Certifications

Ten days of pentest and a report long enough to have its own table of contents. Networks, web, and Active Directory, end to end. The exam is less "can you exploit this" and more "can you still write coherently on day nine."

Web application exploitation past the point where the scanner gives up. Chain the small bugs until they become one large bug, then explain in writing why it was worth someone's bounty budget.

Infrastructure, pivoting, lateral movement, persistence. Learning to do all of it without setting off every alert in the building.