Expanding global access to cybersecurity exams with CirrusHQ and CREST

CREST provides accreditations for organizations and certifications for cybersecurity professionals in penetration testing, incident response, and threat intelligence, working with governments, regulators, and industry bodies worldwide. As global demand for practical cybersecurity certifications increased, CREST recognized an opportunity to extend its reach and amplify its global impact. Practical exams were delivered through assessor-led, hotel-based sessions, requiring manual infrastructure setup at each location and limiting availability to once a month. Exams were delivered in person across the United Kingdom, Singapore, and Australia, which restricted access for professionals outside these countries. The organization saw potential to support a significantly broader international audience, especially in emerging and underserved regions.

The legacy model relied on assessors traveling to each location and manually configuring a private dedicated data center to connect candidates to their exam environment. Although this ensured exam integrity, it created operational complexity, high fixed costs, and limited scalability. Exams were available only once a month, and candidates needed to be located near one of the three data centers. CREST envisioned a more scalable model that could preserve rigor while expanding access. For a not-for-profit committed to building global cybercapacity, modernizing the platform offered a way to expand access while maintaining the rigorous standards that CREST certifications are known for.

In July 2023, CREST used the AWS Partner Finder to identify AWS consulting partners. After a competitive request-forproposal process, CREST selected CirrusHQ, an AWS Premier Tier Services Partner, for its collaborative, adaptable approach to CREST’s unique technical requirements. “We were trying to build environments that did the opposite of what a good AWS environment achieves,” says Mark Grigg, operations director at CREST. “CirrusHQ really understood our challenge and came with a flexible approach.”

CirrusHQ also helped CREST secure partial funding through the AWS Proof of Concept (POC) Program, which provides promotional credits to help customers validate and test solutions on AWS. The project began with the creation of an AWS landing zone to establish a secure, multiple-account environment aligned with AWS best practices. Together, the teams designed fully automated exam environments, implementing AWS Lambda to run code without thinking about servers or clusters and AWS Step Functions to build and orchestrate distributed applications faster with visual workflows. The solution incorporated Amazon Simple Storage Service (Amazon S3) for object storage and Amazon DynamoDB, a serverless, fully managed distributed NoSQL database.

The teams adopted AWS CodeCommit to securely host highly scalable private Git repositories, AWS CodeBuild to build and test code, and AWS CodePipeline to automate continuous delivery pipelines. Incorporating AWS CloudFormation lets CREST speed up cloud provisioning with infrastructure as code, and Amazon EventBridge lets CREST build event-driven applications at scale. CirrusHQ also helped build CRESTDrive, an innovative platform allowing candidates to preupload files, programs, and notes to the AWS environment, creating an open-book exam experience that traditional test centers cannot support. Throughout the 18-month modernization, CirrusHQ worked closely with CREST, providing training and knowledge transfer at each phase.

As a result of the collaboration, CREST expanded from 3 countries to more than 80 for its practical exams and from a handful of test centers operating once monthly to over 1,000 test centers operating daily. Automation significantly streamlined operations, reducing the time and effort required to deploy exam environments by 80 percent. This has resulted in a 33 percent cost savings compared with its previous model.

With global exam delivery now supported by a modern cloud platform, CREST expanded its international development efforts by launching the CREST Cyber Accelerated Maturity Programme (CREST CAMP). CREST CAMP is the first international initiative to fast-track the capability and growth of cybersecurity service providers and the skilled professionals that they rely on in countries that are seeking to improve the maturity of their cyber ecosystems.

At its core, CREST CAMP fosters collaboration between governments, private sector organizations, educational institutions, and national authorities to strengthen local cyber resilience and align local providers with globally recognized standards. “Offering our exams globally through a cloud-based platform meant that we could embed CREST certification directly into capacity-building programs like CREST CAMP,” says Grigg. “Even after a program concludes, organizations in these regions retain a self-sustaining model with local training partners and ongoing access to internationally recognized examinations.”

This cloud-first transformation on AWS not only has broadened global access to CREST’s assessments but also has been recognized industry-wide, contributing to CREST’s win in the Best Professional Training or Certification category at the SC Europe Awards 2024. By modernizing a manual, location-bound exam delivery platform into a secure, cloud-based examination environment on AWS, CREST turned operational complexity into a scalable foundation for growth— strengthening its ability to certify cybersecurity professionals worldwide and advance industry standards on an international scale.