A cloud pentesting certification is worth exactly as much as the skill it proves. The question a hiring manager or a client actually cares about is simple: can you land in a live AWS, Azure or Google Cloud environment, find the identity mistakes and exposed services that lead to compromise, and safely show the impact? A certificate earned by answering multiple-choice questions does not answer that. One earned by doing the work in a real environment does.
That is the line Pwned Labs certifications are built around. Every one of them is assessed hands-on, in live cloud accounts with realistic misconfigurations and telemetry, drawn from the same techniques we use on the AWS, Azure and GCP assessments we run for clients. You are not certified for recognizing an attack path on paper. You are certified for walking it.
What a cloud pentesting certification should test
Cloud environments break differently from on-premises networks, and a certification should reflect where the risk actually sits. Identity is the center of gravity: over-permissioned roles, service accounts that can impersonate more powerful identities, weak conditional access, and keys that end up somewhere they should not. Around that sit exposed storage, metadata endpoints that hand out credentials, secrets buried in code and pipelines, and, increasingly, AI and agentic workloads that most teams have never had anyone test.
A meaningful exam puts you in front of those problems and asks you to chain them together the way a real attacker would: recon the surface, recover a credential, gain access, build situational awareness, escalate, move laterally, and demonstrate impact inside the rules of engagement. Then it asks you to document it the way a client engagement requires. If a certification never makes you touch a live environment, it is testing your reading, not your testing.
Choose your certification by cloud platform
Cloud pentesting rewards depth in the platform you actually work in, so rather than one generalist exam, Pwned Labs certifies per provider. Each certification is backed by a structured bootcamp (guided labs, walkthroughs, and instructor support) that prepares you for a hands-on exam.
ACRTP: AWS. For pentesters and red teamers working in Amazon Web Services. Covers IAM privilege escalation, S3 and data-layer exposure, instance metadata and credential theft, lateral movement across accounts, and detection evasion. AWS Cloud Attack and Defense Bootcamp →
MCRTP: Microsoft Azure & M365. For offensive work across Entra ID, Azure and Microsoft 365: identity enumeration, token and consent abuse, conditional access weaknesses, managed identity attacks, and hybrid paths from cloud back to on-premises Active Directory. Microsoft Cloud Attack and Defense Bootcamp →
GCRTP: Google Cloud & Workspace. For GCP and Google Workspace: service account impersonation, IAM binding abuse, Cloud Storage exposure, metadata token theft, and escalation through project and organization structure. Google Cloud Attack and Defense Bootcamp →
MCRTE: Microsoft, Expert. The advanced track for experienced operators: multi-tenant attack paths, complex identity abuse, and full real-world scenarios in Microsoft estates. Microsoft Cloud Attack and Defense Bootcamp, Expert Edition →
Every track includes dedicated AI and agentic security labs, because assessing those workloads is quietly becoming part of the job rather than an optional extra.
Why hands-on assessment matters more now
The gap between an initial breach and full escalation and data exfiltration has collapsed from days to minutes. The cloud provider APIs are exhaustively documented, and attackers script and test against them long before they touch a real target, so the moment they hold a valid credential, enumeration, escalation and exfiltration can fire as one automated chain. A certification that only checks whether you can recognize the steps is a poor proxy for whether you could keep pace with that. Being assessed in a live environment, against realistic telemetry, is the closest a certification gets to the real thing.
How Pwned Labs certifications fit the wider landscape
Several respected organizations certify cloud penetration testers (GIAC's GCPN, SANS course tracks, and OffSec's cloud learning paths among them), and they differ in format, platform depth and price. Many practitioners hold more than one. What sets the Pwned Labs certifications apart is platform-specific depth, a dedicated track for each provider rather than a single generalist exam, and assessment that happens entirely in live environments rather than on paper. Choose based on the cloud you work in and how you want your skills measured.
From beginner to certified
You do not need to be certified to start. Pwned Labs has more than 30 free hands-on labs, so you can practice real techniques against live environments before committing to a track. If you are new to the field, the Cloud Penetration Testing beginner's guide walks through the methodology and the attack paths that show up on almost every engagement, and the Cloud Security Engineer Roadmap maps the skills to build and the order to build them in.
When you are ready to prove those skills, pick the bootcamp for your platform and work toward the certification exam. And if it is your organization that needs the assurance, our team also runs cloud penetration testing engagements directly.
Frequently asked questions
Is there a certification for cloud penetration testing? Yes. Alongside generalist options like GIAC's GCPN, Pwned Labs offers platform-specific certifications: ACRTP for AWS, MCRTP for Microsoft Azure and M365, GCRTP for Google Cloud, and MCRTE for expert-level Microsoft work. Each is earned by completing a hands-on exam in a live cloud environment.
Which cloud pentesting certification should I start with? Start with the platform you work in most. AWS-focused roles suit ACRTP, Microsoft environments suit MCRTP, and Google Cloud suits GCRTP. Experienced operators in Microsoft estates can progress to MCRTE.
Do I need prior experience? The bootcamps assume basic security fundamentals and comfort on the command line. The guided labs build the platform-specific skills from there, and the free labs are a good way to gauge where you stand before you enroll.
Are the exams hands-on? Yes. Every Pwned Labs certification is assessed in live cloud environments, and there are no multiple-choice exams.
Does the training cover AI security? Yes. Dedicated AI and agentic security labs and scenarios are part of the curriculum across the certification tracks.
Start your certification
Browse the bootcamps to pick your platform, or explore the free labs to see the training style first. You do not have to learn alone. The Pwned Labs Discord is an active community where beginners and seasoned pros swap help and walkthroughs.
.png)