Course catalog

Pick the macOS track you want to build around.

MacSec Labs is organized as a secured training library. Each course has its own syllabus, reader, lab artifacts, progress tracking, and certification path.

Browser-based Mac lab access is currently available for MRTO. Labs for MRE and MRTE are being added in the coming weeks.

MRTO certification badgeMRTE certification badgeMRE certification badge
Course paths

Choose a track. Follow the path.

Track 01

Red team operations

Start with macOS operator fundamentals, then move into accelerator-backed evasion and agentic campaign execution.

Track 02

Reverse engineering

Move from application triage and LLDB workflow into deeper reversing, patching, debugger workflow, and runtime analysis.

Track 03

Vulnerability research

Kernel and platform vulnerability research: XNU internals, iOS internals, discovery workflow, and practical evidence building.

Track 04

Detection engineering

Defensive macOS telemetry, Endpoint Security sensor engineering, detection as code, validation, hunting, and evidence packaging.

Practical certification exams

Practical certification exams for MacSec Labs course tracks.

Each MacSec Labs course track is being designed with a practical 8-hour hands-on exam. Students who successfully clear the exam will be awarded the corresponding MacSec Labs practical certification for that track.

Red Team Tradecraft

Certified macOS Red Team Operator

The MRTO exam includes reconnaissance, lateral movement, and privilege escalation across multiple Mac systems on an internal network.

Reverse Engineering

Certified macOS Reverse Engineer

MRE is the MacSec Labs practical reverse engineering credential for app triage, Mach-O analysis, runtime observation, and key recovery.

Advanced Evasion

Certified macOS Red Team Expert

Launching in Sep

MRTE is the planned expert credential for enterprise-grade EDR bypass, advanced macOS evasion, and lateral movement across multiple air gapped Mac targets.

Completion certificate

Earn a MacSec Labs certificate when you complete the course.

Students who complete every module in an enrolled course can generate a printable certificate from their dashboard. The certificate uses the name saved in the authenticated profile page.

MacSec Labs

Sample certificate

MSL-RT-2026-XXXXXXX

Certificate of Completion

Awarded to

XXXX

has successfully completed

MacOS Red Team Tradecraft