The PT2 exam is a 72-hour, non-proctored, hands-on assessment covering both hands-on exploitation and reporting together. It consists of 2 sections across 10 machines in a single network instance, reached over VPN and available 24/7 once started. Both sections are live from the first minute - candidates choose their entry point and switch freely between sections at any time. No paid tool licence is required.

Modern Infrastructure Attacks - 5 machines, 6 flags. Compromise a modern Linux-based estate covering web application exploitation, AI/LLM exploitation, advanced container bypass and pivoting, local Linux privilege escalation, and cloud misconfiguration and IAM privilege escalation.

Active Directory Attacks - 5 machines, 5 flags. Chain a full relay-to-forest-root attack path across two domains, plus an external trust, covering NTLM relay and AD Certificate Services abuse, delegation abuse, child domain controller privilege escalation, forest root privilege escalation, and inter-forest trust exploitation.

Total: 1,000 points across 11 flags. Passing mark: 740 points (74%).

Each exam instance is deployed in isolation, with unique per-instance flags injected at deploy - no candidate ever affects another. Attack from the TryHackMe AttackBox or your own VPN-connected machine. All you need is your usual toolkit. No paid tool licence is required to sit the exam.

PT2 is not an entry-level certification. It assumes comfort with exploiting modern web applications, working in both Linux and Windows, Active Directory fundamentals and common attack primitives, pivoting and tunnelling, and writing findings up for a technical reader. PT1 and WEB1 are the natural route in, but are not required.

The Advanced Penetration Tester path, including the PT2 prep module, is the primary preparation route. Supporting Premium modules include Attacking LLMs and Chaining Vulnerabilities and Container Security, alongside Hacking Active Directory and Authentication and Advanced Server-Side Attacks. PT2 does not bundle Premium - preparation content requires a Premium or MAX subscription.

Flags are validated automatically against the candidate's own instance. Written components (attack description and remediation guidance) are graded against a published rubric, with a human appeal path available for written scores. The passing mark is 740 of 1,000 points (74%).

Your PT2 credential includes a verifiable digital certificate with a unique verification ID, a shareable Credly badge, LinkedIn integration, a QR code for instant verification, a public verification portal for employers, and per-finding write-ups as portfolio evidence.

Pricing is geo-tiered, with a 15% discount for active Premium subscribers and 25% for MAX subscribers:

The purchase includes one free retake and 72-hour exam access; Premium is not bundled. A PT1 + PT2 bundle is also available at a 20% discount.

Additional retakes beyond the included free one can be purchased separately (T1/T2 retake: £200 / $275 / €230).

PT1 proves broad penetration testing skill and WEB1 proves web depth. PT2 is the advanced step above both - more of the attack surface, no prescribed route, and reporting weighted into the score.