PNPT Study Guide — TCM Security Cert | FsKnockouT

The Practical Network Penetration Tester (PNPT) is TCM Security's flagship offensive-security certification. It stands out from other practical certs in one key way — the exam includes a live oral debrief with TCM staff where you present your findings as if the hiring manager at a consulting firm were reviewing your work. This guide covers the exam format, the 5-day structure, OSINT phase tactics, AD compromise strategy, debrief preparation, and how FsKnockouT walkthroughs fit in.

What PNPT is

PNPT is a 5-day external-plus-internal network penetration test followed by a mandatory 15-minute debrief call with a TCM Security staff member. The exam simulates a realistic pentest engagement: you receive scope, perform OSINT, breach the external perimeter, pivot to an internal Active Directory network, achieve domain admin, and write a professional report. Then you get on a video call and present your findings orally.

The underlying training is TCM Security's Practical Ethical Hacking course, Open-Source Intelligence course, External Pentest Playbook, and Windows Privilege Escalation course — all taught by Heath Adams and TCM staff.

Who PNPT is for

  • Junior penetration testers who want a vendor-neutral, hiring-manager-respected credential.
  • Candidates transitioning into offensive security from IT, sysadmin, or SOC backgrounds.
  • Candidates stacking PNPT alongside OSCP+ to differentiate on realistic consulting experience.
  • Internal red-team candidates at companies that do their own pentests.

Exam format

You get 5 days of hands-on exam time, 2 days to write the report, and then schedule a 15-minute debrief call with TCM. The exam flow:

  1. OSINT phase. Gather intelligence on the target organisation using public sources. Credentials, email patterns, employee lists, exposed services.
  2. External perimeter breach. Use OSINT findings to get an initial foothold — often via password spraying, phishing-style credentials, or exposed web services.
  3. Internal pivot. Once inside, enumerate the AD environment, move laterally, abuse misconfigurations.
  4. Domain admin. Achieve full domain compromise using typical AD attack chains — Kerberoasting, ACL abuse, delegation, or credential dumping.
  5. Reporting. Write a professional pentest report documenting the full engagement.
  6. Debrief. Schedule and attend a 15-minute call where you walk a TCM reviewer through your methodology, findings, and remediation recommendations.

Common failure points

  1. OSINT phase neglect. Candidates who speed through OSINT miss the credential leak that was the intended initial-access path. Spend real time here.
  2. Over-reliance on scanners. PNPT rewards patient manual enumeration. Automated scanners miss the custom quirks of the exam environment.
  3. Report quality. TCM grades the report hard. Executive summary matters. Findings must have CVSS scoring, risk ratings, and clear remediation.
  4. Debrief nerves. Many candidates write a perfect report then fail the debrief because they can't articulate their methodology coherently. Practice explaining each finding out loud.
  5. Timeline mismanagement. 5 days is plenty of time until you spend 3 days on the external perimeter. Budget your time — aim to be inside by end of day 2.

Study timeline (10 weeks)

  • Weeks 1-4: TCM Practical Ethical Hacking course. Complete every lab.
  • Week 5: TCM Open-Source Intelligence course. Build an OSINT workflow with Maltego, Hunter.io, LinkedIn scraping, and breach-data sites.
  • Week 6: TCM External Pentest Playbook and Windows Privilege Escalation course.
  • Week 7: Hack The Box AD pro labs (Dante, Zephyr) for internal network pivoting practice.
  • Week 8: Report template development. Study real pentest reports from public sources (PenTestPartners, NCC Group publish samples).
  • Week 9: Debrief rehearsal. Record yourself explaining findings to camera. Watch for filler words and clarity.
  • Week 10: Exam scheduled, final review of your template and OSINT workflow.

Recommended practice

FsKnockouT maintains the PNPT Latest Exam Walkthrough covering current OSINT patterns, perimeter paths, internal pivot chains, and the AD compromise strategy. We also offer pay-after-pass remote support during the 5-day exam window.

Frequently asked questions

How much does PNPT cost?

The exam alone is $399 USD. The full All-Access bundle including the required courses is typically around $599 USD.

Can I fail the debrief?

Yes. The debrief is pass/fail — if TCM decides you cannot clearly explain your own methodology, they fail the overall exam even if your report was strong.

What if I need more time?

You can request a 1-time extension of your exam window, typically 2 additional days. Request this proactively — not at hour 118.

How does PNPT compare to OSCP?

PNPT is more realistic as a consulting-engagement simulation (OSINT, external perimeter, internal pivot, report, oral debrief). OSCP is more rigorous as a pure technical exam. Both are valuable for different hiring contexts.

What is the pass rate?

TCM does not publish a public pass rate. Anecdotally first-attempt pass rates are higher than OSCP+ because the scope is more guided, but the debrief adds a wildcard.

Can I retake if I fail?

Yes. Retakes cost $249 USD and include the same 5-day window plus debrief.

Does TCM provide feedback on fails?

Yes. TCM provides specific feedback on where the fail occurred — report, technical, or debrief — which makes retake preparation efficient.

Ready to prepare?

Get the PNPT walkthrough for current-pool coverage and message @FsKnockouT on Telegram for live exam support. Related reading: OSCP study guide 2026 and CPTS HTB preparation.