CTSP case studies

CTSP · Put your knowledge to work in context.

The Certified Threat Intelligence Specialist (CTSP) is a vendor-neutral credential aimed at analysts, SOC staff, incident responders, and security managers who turn raw threat data into decisions. It tests whether you can run the full intelligence cycle rather than just read feeds: framing requirements, planning collection, analysing actors and campaigns with structured techniques, writing and grading indicators, hunting with them, and briefing decision-makers without overstating confidence. The CTSP case studies are 5 cases and about 4,491 words.

Insider or Intrusion? Adjudicating a 1.2 GB Upload Under a 24-Hour Deadline

You are the CTI lead at a mid-sized health insurer with 4,200 employees. On a Tuesday morning the DLP platform flags a 1.2 GB upload of member eligibility extracts from a claims analyst's laptop to a personal Google Drive account.

991 words, about 5 min 2

Hunting a Shared Behavioral Package Across a 40,000-Endpoint Estate

You run a three-person threat hunting team at a manufacturer with 40,000 endpoints, 2,600 servers, and 90 days of EDR telemetry. The SIEM retains 30 days, and command-line logging is enabled on only 40% of servers.

893 words, about 4 min 3

Rebuilding a Collection Portfolio After a 30% Budget Cut

You are the sole CTI manager at a retail bank with three analysts. A 30% budget cut lands in Q3.

906 words, about 5 min 4

Handling a Phishing Kit Full of Victim Credentials - and Two Inbound Requests

An analyst on your team monitors a Telegram channel used by a ransomware affiliate. She finds a posted archive containing a phishing kit: 3,200 sets of victim credentials (bank, email, and VPN logins, roughly 400 from your home country), the affiliate's own SSH private keys, and a C2 configuration.

888 words, about 4 min 5

Four Audiences, One Intrusion, Four Hours

At 09:00 you confirm an intrusion: a malicious OAuth application has been consented to by 14 users, granting read access to mailboxes, including the CFO's. The initial lead came from a TLP:RED report shared by a peer bank under an NDA; that report names the actor only as an unverified cluster designation and is single-source.

813 words, about 4 min