CTSP
Certified Threat Intelligence Specialist
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Certified Threat Intelligence Specialist (CTSP) is a vendor-neutral credential aimed at analysts, SOC staff, incident responders, and security managers who turn raw threat data into decisions. It tests whether you can run the full intelligence cycle rather than just read feeds: framing requirements, planning collection, analysing actors and campaigns with structured techniques, writing and grading indicators, hunting with them, and briefing decision-makers without overstating confidence. The exam is multiple choice and scenario-driven, so expect questions that describe a messy situation and ask for the most defensible next step rather than a definition. Preparation should be practical. Work through the intelligence cycle and common frameworks, then practise turning a report into a finished assessment with clear confidence language. Build hands-on familiarity with a threat intelligence platform, indicator standards such as STIX and TAXII, and MITRE ATT&CK mapping. Study the legal and operational security side too, including handling sensitive sources and sharing constraints. This page is independent study material and is not affiliated with or endorsed by any certifying body; always confirm logistics with the official programme before booking.
What you'll study
About CTSP preparation
What is the exam format?
Expect multiple-choice questions, many built around short scenarios describing an analyst's situation. The official certifying body publishes the current question count, time limit, and delivery options, so check its site rather than relying on forum posts, which frequently mix up versions and providers.
How hard is the CTSP?
Candidates with a year or two of SOC, incident response, or analysis work usually find the concepts familiar but the scenario questions demanding, because several answers can look reasonable. The differentiator is judgement: choosing the answer that respects collection limits, analytic confidence, and stakeholder needs.
What happens if I fail, and can I retake?
Retake rules, waiting periods, and any fees are set by the certifying body and change over time. Confirm the current retake policy in the official candidate handbook before you sit the exam, and note that some programmes require a waiting period between attempts.
How long should I study, and in what order?
Most candidates need several weeks of part-time study. Start with the intelligence cycle and requirements, then actor analysis, then collection planning. Move to structured analytic techniques and indicators, and finish with tooling, reporting, and legal considerations, since later topics assume the earlier vocabulary.
Do I need hands-on tool experience?
Not necessarily, but it helps. Questions about threat intelligence platforms, indicator sharing formats, and enrichment pipelines make more sense if you have loaded data into a platform, exported indicators, and seen how false positives arise. Free trials and open-source tools are enough to build that intuition.
Where do candidates lose the most marks?
The most common failures are treating indicators as durable facts, ignoring the intelligence requirement, and writing assessments without stating confidence or sourcing. Scenario questions reward analysts who ask what decision the intelligence supports before choosing a technique or a tool.
Is the certification worth it for career progression?
It signals that you understand the full cycle rather than only tool operation, which matters for roles moving from tier-one monitoring toward analysis or threat intelligence leadership. Weigh it against employer demand in your region and against practical portfolio evidence such as published, well-sourced analysis.
How should I prepare in the final week?
Rehearse the cycle end to end on one real campaign: write the requirement, list sources, map activity to a framework, produce graded indicators, and draft a two-page assessment for a non-technical reader. Then review legal and sharing constraints, which are easy to neglect and frequently tested.