory
Advanced PT)
Advanced Path: Red Team Specialization
Cert / Provider Certification Name Focus Area Cost Est. (USD)
Advanced AD
CRTP (Certified Red $299 (Exam Only) +
Altered Security Attacks, Forest
Team Professional) Labs
Trusts, Persistence
Advanced AD,
CRTE (Certified Red Evasion, Lateral $399 (Exam Only) +
Altered Security
Team Expert) Movement, Labs
Forensics
Red Team Planning,
CRTL (Certified Red $499 (Exam Only) +
Altered Security Management,
Team Lead) Labs
Leadership
Modern Adversary
CRTO (Certified Red $400 (Exam only) +
Altered Security Simulation, C2 &
Team Operator) Training
Evasion
Evasion, Anti-Virus
OSEP (Experienced
OffSec Bypass, Advanced AD $1,749+
Pentester)
Attacks
Advanced Path: Web Application
Specialization
Cert / Provider Certification Name Focus Area Cost Est. (USD)
Code Review,
OSWE (Web Advanced Web
OffSec $1,749+
Expert) Exploit
Development
eWPTXv2 (Web Advanced Web &
$300+
INE Penetration Tester API Exploitation,
(Subscription)
eXtreme) Client-Side
GWAPT (Web Enterprise Web App
SANS Application Testing, $2,500+ (Training)
Penetration Tester) Methodology
Advanced Path: Mobile Security
Specialization
Cert / Provider Certification Name Focus Area Cost Est. (USD)
eMAPT (Mobile Android & iOS Black-
INE Application box & White-box $300 (Subscription)
Penetration Tester) Analysis
Android App Reverse
OSMR (Mobile Reverse
OffSec Engineering, Malware $1,749+
Engineer - New)
Analysis
Securing & Testing
GMOB (Mobile Device
SANS iOS/Android Apps and $2,500+ (Training)
Security Analyst)
Devices
Conclusion & Next Steps
Web 3.0, API CERTIFICATION
Key Takeaways:
Beginner: Start with eJPTv2 & CEH for hands-on, report-focused learning.
Mid-Level: PNPT, Eccpt CPTS and OSCP is your non-negotiable professional benchmark
for real-world testing.
Advanced: Specialization is key (OSEP for AD/Evasion, OSWE for Web, CRTO for Modern
Red Team).
Mindset: VAPT is a technical skill; Red Teaming is a strategic engagement.
HR: CEH > OSCP > CREST CRT > CISSP
Technical: eJPT > CPTS > (PNPT or eCCPT ) , eWPTx and CRTP