Skip to content
    chevron design overlay on image
    Red Team Track · Journeyman

    Red Team Journeyman Course

    Two weeks of advanced, operator-grade training that builds on apprentice foundations to run full-lifecycle Red Team assessments with real stealth and operational maturity.

    Course Overview

    The Red Team Journeyman Course is an intensive, two-week, instructor-led program that builds on apprentice-level foundations to develop operators capable of executing full-lifecycle Red Team assessments with precision, stealth, and operational maturity. Students gain deep hands-on experience across mission preparation, exploitation, post-exploitation, and mission effects across 13 advanced labs, culminating in a 19-hour practical certificate exam.

    COURSE OUTCOMES

    What You’ll Learn

    RTJC takes you from apprentice fundamentals to operator-grade tradecraft, building the tooling, evasion, and infrastructure skills needed to run advanced, full-lifecycle engagements.

    Advanced Red Team infrastructure and C2
    Stealthy reconnaissance and exploit weaponization
    Custom C# payloads and AV bypass
    Advanced post-exploitation and lateral movement
    Active Directory enumeration and exploitation
    Advanced tunneling and persistence
    Mission effects and operational logging
    And more!
    advanced red team lab collaboration

    APPLIED CAPABILITIES

    Skills You'll Gain

    • How to configure and operate Cobalt Strike team servers, listeners, beacons, and BOF plugins at a journeyman level
    • How to build and execute custom C# post-exploitation tools using Visual Studio and execute-assembly
    • How to chain persistence, escalation, and remote execution across a full enterprise environment
    • How to set up advanced tunneling with SOCKS proxies, portfwd, SSH tunnels, and proxychains
    • How to bypass application whitelisting and AV using living-off-the-land techniques and custom payloads
    • How to troubleshoot failed techniques under real operational conditions
    • How to maintain situational awareness and operate with professional Red Team tradecraft
    Register Today

    COURSE STRUCTURE

    Inside This Course

    RTJC runs as two weeks of live, instructor-led training built around 13 advanced hands-on labs with a 19-hour exam the final two days. Explore how the course is structured, how you'll learn, and where the certificate leads.

    chevron design overlay on image

    What k>fivefour Students Are Saying

    I came in with more than a decade of offensive security experience on Linux, likely well ahead of the typical student, and k>fivefour still stood out. They build the course the way a real Red Team assessment works, grounded in capability proven on live networks.

    Jeff U.

    DoW Red Team Operator

    As my first time using Cobalt Strike and performing Red Teaming activities, I really appreciated how the course followed a realistic scenario, from phishing through to gaining full control of a network. It made the experience very engaging and helped me clearly understand the power of the tools used throughout.

    Alejandro M.

    Commercial Red Team Operator

    As someone with a red team background, I appreciated that it baselines people on the core concepts and on Cobalt Strike, the most common C2 tooling out there, while still resurfacing fundamentals even experienced operators forget. The DoW Certified Red Team (DCRT) approved logging methodology alone was one of the most valuable parts, and it's something every red team should be doing.

    Austin S.

    DoW Red Team Operator

    The multi-level tunneling work stood out as the most valuable part for our future operations. The difficulty is genuinely high, but that is exactly what makes it worth doing.

    RTJC Student

    Allied Partner Force

    This isn't content built in a vacuum. It was developed by Red Teamers, based on techniques that actually worked on real DoW assessments against real DoW networks. That's what sets k>fivefour apart.

    Jeff U.

    DoW Red Team Operator

    I came in a little skeptical about how much could be covered in such a short amount of time, but the content was delivered really well. I was very impressed by the coverage of lateral movement, persistence, and getting a feel for how to move around an enterprise network.

    Logan H.

    DoW Red Team Operator

    My first real exposure to Red Team operations, and one of the most insightful courses I've taken. Seeing privilege escalation, lateral movement, and domain migration in a realistic scenario gave me a real understanding of the Red Team mindset. The two-instructor format kept the perspectives diverse and the pace engaging throughout.

    Cyber Operator

    Allied Ministry of Defense

    I expected surface-level material and got the opposite. It goes deep on high-level Linux exploitation, starts you on the fundamentals, then ramps up fast. The hands-on labs and writing up my own work are what made it stick, and the 9-hour final in a real-world lab environment made me prove I actually understood it.

    Rusty R.

    DoW Red Team Operator

    OUR TEAM

    Meet Our Instructors

    Learn from operators who've worked the missions they teach. Our instructors bring real-world cyber operations experience directly into every course.

    k>fivefour Principal Instructor Matt Hasty Matt Hasty is a U.S. Navy veteran and Principal Instructor at k>fivefour, bringing over a 13+ years of cybersecurity and Red Team operations experience to every session he leads. He holds a Master of Science in Cybersecurity and Information Assurance and a Bachelor of Science in Electrical Engineering, along with certifications including RTAC, RTJC, OSCP, and GXPN. Across roles as a Senior Penetration Tester, Red Team Engineer, and Advanced Cybersecurity Engineer, Matt sharpened his skills in vulnerability research, risk assessment, and automation. His ability to translate complex tradecraft into practical, mission-ready skills is what sets his instruction apart and makes a direct impact on every student he trains. LinkedIn
    Red Team Instructor Noel Stephens Noel Stephens is an Air Force Veteran with over 10 years in Cyber Security, ranging from ICS to Electronic Warfare to Offensive Operations. His most recent role was as an operator for the top DoD Red Team. During that time he also worked weekends as a SOC Analyst for the IRS to bolster his understanding of all aspects of the Cyber domain. Now, Noel Stephens works as a Threat Emulation SME and instructor for k>fivefour while also developing new courses and techniques. LinkedIn

    BEFORE YOU ENROLL

    Frequently Asked Questions

    Answers to the questions we hear most often about k>fivefour training, from prerequisites and delivery format to what the certificate exam involves. If your question isn't covered here, reach out and our team will help.

    Why choose k>fivefour?

    Our courses are built, updated, and taught by operators who currently do this work for real, not by trainers reading from a script. The tradecraft you learn reflects how adversaries operate today, and it evolves as the threat evolves. You spend the majority of your time hands-on in realistic environments, so you finish mission-ready, with skills you can put to work immediately.

    What is Battlegrounds?

    Battlegrounds is our library of realistic, hands-on cyber training environments where you practice against live scenarios. Battlegrounds is available through a separate subscription. Learn more on our Battlegrounds page here.

    How long is the exam?

    Most k>fivefour exams are approximately 9 hours of hands-on practical work. Longer courses have longer exams: the Red Team Journeyman exam runs approximately 19 hours. Exact timing is confirmed during each course.

    What's included in the course fee?

    Each instructor-led course includes live instruction, all course materials, access to a fully provisioned virtual lab environment for hands-on exercises, a welcome bag including some awesome swag, and a certificate box with personalized gear once you pass.

    What do the apprentice, journeyman, and master levels mean?

    They mark increasing depth and operational maturity. Apprentice courses build the core methodology and skills for a discipline, journeyman courses develop independent operator-level tradecraft, and specialization courses go deep on a specific domain such as Linux and Unix exploitation or cyber ops forensics.

    How long are test days?

    Test days are approximately 9 hours long. However, it's up to the student and their individual performance.

    Do you offer training for teams or private cohorts?

    Yes. We work with organizations to deliver training to teams, including enterprise and group arrangements. Contact us to talk through options and pricing for your team.

    What's the nearest airport to the training center?

    Huntsville International Airport (HSV) is the closest airport to our training facility at Bridge Street. It's a short drive from the training center and the nearby hotels.

    Do you offer any discounts?

    Discounts may be available for group and team enrollments, government and military personnel, and returning students. Confirm which apply to you by contacting us with your situation, and we'll let you know what's available.

    What is your cancellation, rescheduling, and refund policy?

    If you need to cancel or reschedule, contact us as soon as possible. Cancellations made 30 or more days before the course start date are eligible for a full refund or a no-cost transfer to a future session. Between 15 and 29 days out, you can transfer to a future session at no cost, or receive a refund less a 15% administrative fee. Within 14 days of the start date, fees are non-refundable, though a one-time transfer may be available at our discretion. You may also send a substitute attendee from your organization at no charge up to the course start date. If k>fivefour cancels or reschedules a course, you'll receive a full refund or a transfer of your choice.

    Do your courses include a certificate?

    With the exception of COIC, every course concludes with a hands-on practical exam. Students who pass earn a k>fivefour certificate for that course. COIC students receive a certificate after passing an exam with more than 100 questions.

    What payment methods do you accept?

    Individuals can pay by credit card directly through our website. For government and enterprise customers, we accept purchase orders, government purchase cards (GPC), and training request forms such as the SF-182. Contact us to arrange invoicing or to work through your organization's procurement process.

    What happens if I don't pass the exam?

    You can retake the exam. Retake options and pricing are listed on each course page, or you can contact us to schedule one.

    What equipment do I need?

    You'll need a laptop capable of connecting to a remote lab environment and a reliable internet connection. Your hands-on labs run in a fully provisioned virtual environment we supply. For the proctored exam, you'll also need a webcam.

    Which course should I take first?

    If you're new to the field, start with our Intro to Cyber Ops or an apprentice-level course, depending on your background: the Red Team Apprentice Course for offensive skills or the Blue Team Apprentice Course for defensive skills. Journeyman and specialization courses build on that foundation. If you are not sure, reach out and we'll help guide you.

    What's the difference between the Red Team and Blue Team tracks?

    The Red Team track teaches offensive operations, including how to emulate real-world adversaries to identify and exploit weaknesses. The Blue Team track teaches defensive operations, including how to detect, hunt, and respond to those same threats. Many students train across both tracks to build a purple, cross-domain skill set.

    What hotels would you recommend nearby if I attend in person?

    The nearest hotels to our training center include:

    • The Westin Huntsville
    • Hyatt Place Huntsville/Research Park/Redstone
    • Hampton Inn & Suites Huntsville/Research Park
    • Home2Suites by Hilton Huntsville/Research Park

    Can exam attempts be taken virtually?

    Yes. Students will need a webcam and a modern web browser. Additionally, students will need to allow our proctors to record their screens and webcams throughout the exam. Additional information about the proctoring process is provided during each course.

    Can I earn CPEs for k>fivefour courses?

    Yes! You'll be provided with a letter of completion for every course you take with k>fivefour that will include course name, date, and credit hours.

    Where can I purchase training products via credit card?

    You can purchase training courses and Battlegrounds subscriptions directly through our website.

    Are your courses offered virtually or in-person?

    Our courses are offered both in person and virtually. For in-person courses, our instructors teach from our training facility in Huntsville, AL.

    When are classes held, and at what time?

    Classes are held based on our course calendar. View upcoming dates on our training page here

    Classes are normally held from 8:00 AM to 5:00 PM (Central Time) each day the class is in session. Our courses are taught from our training facility in Huntsville, AL.

    What is the address for the training center?

    Our Training Center is located at 340 The Bridge Street, Suite 212, Huntsville AL, 35806. We are located at the Lofts at Bridge Street on the second floor.

    Not sure which course fits where you are, or need to set up training for a team? Our team can help you choose the right path and answer anything the FAQs didn't cover. Reach out and we'll point you in the right direction.

    Still Have Questions?

    Our team is here to help you find the right training for your mission.