CTAS study guide
CTAS · Work through your exam, one topic at a time.
The Certified Threat Analysis and Strategy (CTAS) credential is aimed at analysts and team leads who turn raw threat data into decisions: what an adversary is doing, how likely it is to affect a given organization, and what should be done first. It suits cyber threat intelligence analysts, SOC and detection engineers moving toward intelligence work, incident responders who write assessments, and managers who own a threat intelligence program or its budget. The CTAS study guide has 8 sections and about 2,955 words.
01Threat Intelligence Foundations and Requirements
The Foundations and Requirements domain tests whether you can run threat intelligence as a decision-support discipline. Questions cover the intelligence cycle, intelligence levels and consumers, and the requirement chain from Priority Intelligence Requirements (PIRs) to Specific Intelligence Requirements (SIRs) to Essential Elements of Information (EEIs).
390 words, about 2 min02Threat Data Collection and Source Management
Collection and Source Management tests how you turn requirements into a collection plan, select and vet sources, record provenance, and manage gaps. Expect source categories, reliability and credibility grading, legal boundaries, deconfliction, and feedback into direction.
408 words, about 2 min03Processing, Exploitation, and Analysis Tradecraft
Processing, Exploitation, and Analysis Tradecraft tests the middle of the intelligence cycle: converting raw collection into assessed, decision-ready intelligence. Expect questions on normalization, enrichment, fusion, structured analytic techniques, hypothesis testing, confidence, and cognitive bias.
352 words, about 2 min04Adversary Tradecraft and Attack Lifecycle Analysis
Adversary Tradecraft and Attack Lifecycle Analysis tests your ability to describe how adversaries operate and map behavior to frameworks. Expect the Cyber Kill Chain, the Diamond Model, MITRE ATT&CK, TTPs, intrusion sets, campaigns, infrastructure, victimology, and attribution reasoning.
367 words, about 2 min05Intelligence Dissemination and Decision Support
Dissemination and Decision Support tests how intelligence reaches the right consumer and changes a decision. Expect product types, audience tailoring, bottom-line-up-front writing, confidence language, handling caveats such as TLP, recommendations, feedback, and measures of use.
368 words, about 2 min06Strategic Threat Assessment and Risk Prioritization
Strategic Threat Assessment and Risk Prioritization tests how threat intelligence becomes business risk decisions. Expect threat versus vulnerability versus risk, likelihood and impact, crown-jewel mapping, actor prioritization, scenario analysis, risk registers, and treatment options.
362 words, about 2 min07Legal, Ethical, and Governance Considerations
Legal, Ethical, and Governance Considerations tests lawful and responsible intelligence work. Expect privacy and data protection, computer misuse, terms of service, handling and sharing, oversight, minimization, retention, and ethical judgment.
350 words, about 2 min08Program Management, Metrics, and Continuous Improvement
Program Management, Metrics, and Continuous Improvement tests running threat intelligence as a managed program rather than an ad hoc service. Expect mission and governance, roles, stakeholders, technology, processes, maturity, metrics, feedback, training, and lessons learned.
358 words, about 2 min