Frequently Asked Questions

Have Question? We are here to help

What is the difference between badges and certifications?

A badge represents a practitioner’s mastery of a particular set of MAD20™ knowledge and real-world skills as demonstrated through a passing score on the associated assessment. Every badge earned brings a practitioner closer to earning a certification. MAD20 certifications represent a practitioner’s mastery of a particular aptitude in the ATT&CK® Framework applications.

How do I earn MAD20 certifications?

MAD20™ certifications bring a new approach to certifications in the cyber security industry. Certifications only require you to pass a series of assessments to earn current badges. Badges are pre-requisites for attaining your MAD20 certification. Upon successful completion of the requisite number of badges along your selected roadmap, you become eligible to earn your MAD20 certification. Your MAD20 certification is automatically awarded upon successful completion of the comprehensive examination.

How do I earn MAD20 badges?

To earn a badge, you must pass an assessment. To take an assessment for a badge, visit the My Roadmap page and click on a badge you have not yet earned, then click on the “Earn Badge” button.

Each assessment contains questions that enable you to demonstrate mastery of the learning objectives associated with the respective badge. To pass, you must achieve a minimum score on the assessment (typically 80 percent).

Upon submitting your answers to an assessment, your assessment will be graded and you will see a message indicating if you passed or not. If you passed, the badge (and associated certification if you completed it) will appear under your account name on the left side of the screen in the MAD20 Skills Hub. You can also see all the badges and certifications you have earned on the “My Roadmap” page.

Why is the score of an assessment based on a total that is greater than the number of questions?

Questions that are multi-selection often count for more than 1 point, depending on how many correct answer options there are. This is due to the increased difficulty in answering multi-select questions. Therefore, this is expected behavior – many assessments have more possible points to earn than questions for this reason.

How long does it take to get my badge or certification after passing an assessment?

Please note that it may take up to 24 hours for your badge or certification to appear in the Skills Hub after passing the required assessment(s) and you may need to log out and log back in.

Additionally, it may take up 72 hours for your digital badge or certification to be awarded, providing you with the ability to share your achievement with others.

Do I need to view the training materials to attempt to earn a badge or certification?

No. Trainings are available to educate practitioners on the latest MITRE ATT&CK® Framework to become advantaged defenders. You can skip any of the training if you feel you are ready for the badge assessments. To confirm a thorough understanding of the material covered, MAD20 certification exam attempts require successful completion of badge assessments. 

How many times can I take an assessment?

You may attempt each assessment up to 100 times, as frequently as once every 24 hours.

How will I know if new content is added to the MAD20 Skills Hub?

The MAD20 team works on a continuous basis to develop new MAD20 content and features. Look for notifications of new content through email messages from the MAD20 team and through visual indicators within the MAD20 Skills Hub of new or featured content.

Who are the MAD20 vendor partners?

MAD20 maintains a number of relationships with strategic partners in our mission to equip cyber professionals with the tools and training necessary to combat an increasingly dynamic cyber threat landscape. These partners include CYBER RANGES Corp.

CYBER RANGES delivers world-class cyber security training and capability development exercises using next-generation technology and services for the design, delivery, and management of simulation-based, deep-dive experiences in cyber security. The platform delivers real-world scenarios to better prepare security operators and managers to be able to work with real threats.

The partnership between CYBER RANGES and MAD20 adds access to MAD20-developed labs running on the CYBER RANGES platform, enabling learners to practice the skills they learn in the training around Adversary Emulation and Threat Hunting. Going forward, the partnership will bring new hands-on assessments and credentials, offering MAD20 subscribers new ways to prove their mastery of ATT&CK-based Adversary Emulation and Threat Hunting concepts.

CYBER RANGES fully supports  MAD20™  across its entire cyber range architecture. Through its proprietary Injector Engine CYBER RANGES platform can automatically emulate the latest-intel attacks, APTs, and specific tactics and exploits from the MAD20™ Matrix™.

Additionally, MAD20 issues digital badges through our partnership with Credly, a leading provider of digital credentials for professional certifications, online courses, and association memberships.

How do I know if I have a badge or certification?

The badges and certifications you have earned will appear under your account name on the left side of the screen under “My Certifications” or “My Badges” respectively. Please note that it may take up to 24 hours for your badge or certification to appear after passing the required assessment(s).

How do I access the MAD20 course curriculum?

To view our course offering, visit our Course Catalog page. You can find the course curriculum, including instructor names, associated badges and certifications, lesson modules, and individual video lessons on any of the course detail pages.

What was the certificate of completion offered by Cybrary at the end of the course?

Cybrary offered a certificate of completion after a practitioner viewed all of the video lesson content and completed any associated exercises hosted by Cybrary. The Cybrary certificate of completion is neither affiliated with nor equivalent to the MAD20™ certifications.


MAD20 content will no longer be available on Cybrary, beginning on January 1, 2024. 

What happened to the content previously available on Cybrary?

MAD20 content will no longer be available on Cybrary, beginning on January 1, 2024, to streamline just-in-time content updates going forward. Prospectively, this content will solely be accessible within MAD20 and select partners.

MAD20 is committed to ensuring that foundational MITRE ATT&CK content remains free and accessible to all.  

I hear that you offer free content. Is this true?

Yes. MAD20 is committed to ensuring that foundational MITRE ATT&CK content remains free and accessible to all. In support of this, we apply value-based pricing to our enterprise, government, and higher education offerings. 

To access our free library of MAD20 content, enroll with a free account today



What do I get with my MAD20 subscription and how is this different than other cybersecurity certification programs?

MAD20™ is the cybersecurity community’s only ATT&CK® certification ecosystem produced by MITRE ATT&CK® subject matter experts. Your MAD20™ subscription provides you unlimited access to the MAD20 Skills Hub, where you can access a growing library of assessments on the practical use of ATT&CK® to better secure your network. As a subscriber, you will be able to assess your skills using a combination of tests and range-based exercises as the program grows to meet new threats and adversary TTPs as they emerge.

How do I request a refund on my subscription to MAD20?

Users who have not yet accessed any training exercises or exams in the MAD20 Skills Hub within 24 hours of purchase may request a refund by contacting Customer Support and providing a reference number and the email address used to complete the purchase.

Does the MAD20 Skills Hub have a preferred browser?

We find that the MAD20 Skills Hub works best with the latest version of Google Chrome on desktop/laptop.