Does knowing some obscure nmap flag really make you a good baseline candidate? Aptitude tests are hard, but CRT was silly things like ‘what normally runs on port 1433’. I don’t care. I have 2 devices that can google on my person at anytime when the question is relevant. I’d prefer to see MCS*, OSCP, OSCE, hell even pentesterlabs stuff. Anything that runs at or near actual cost of development.

I also don’t take financial reports as gospel. I’m no finance guru but assume it’s possible / easy to hide money, or it gets reinvested into marketing the notion that crest actually matters, the former at which doesn’t make the thing a giant scam at least.