Blue team certifications range from 24-hour practical investigations to four-hour proctored question exams, and the name on the certificate says little about which skills were actually tested. This guide compares the main defensive and SOC analyst credentials using only what each provider publishes: Blue Team Level 1 (BTL1) and Level 2 (BTL2), CyberDefenders' practical exam, HTB Certified Defensive Security Analyst (CDSA), TCM Security's Practical SOC Analyst Associate (PSAA), EC-Council Certified SOC Analyst (CSA), GIAC GCIH and GCIA, and CompTIA CySA+. It covers who each suits, exam formats, prerequisites, preparation, cost and renewal, and where they sit on a SOC career path. It is written for aspiring and junior analysts choosing a first defensive credential and for SOC managers deciding what to fund. It is vendor-neutral and does not rank providers. Facts were checked on providers' own pages on 24 October 2026; prices and formats change, so confirm before you buy.
Key takeaways
- Practical and knowledge exams test different things. BTL1, BTL2, CDSA, PSAA and the CyberDefenders exam are hands-on investigations; CSA, GCIH, GCIA and CySA+ are timed question exams, with GIAC adding hands-on CyberLive items.
- BTL1 has moved to a new brand. The Security Blue Team website now redirects to Centri, the trading name of Security Team Training Ltd, which publishes BTL1 as a 24-hour practical incident response exam at GBP 399 including training.
- Most practical credentials do not expire. Centri describes BTL1 and BTL2 as lifetime certifications and TCM Security says the PSAA does not expire, while GIAC renews every four years and CySA+ every three.
- Entry barriers are low across the board. None of the providers checked sets a formal experience requirement; they publish recommended experience instead, from 0 to 2 years for BTL1 to about four years for CySA+.
- Choose by role, not brand. Match the credential's domains to the work you do or want: alert triage and phishing, forensics and malware, network intrusion analysis, or incident handling.
Who the certification is for
"Blue team" covers the defensive side of security operations: monitoring, triage, investigation, incident response, threat hunting and forensics. The credentials below share that ground but aim at different points in a career.
- Career entrants and Tier 1 analysts: BTL1 (Centri recommends 0 to 2 years and lists students and IT staff among its audience) and PSAA (TCM Security calls it associate level). Both test whether you can investigate, not just recall terms. See the SOC Analyst Career Guide.
- Analysts with a year or more: the CyberDefenders practical exam (aimed at analysts with 1+ years) and HTB CDSA, which requires completing a full HTB Academy role path before the exam.
- Experienced analysts moving into hunting and malware work: BTL2, where Centri recommends 2+ years and advises BTL1 first.
- Analysts in organisations that require a proctored, widely listed credential: GCIH, GCIA, CySA+ and CSA. CompTIA lists DoD 8140 work roles for CySA+ (V3 page), including cyber defense analyst and cyber defense incident responder.
- Managers: use these credentials to structure analyst development, but test practical skill in hiring regardless of the certificate. See the SOC Guide.
Exam format and domains
Practical (hands-on) credentials
| Credential (provider) | Exam format | Pass criteria | Main domains |
|---|---|---|---|
| BTL1 (Centri) | 24-hour practical incident response exam, graded immediately with feedback | Not stated on the page read | Security fundamentals, phishing analysis, threat intelligence, digital forensics, SIEM, incident response |
| BTL2 (Centri) | Up to 72 hours for a practical assessment plus written report, hand-marked within 30 working days | 70% | Malware analysis (static and dynamic, PE, PDF and Office files), threat hunting, advanced SIEM, vulnerability management |
| CCDL2, formerly CCD (CyberDefenders) | 48-hour practical, vendor-neutral | Not stated on the page read | SecOps fundamentals, incident response, email security, evidence collection, disk and memory DFIR, threat hunting with Elastic SIEM, malware analysis |
| HTB CDSA (Hack The Box) | 7-day exam with a report in English (PDF or ZIP, max 20 MB) submitted through the platform | Minimum points plus a commercial-grade report | Defined by the HTB Academy role path completed beforehand |
| PSAA (TCM Security) | 48 hours in the exam environment plus two more days for a written report; no multiple choice, no flags | Report must document findings, investigation steps, IOCs and recommendations | Scenarios built from user reports, alerts, and system and network artefacts |
Centri lists the tools used in BTL1 training as including Splunk, Wireshark, Volatility, Autopsy, KAPE, MISP, TheHive, Sigma and VirusTotal, and maps the course to the NICE Cyber Defense Analyst work role. TCM Security allows any tools in the PSAA, including AI tools if their use is disclosed in the report.
Knowledge-based (proctored question) credentials
| Credential (provider) | Questions and time | Passing score | Delivery and notes |
|---|---|---|---|
| GCIH (GIAC) | 106 questions, 4 hours | 69% (versions released on or after 10 May 2025) | Proctored remotely via ProctorU or onsite at Pearson VUE; includes CyberLive hands-on items; 120 days from activation to sit. Covers incident handling, attacker exploits and tools such as Nmap, Metasploit and Netcat |
| GCIA (GIAC) | 106 questions, 4 hours | 67% (versions released on or after 21 January 2023) | Proctored, with CyberLive items. Covers traffic analysis, application protocols, Snort and Zeek, tcpdump filters, Wireshark and network traffic forensics |
| CySA+ CS0-004 (CompTIA) | Maximum 85 questions, 165 minutes | 750 on a 100 to 900 scale | Launched 23 June 2026. Domains: Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, Reporting and Communication 16%. The V3 English exam retires 22 December 2026 |
| CSA 312-39 (EC-Council) | 100 questions, 3 hours | 70% | Multiple choice via the EC-Council Exam Portal. Modules include log management, incident detection and triage, proactive threat detection, incident response and SOC for cloud environments |
GIAC asks candidates to confirm the format and passing score for their own attempt in their GIAC account, since these change between exam versions. See the GIAC GCIH Guide and the CompTIA CySA+ Guide for detail on those two.
Prerequisites and experience
| Credential | Formal prerequisite | Provider's recommendation |
|---|---|---|
| BTL1 | None | 0 to 2 years; complete all labs before the exam |
| BTL2 | None | 2+ years in a practical role; BTL1 advisable first |
| CCDL2 | None listed | Aimed at analysts with 1+ years |
| HTB CDSA | 100% completion of the chosen HTB Academy role path, plus a voucher | Not stated |
| PSAA | None stated | Associate level; includes SOC 101 training |
| GCIH, GCIA | None | GIAC says practical work experience helps, and courses or self-study may meet the need |
| CySA+ | None | About four years in a SOC or vulnerability analyst role |
| CSA | None listed | Foundational IT and security knowledge, networking, TCP/IP, firewalls and IDS/IPS |
Where identity fits: much of what a junior analyst investigates is identity activity: phishing that harvests credentials, suspicious sign-ins, new service accounts, and misused API keys. Whatever credential you choose, practise reading authentication logs and Active Directory events (BTL1 includes an Active Directory lesson). See the Windows Event Log Guide.
Preparation plan
- Pick the format first: decide whether you need a proctored knowledge exam (often required by employers or contracts) or a practical one (stronger evidence of investigation skill). Many analysts eventually hold one of each.
- Build the toolkit: set up a home lab with a SIEM, a packet capture tool and a memory forensics tool, matching those named in your chosen syllabus. See the SIEM Guide.
- Work the provider's labs: BTL1 includes 23 browser labs with 100 hours of access over four months, and BTL2 28 labs with 120 hours over five months. Schedule lab time before access ends; Centri strongly recommends completing all BTL1 labs before the exam.
- Practise reporting: BTL2, CDSA and PSAA require a written report. Write one investigation report a week with timeline, evidence, IOCs and recommendations, and have a colleague review it.
- Rehearse endurance: for 24 to 72 hour exams, plan sleep, breaks and note-taking. For four-hour proctored exams, practise full timed mocks.
- Sit with a retake plan: BTL1 includes one free resit, PSAA includes one free retake, HTB CDSA requires a submitted report on the first attempt before a second, started within 14 days of feedback. Know your option before exam day.
- Turn it into practice: after passing, write detections or hunts for your own environment. See the Detection Engineering Guide and the Threat Hunting Guide.
Measuring progress
- Lab completion: share of provider labs finished before the access window closes.
- Investigation speed: time to triage a practice alert to a verdict, tracked weekly.
- Report quality: peer-review score for completeness of timeline, evidence and recommendations.
- For SOC managers: share of Tier 1 analysts holding a practical credential, and change in escalation accuracy after certification.
Small vs large teams: a small team may fund one practical credential per analyst and rely on lab work for the rest. A larger SOC can set a ladder, for example a practical entry credential for Tier 1 and a proctored or advanced practical one for Tier 2, and run study cohorts with shared lab environments.
Cost, renewal and continuing education
| Credential | Published price (checked 24 October 2026) | Included | Validity and renewal |
|---|---|---|---|
| BTL1 | GBP 399, training and exam | 4 months of course access, 23 labs, one exam and one free resit | Lifetime |
| BTL2 | GBP 1,999, training and exam | 5 months of access, 28 labs, the exam | Lifetime |
| PSAA | 249 (TCM Security shows a dollar sign without a currency code) | 30+ hours of SOC 101 training with 12 months of access, one attempt and one free retake; voucher valid 12 months | Does not expire |
| HTB CDSA | Not listed on the page read | Voucher included in an annual HTB Academy subscription, bought separately with a monthly one | Not stated |
| CCDL2 | Not listed on the page read | Not stated | Not stated |
| CSA | Course from USD 999 on demand or USD 1,399 live online | Course and certification | Not stated on the page read |
| GCIH, GCIA | Not listed on the pages read | Exam attempt; practice tests sold separately | Every four years: 36 CPEs or retake the exam, plus a renewal fee |
| CySA+ | Not listed on the pages read | Exam | Three-year cycle: 60 CEUs and a USD 150 CE fee |
Centri reports that about 70% of BTL1 candidates pass on the first attempt and over 99% of those who use the free retake pass; these are Centri's own figures. Centri also awards a silver challenge coin on passing, gold for 90% or more on the first attempt. Lifetime validity lowers cost but means the certificate ages: an employer will want to see recent work alongside a credential earned years earlier.
Common failure patterns
- Choosing by popularity: picking a credential because it is widely discussed rather than because its domains match the role leaves gaps, for example a network intrusion credential for a role that is mostly email and endpoint triage.
- Running out of lab time: access windows of four to five months pass quickly alongside a job; candidates who leave labs late sit the exam underprepared.
- Weak reports: practical exams that mark the report fail candidates who found the answer but could not show evidence and reasoning.
- Using old material: CySA+ moved to CS0-004 in June 2026, GIAC passing scores differ by exam version, and CyberDefenders renamed CCD to CCDL2. Check the current version before studying.
- Treating a lifetime credential as current: without ongoing hunting, detection or IR work, a certificate from years ago says little about present skill.
Where it fits on the career path
| Stage | Typical credentials | Related guides |
|---|---|---|
| Foundation | ISC2 CC, CompTIA Security+ | ISC2 Certified in Cybersecurity (CC) Guide, CompTIA Security+ Guide |
| Tier 1 analyst | BTL1, PSAA, CSA | SOC Analyst Career Guide |
| Tier 2 analyst and incident responder | CDSA, CCDL2, GCIH, GCIA, CySA+ | Incident Response Guide, GIAC GCIH Guide |
| Specialist: hunting, malware, forensics | BTL2, GCFA | GIAC GCFA Guide, Digital Forensics (DFIR) Guide |
| Working with red teams | Defensive credential plus offensive awareness | Purple Teaming Guide, Practical Red Team Certifications Guide |
The stages are our suggestion, based on each provider's recommended experience, not an official ladder. No salary figures are given, as none of the pages checked publishes them. For a wider view of credentials by level, see the Cybersecurity Certifications Guide.
Practitioner checklist
- Write down the role you want and list its daily tasks before comparing credentials.
- Decide whether you need a proctored knowledge exam, a practical exam, or one of each.
- Read the current syllabus on the provider's own page and check the version or name has not changed.
- Confirm the price, what it includes, and the access window for labs and vouchers.
- Build a home lab with the SIEM, packet and forensics tools named in the syllabus.
- Practise a written investigation report weekly if your exam is report-marked.
- Know your retake option and its deadlines before exam day.
- For GIAC and CySA+, diarise renewal and log CPEs or CEUs as you earn them.
- After passing, apply the skills in detections, hunts or IR exercises so the credential stays current.
Standards and references
- Centri: Blue Team Level 1 (BTL1)
- Centri: Blue Team Level 2 (BTL2)
- GIAC: Certified Incident Handler (GCIH)
- GIAC: Certified Intrusion Analyst (GCIA)
- CompTIA: CySA+ V4
- Hack The Box: Academy Certifications
- TCM Security: Practical SOC Analyst Associate (PSAA)
- EC-Council: Certified SOC Analyst (CSA)
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · SOC Guide · SOC Analyst Career Guide · CompTIA CySA+ Guide · GIAC GCIH Guide