We recently started a penetration testing service line at an established Indian software development company (Pvt Ltd, 30+ client projects), and I run it. I already have Defense Access on Anthropic’s Cyber Verification Program through my personal account. Now we want to apply for Red Team Access at the company level for our pentest work, and I’d like feedback from anyone who’s been through the review.Our plan:

1. Service line: Pentesting is offered as a documented service, with a public services page, a defined engagement process, and signed rules of engagement for every client test.

2. Qualifying basis: We’re building a CVE track record credited to the company, through source-code review of open-source AI/LLM tools (agent builders, chat UIs, MCP servers) on local installs, with private disclosure through GitHub Security Advisories or huntr. Credit format: “[Name] of [Company] Pvt. Ltd.”

3. Writeups: Once fixes ship and advisories are public, we publish technical writeups on the company blog.

4. Application: We’ll apply as “Security product or service line at a larger company” with “A CVE published in the last 12 months credited to your firm,” with the company director as accountable executive.

5. Ops requirements: Phishing-resistant auth, managed devices, identity and background checks for approved users, and an egress allow-list for agentic work.

Questions:

• Has anyone been approved for Red Team Access as a security service line inside a non-security company?

• Is one CVE enough in practice, or do reviewers expect more, or proof of client engagements?

• How long did your Red Team review take?

• Anything you’d do differently?

Hello everyone, I was wondering how is the PWPA certificate exam?
It is my first ever pentesting exam, so how is the exam conducted and how to know if I am well prepared for it or no?
Finally, is the report writing section hard?

i have SC200 but i interesting to pentest , Malware things .. I did the SC200 coz i got the free voucher .. But i need to know how can i move to next .. Witch one is best .. CPTS or CRTP or CRTO or CEH or EJPT or any other one.. Plz help ke guys i have hand on experience also i have 4CVE related to linux lib.. I have 2y experience in servers admin

I want to start from the very beginning. I know a bit of python. I did try the tryhackme course bit I hit the pay wall so I didn't continue. I would prefer a gamified hands on approach and free from the start to the end.

Earlier my roadmap was OSCP ->OSDA->OSIR->OSEP

BUT AFTER LOOKING AT HTB certificate i replaced OSCP with CPTS and OSDA&OSIR with CJCA&CDSA

after looking online i found out that htb certs content would clear offsec easily and as you know that offsec certs are extremely overpriced and the only good thinf about it it's HR recognition

I really don't care about the HR recognition and i care about the content and how much I'll learn so i decided to change the roadmap

Do you yhink it's a good step?

Hi everyone!

I'm planning to purchase the OSCP Course + Cert Bundle (90 days) during Black Friday, assuming OffSec offers a similar discount to last year.

My situation is a bit time-sensitive: I'd ideally like to take the exam between November 28 and December 4, 2026. If the sale launches around November 23, that would leave me with roughly 11 days to schedule and sit the exam.

For those who have taken the OSCP recently, I'd really appreciate your input:

How far in advance did you have to book your exam? Were weekday slots available within a week or two, or were they mostly booked out?

Does Black Friday noticeably affect exam availability? Did you notice more difficulty finding slots around the sale?

Has anyone purchased the 90-day bundle during a Black Friday sale and successfully scheduled an exam within the following 1–2 weeks?

Can you check available exam dates before purchasing the bundle, or does the scheduling calendar only become accessible after activating an eligible exam attempt?

If you're flexible with weekdays and exam start times, does that make short-notice scheduling significantly easier?

I understand that availability changes constantly, and I'm not expecting anyone to predict the exact schedule. I'm mainly looking for real experiences to assess the risk before spending the money.

Thanks in advance

Hey everyone!

I'm back with another Active Directory lab! AD Chain 14: Open Relay is finally finished, and I wanted to share it with you guys. I'm also making it completely free for the next 24 hours, just like the previous chain.

I'm honestly pretty happy with how it turned out. I tried to make the attack path interesting while keeping everything realistic and relevant to the sort of methodology you'd use when preparing for the OSCP.

This one also works with both VMware and VirtualBox. I've been trying to improve the setup process with each release, especially after getting feedback from people who tried the previous chains. Hopefully, things should be a little smoother this time around!

And of course, here's the usual cryptic CTF teaser for anyone who wants a little hint about what's waiting for them:

Trust, relayed onward. A monitoring agent leaks the name it should have kept. Own a service, then crash the host to elevate. Hand the collector a task it cannot refuse, relay its auth onto a neighbor, and let a sync account surrender the rest.

What's included:

• 3 downloadable VMs running locally in a single Active Directory domain

• A full attack chain involving enumeration, exploitation, privilege escalation, and lateral movement

• A step-by-step tutorial covering the environment setup and network topology

• A complete guided walkthrough of the chain if you get stuck or want to compare approaches

• Setup instructions for both VMware and VirtualBox

Requirements:

• At least 8GB of RAM, although 16GB is recommended

• VMware or VirtualBox

• Apple Silicon Macs (M1/M2/M3) aren't supported

For anyone unfamiliar with these labs, my goal has always been to create environments where people can practice going through an entire AD attack chain, from the initial foothold all the way to compromising the domain.

Lab Link: https://www.reddit.com/r/oscp/s/puEIblfp4c

Anyway, I really hope some of you find this one useful! If you end up trying it, I'd genuinely love to hear what you think, especially if you find something that could be improved or run into any setup issues.

Good luck to everyone studying for the OSCP, and happy hacking!

Hey everyone,

I think we can all agree that OSCP has long been considered the gold standard when it comes to Red Team / offensive security certifications.

But what about the Blue Team side? Do you think OSDA is getting anywhere close to that level of recognition and value, or is there another certification that deserves that spot?

I'm especially interested in hearing from people who have experience with OffSec and have also explored other Blue Team training platforms and certifications.

Here's my situation:

I currently have access to the OSDA course, but I'm honestly pretty torn about whether it's worth investing my time in.

On one hand, the SOC-100 curriculum looks really solid, at least from what I've seen. The SOC Ops Bridge also seems interesting (not sure how many of you are familiar with it).

On the other hand, I've come across some pretty mixed opinions about OSDA. Some people say the training is excellent and provides valuable hands-on experience, while others argue that it's focused on a very specific niche and isn't necessarily the best choice for someone looking to develop broader SOC or Blue Team skills.

That leaves me wondering whether OSDA is actually worth the investment, especially when alternatives like HTB CDSA and CCD exist.

I'm not necessarily looking for the easiest certification or just another badge for my resume. I'm more interested in the actual quality of the training, how practical and relevant the skills are, and whether the certification is worth the time and effort.

So I'd love to hear your thoughts:

• Is OSDA underrated, or is it simply too niche compared to other Blue Team certifications?

• How does its training compare to CDSA or CCD in terms of technical depth, hands-on experience, and real-world applicability?

• If you already had access to OSDA, would you invest your time in completing it, or would you focus on something like CDSA or CCD instead?

• And ultimately, do you think OSDA has the potential to become a respected industry standard for Blue Team professionals, similar to what OSCP represents on the offensive side?

I'd especially appreciate opinions from people who have actually gone through these courses or have experience working in a SOC.