TPFP TI
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The TPFP TI (Threat Intelligence) certification is a professional credential aimed at practitioners who gather, analyse, and act on cyber threat intelligence. It suits SOC analysts, CTI analysts, incident responders, threat hunters, and security engineers moving from raw data handling into structured intelligence production. Candidates typically come from defensive operations or intelligence-adjacent roles and want a credential that evidences end-to-end tradecraft rather than tool familiarity alone. The exam spans seven domains: threat intelligence fundamentals; data collection and sources; analysis and production; dissemination and sharing; operational security plus legal and ethical considerations; tools and platforms; and intelligence use in incident response and hunting. Expect scenario-based multiple-choice items that test judgement - how to scope a collection requirement, judge source reliability, apply structured analytic techniques, handle sharing caveats, and turn indicators into actionable detection. Preparation should combine a solid grasp of intelligence lifecycle concepts, familiarity with standard sharing formats and platforms, and hands-on practice producing short intelligence products from realistic data. Building a small portfolio - a finished report, a detection rule set, an indicator triage log - is more useful than memorising definitions. Always confirm current exam logistics, including scheduling, fees, and any retake rules, directly with the certifying body, since it publishes the authoritative and up-to-date figures.
What you'll study
About TPFP TI preparation
What is the exam format?
It is delivered as multiple-choice questions, covering the seven published domains. The certifying body sets the current item count, time limit, and delivery method, so check its official site for the exact format before you book. Practise answering scenario questions quickly, since many items describe a situation rather than asking for a definition.
How difficult is the TPFP TI exam?
Most candidates find the fundamentals domain straightforward and the analysis and production domain demanding, because it asks you to make judgement calls rather than recall terms. If you have worked in a SOC or CTI team, the operational domains feel natural. Candidates without production experience should build practical artefacts before sitting the exam.
How long should I study, and in what order?
A common approach is to start with fundamentals and the intelligence lifecycle, then collection and sources, then analysis and production. Follow with dissemination and sharing, then operational security and legal considerations. Finish with tools and platforms, and incident response and hunting. Weight your time toward the two 20 percent domains.
What are common failure modes?
Candidates often confuse data, information, and intelligence, or treat indicators as intelligence without context. Others underestimate dissemination caveats, such as handling classifications and sharing agreements, or ignore legal and ethical constraints on collection. Another frequent error is choosing the most technically impressive answer instead of the one matching the requirement.
Can I retake the exam if I fail?
Retake rules, waiting periods, and any associated costs are set by the certifying body and can change. Consult its official certification page for the current retake policy rather than relying on forum posts. In the meantime, review your weakest domain and rebuild practical skills before attempting the exam again.
How much does the exam cost?
Fees vary by region, membership status, and any bundled training, so this page does not quote a figure. The certifying body publishes current pricing on its official website. Check there before budgeting, and confirm whether training materials or a retake are included in the price.
How is the exam timed, and how should I pace myself?
The official body publishes the current time limit. As a general habit, read each scenario fully, eliminate clearly wrong options, and avoid dwelling on a single item. Flag hard questions and return to them. Practise timed sets so you know your natural pace before exam day.
Do I need hands-on tool experience?
Tools and platforms carry a modest weight, but practical familiarity helps across the whole exam. Knowing how intelligence platforms ingest feeds, how indicators are normalised, and how sharing formats encode context makes scenario questions easier. A small home lab or free-tier platform trial is usually enough to build that intuition.
How should I prepare in the final weeks?
Shift from reading to producing. Write a short intelligence report with a clear assessment and confidence statement, triage a set of indicators, and map a threat to detection coverage. Review your errors by domain. Confirm exam logistics with the certifying body so nothing administrative surprises you on the day.