CTI study guide
CTI · Work through your exam, one topic at a time.
The Certified Threat Intelligence Analyst (CTI) credential is designed for security professionals who want to demonstrate competence in producing and applying threat intelligence. It suits analysts, SOC staff, incident responders, and consultants moving from raw data to decision-ready intelligence. The CTI study guide has 9 sections and about 4,083 words.
01Introduction to Threat Intelligence
This domain tests definitional precision: can you separate data from intelligence, place a product at the right level, and explain how requirements - not feeds - drive a programme. Expect short scenario items asking which type of intelligence a named stakeholder actually needs.
474 words, about 2 min02Threat Intelligence Types and Sources
This domain tests source selection and source evaluation: which discipline answers which question, how reliable a source is, and how corroboration affects the confidence you may state. OSINT - vendor blogs, CERT advisories, news, social media, code repositories, certificate transparency, scanning data.
401 words, about 2 min03Threat Intelligence Frameworks and Standards
This domain tests whether you can pick the right framework for a task: describing an intrusion, mapping detection coverage, pivoting between artefacts, or exchanging data between tools. Seven phases: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, actions on objectives.
490 words, about 2 min04Threat Intelligence Lifecycle and Planning
This domain tests the order of the intelligence cycle, where each activity belongs, and how requirements are written. Scenario items often describe an activity and ask which phase it sits in, or ask you to critique a poorly written requirement.
475 words, about 2 min05Threat Data Collection and Processing
This domain tests the plumbing between collection and analysis: what to ingest, how to normalise it, how to avoid poisoning your own detection estate with stale or shared infrastructure. Automated feed ingestion (STIX/TAXII, MISP, API, CSV); sensor and telemetry collection (EDR, DNS, proxy, NetFlow, honeypots, sinkholes); manual research on paste sites, forums and sandboxes; human intake from incident response, the SOC and CERT contacts.
429 words, about 2 min06Threat Analysis and Production
This domain tests analysis technique and judgement: structured reasoning, calibrated confidence, and the discipline to stop at the attribution level the evidence supports. Analysis answers three questions: so what, for whom, and how sure.
434 words, about 2 min07Threat Intelligence Dissemination and Integration
This domain tests whether intelligence reaches the right consumer in the right form and whether you can handle it lawfully. Items often hinge on Traffic Light Protocol colours or on the difference between human-readable and machine-readable delivery.
469 words, about 2 min08Threat Hunting and Detection
This domain tests proactive hunting method and detection engineering discipline: hypotheses, data availability, durable detection logic and false positive control. Monitoring answers alerts that already exist.
452 words, about 2 min09Operational Security and Threat Intelligence Program Management
This domain tests two linked subjects: protecting your own collection activity, and building a programme that survives budget cycles. Items often present a research scenario and ask what the analyst should have done differently.
459 words, about 2 min