CTSP study guide
CTSP · Work through your exam, one topic at a time.
The Certified Threat Intelligence Specialist (CTSP) is a vendor-neutral credential aimed at analysts, SOC staff, incident responders, and security managers who turn raw threat data into decisions. It tests whether you can run the full intelligence cycle rather than just read feeds: framing requirements, planning collection, analysing actors and campaigns with structured techniques, writing and grading indicators, hunting with them, and briefing decision-makers without overstating confidence. The CTSP study guide has 8 sections and about 3,602 words.
01Threat Intelligence Fundamentals and Frameworks
Threat intelligence fundamentals and frameworks test whether you can distinguish data, information, and intelligence, select the right framework for a question, and describe the intelligence cycle as a requirements-driven process rather than a feed-consumption habit. Expect definitions, framework components, and questions that ask you to map an intrusion to a model.
506 words, about 3 min02Threat Landscape and Actor Analysis
Threat landscape and actor analysis tests your ability to classify adversaries, compare their intent, capability, opportunity, and constraints, and reason about attribution without overstating certainty. Questions often present intrusion evidence and ask what can and cannot be concluded.
428 words, about 2 min03Collection Sources and Collection Planning
Collection sources and collection planning tests whether you can turn intelligence requirements into a deliberate collection plan, evaluate sources properly, and use internal and external data without crossing legal or ethical lines. Expect questions about source types, the Admiralty code, PIRs, and collection gaps.
445 words, about 2 min04Intelligence Analysis and Structured Analytic Techniques
Intelligence analysis and structured analytic techniques tests whether you can apply disciplined reasoning, separate facts from assumptions, express confidence and likelihood correctly, and use structured techniques to challenge your own conclusions. Expect scenario questions about bias, ACH, and analytic standards.
442 words, about 2 min05Indicators of Compromise and Threat Hunting
Indicators of compromise and threat hunting tests whether you can distinguish atomic indicators from behavioral detection, manage indicator lifecycle and context, and run hypothesis-driven hunts that produce durable detections. Expect questions about the Pyramid of Pain, false positives, and ATT&CK mapping.
452 words, about 2 min06Threat Intelligence Platforms and Tooling
Threat intelligence platforms and tooling tests whether you understand how a TIP ingests, normalizes, enriches, stores, scores, and shares intelligence, and how standards such as STIX/TAXII and MISP fit together. Expect questions about data models, integrations, and platform workflows rather than product buttons.
460 words, about 2 min07Dissemination, Reporting, and Stakeholder Communication
Dissemination, reporting, and stakeholder communication tests whether you can turn analysis into a product that fits the audience, states confidence and sourcing, and respects sharing rules. Expect questions about product types, BLUF, TLP, and the difference between tactical and strategic reporting.
424 words, about 2 min08Legal, Ethical, and Operational Security Considerations
Legal, ethical, and operational security considerations tests whether you can collect and share intelligence within the law, handle sensitive data responsibly, and protect your own infrastructure and identity. Expect scenario questions about authorization, privacy, disclosure, TLP, and OPSEC failures.
445 words, about 2 min