ISTQB CT-SEC
Certified Tester Security Tester (CT-SEC)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The ISTQB® Certified Tester Security Tester (CT-SEC) is a Specialist-level qualification in the ISTQB® portfolio. Per the official ISTQB® site, the certification "focuses on planning, performing, and evaluating security tests from multiple perspectives including risk, requirements, vulnerability, and human factors," and "also covers security testing tools and standards." It sits alongside other specialist certifications such as CT-STE, CT-MAT and CT-PT, and the site describes the security test engineer release as "an important extension within ISTQB's portfolio," tracing the first security testing syllabus back to 2016. CT-SEC is aimed at testers and quality professionals who want structured, vendor-neutral competence in security testing rather than tool-specific knowledge: people planning security test activities, executing them, and judging their results against risk, requirements, known vulnerabilities and human factors such as insider behaviour and usability of security controls. This independent study page organises preparation around four domains - security testing planning; security test performance; evaluating security tests from risk, requirements, vulnerability and human-factors perspectives; and security testing tools and standards. To prepare, download the official syllabus and sample exams from the ISTQB® knowledge base, work through each chapter's learning objectives, practise the terminology in the ISTQB® glossary, and locate an accredited training provider and an exam provider in your area through the official listings. Verify all exam logistics with your exam provider; this site is not affiliated with ISTQB®.
What you'll study
About ISTQB CT-SEC preparation
Is this the same as the CT-STE certification?
No. ISTQB® lists them as separate entries: Certified Tester Security Test Engineer (CT-STE) and Certified Tester Security Tester (CT-SEC). The CT-SEC description emphasises planning, performing and evaluating security tests across risk, requirements, vulnerability and human-factors perspectives, plus tools and standards. Check the current syllabus for each before choosing.
What does the exam cover?
Per the official overview: planning security tests, performing them, and evaluating results from risk, requirements, vulnerability and human-factors perspectives, together with security testing tools and standards. Study those four areas in the order given in the syllabus rather than starting with tools, which are the least useful entry point.
How long is the exam and how many questions are there?
The official ISTQB® page does not publish the CT-SEC question count, duration, pass mark or fee, so treat any such figure you see elsewhere with suspicion. Ask your local exam provider, which sets and administers the exam in your region, and confirm details before booking.
How much does it cost and where do I sit it?
Fees are not stated on the ISTQB® site; pricing is set locally. Use the official "Find an Exam" listing to identify exam providers in your area, and the "Find Accredited Training" listing if you want a course. Compare providers on price, language and delivery format rather than assuming a global standard rate.
Do I need CTFL first?
ISTQB® states that CTFL certification is recognised as a prerequisite to other ISTQB® certifications where Foundation Level is required. Whether that applies to CT-SEC is a syllabus and exam-provider question, so confirm entry requirements with your provider before registering.
How hard is it, and what trips candidates up?
It is a specialist qualification, so expect depth beyond foundation terminology. Common failure modes are memorising tool names without knowing when each applies, and treating security testing as purely technical while ignoring risk analysis, requirements traceability and human factors - the perspectives the official description explicitly names.
What is the best study order?
Start with planning, since it frames scope and risk. Then performance of security tests, then evaluation against risk, requirements, vulnerability and human factors, and finish with tools and standards so each tool maps to a purpose you already understand. Use the official syllabus and sample exams from the ISTQB® knowledge base.
Can I retake the exam if I fail?
Retake rules, waiting periods and any re-sit fees are set by your exam provider and are not published on the ISTQB® page, so ask before you book. Build a buffer into your schedule in case a second attempt is needed, and review your score report to target weak domains.
How long is the certificate valid?
The official page states a seven-year validity only for Expert Level Test Management and Expert Level Improving the Test Process certificates; it says nothing about validity for CT-SEC. Do not assume seven years applies. Confirm the current rule with your exam provider or Member Board.
Is this page official?
No. This is independent study material and is not affiliated with or endorsed by ISTQB®. Always verify syllabus version, exam structure, fees and rules against the official ISTQB® site and your exam provider, since certifications are revised and older figures circulate widely.