EC-Council Defensive Certifications Guide: CND, CSA and ECIH compared

EC-Council is best known for the CEH, but its three defensive credentials, Certified Network Defender (CND), Certified SOC Analyst (CSA) and EC-Council Certified Incident Handler (ECIH), are the ones blue team practitioners and their managers actually have to choose between. This guide sets out what EC-Council itself publishes for each: exam format, modules, prerequisites, training packages, accreditation and the continuing education rules that keep the credential current. It then adds a preparation plan and shows where each one sits against other blue team credentials. It is written for network, SOC and incident response practitioners deciding which to sit, and for managers deciding which to fund. Facts are as published on EC-Council's own pages, checked on 27 October 2026. Prices change and differ by region and partner, so check current fees with EC-Council before you buy.

Key takeaways

• Three credentials, three jobs. CND covers defending the network and its endpoints, CSA covers tier 1 and tier 2 SOC work around the SIEM, and ECIH covers handling incidents from first response to recovery.
• The exams look similar on paper. All three are 100 multiple choice questions on the EC-Council Exam Portal; CND allows 4 hours, CSA and ECIH allow 3.
• Prerequisites differ more than the exams. CND and CSA ask for networking and security fundamentals; ECIH asks for at least one year of cybersecurity experience and is not aimed at beginners.
• Recognition is uneven. EC-Council lists CND and ECIH as ANAB accredited to ISO/IEC 17024 and approved under DoD 8140; the CSA page does not list either, which matters for regulated or defence employers.
• Renewal is the same for all three. Each needs 120 EC-Council Continuing Education (ECE) credits per three-year cycle and an annual fee of USD 80, under one policy that covers every EC-Council professional certification you hold.

Who the certification is for

EC-Council describes CND as an intermediate-level programme, CSA as a programme for SOC analysts working with logs and detection, and ECIH as a mid-level to senior course. Read the three as a ladder of responsibility rather than difficulty: protect the environment, watch it, then respond when something gets through.

If you are early in your career and have no security credential at all, a broad foundation such as Security+ is usually the first step; see the CompTIA Security+ Guide. For the wider choice of defensive credentials from other bodies, see the Blue Team Certifications Guide.

Exam format and domains

Format at a glance

A cut score that varies by exam form means EC-Council sets the pass mark for each question bank according to its difficulty, so a score that passed one candidate does not tell you what the next form needs. Prepare to clear the top of the range, not the bottom.

CND modules

The CND outline on EC-Council's page runs from Module 02 to Module 20, with four self-study appendices (computer network fundamentals, physical network security, VPN security and macOS endpoint security). The modules group naturally into five areas.

• Network defence: administrative network security, technical network security and network perimeter security (Modules 02 to 04).
• Endpoints: Windows, Linux, mobile and IoT endpoint security (Modules 05 to 08).
• Applications, data and platforms: administrative application security, data security, enterprise virtual network security, enterprise cloud security and wireless security (Modules 09 to 13).
• Monitoring: network traffic monitoring and analysis, and network logs monitoring and analysis (Modules 14 and 15).
• Response and anticipation: incident response and forensics, business continuity and disaster recovery, risk management, attack surface analysis and cyber threat intelligence (Modules 16 to 20).

CSA modules

1. Security Operations and Management
2. Understanding Cyber Threats, IoCs and Attack Methodology
3. Log Management
4. Incident Detection and Triage
5. Proactive Threat Detection
6. Incident Response
7. Forensic Investigation and Malware Analysis
8. SOC for Cloud Environments

ECIH modules

The current ECIH (the page refers to ECIHv3) has ten modules: an introduction to incident handling and response, the incident handling and response process, first response, and then seven incident types: malware, email security, network security, web application security, cloud security, insider threats and endpoint security.

How the three overlap

Holding all three involves real repetition. Most people need one, or two that match a career step, such as CSA followed later by ECIH.

Where identity fits: none of the three outlines names identity as a module, yet the incidents they train you for usually turn on it: stolen session tokens in email incidents, abused service accounts in insider and cloud incidents, exposed API keys in web application incidents. When you revise triage and response, add how to revoke and rotate credentials and how to find which machine identities an attacker used. See the Incident Response Guide.

Prerequisites and experience

EC-Council's course pages sell the exam as part of a training package. If you intend to sit an exam without attending official training, EC-Council runs a separate eligibility application process; read its current rules on the EC-Council certification site before you pay, because the route, any application fee and the evidence it asks for are set there rather than on the course pages.

The CND page itself is not fully consistent about prerequisites (one section asks only for networking knowledge, another for IT education and working experience). Treat the stricter wording as the safe assumption and keep evidence of your experience.

Preparation plan

The plan below assumes one credential, part-time study and some hands-on access to a lab. EC-Council's packages include courseware and labs (for CND the FAQ lists one year of courseware access, six months of lab access and an exam voucher valid for one year), so plan the timetable around the voucher and lab windows.

1. Pick one credential (week 0): match it to the job you do now or the next one, using the fit table above. Check whether your employer or contract requires an ANAB accredited or DoD 8140 listed credential.
2. Get the outline (week 0): use the module list as your checklist, and confirm the current version with EC-Council or your training centre.
3. Baseline (week 1): score yourself against each module. Most candidates find gaps in the areas their job does not cover: CND candidates in cloud and IoT, CSA candidates in malware analysis, ECIH candidates in web application and email incidents.
4. Labs first (weeks 2 to 5): use the included labs while access lasts. For CND, configure a firewall, an IDS and log forwarding end to end. For CSA, build SIEM correlation rules and triage a queue of alerts. For ECIH, walk an incident from detection to lessons learned, collecting evidence as you go.
5. Close gaps (weeks 6 to 8): read the weak modules, then return to the lab. Tie each topic to a real procedure in your own organisation where you can.
6. Rehearse (weeks 9 to 10): sit timed mocks of 100 questions in the allowed time (4 hours for CND, 3 for CSA and ECIH). Aim well above the published pass mark.
7. Book and sit (week 11 or 12): confirm the voucher expiry date and exam portal requirements before booking.

Measuring readiness

• Module coverage: every module scored at least once in a mock, none far below your average.
• Timed score: two full mocks completed inside the time limit at 80% or above, to clear a variable cut score with margin.
• Practical recall: you can explain, without notes, what you would log, what you would alert on and what you would contain first for each incident type in the outline.
• Lab completion: all included labs finished before lab access ends.

Small vs large organisations: in a small team one person often covers network defence, monitoring and response, which makes CND the more useful single credential. In a large organisation with a separate SOC and incident response team, CSA or ECIH maps more closely to a single role and to the career ladder inside that function.

Cost, renewal and continuing education

Prices are the starting prices on EC-Council's course pages on 27 October 2026; regional prices, training centre prices and promotions differ, so check current fees before you commit. EC-Council's FAQs say cost varies by delivery mode.

How the ECE policy works

• Cycle: a certification is valid for three years from the date you earn it, and you need 120 ECE credits per certification in that period.
• Shared credits: credits are counted per certification, but a credit you earn can be applied to every EC-Council certification you hold.
• Annual reporting: credits are earned per calendar year and must be registered by 1 February of the following year.
• What does not count: activities that are part of your normal job role.
• Evidence: keep sufficient evidence of each activity in case EC-Council asks for it.
• If you miss it: the certification can be suspended; earning the credits and paying the fee within 12 months reinstates it, with the next cycle shortened. If you still do not comply, the certification is revoked and you must pass the exam again.

For how EC-Council's scheme compares with ISC2, ISACA, CompTIA and GIAC renewal, see the Certification Renewal and CPE Requirements Guide.

Common failure patterns

• Choosing by brand, not role: candidates sit CND because it is the best known of the three, then work in a SOC where CSA or ECIH would have matched the job.
• Assuming recognition: a defence or public sector employer may require a DoD 8140 listed or ANAB accredited credential. Check the current EC-Council and DoD listings before you choose; the CSA page does not claim either.
• Letting labs expire: lab access in a package can be shorter than courseware access. Finish the labs first.
• Revising to the lowest cut score: the CND pass mark varies by form, so a mock score of 65% is not a safe margin.
• Missing the 1 February deadline: credits earned but not registered still count against you. Log them as you go.
• Studying response without credentials: incident response that ignores stolen keys and tokens leaves attackers inside. In the Cloudflare Thanksgiving breach, one service token and three service account credentials left unrotated after the Okta breach let an attacker back into Confluence, Jira and Bitbucket; containment that stops at cleaning hosts misses this.

Where it fits on the career path

• Before: a foundation credential and networking experience. CND suits people coming from network or systems administration.
• Alongside: CSA sits next to analyst credentials such as CySA+; see the CompTIA CySA+ Guide and the SOC Analyst Career Guide.
• After: ECIH leads towards incident response and forensics specialisms; see the Incident Response and Forensics Certifications Compared Guide.
• The offensive side: the CEH is EC-Council's best known credential, but it trains attack techniques rather than defence; see the CEH Certification Guide.
• Management: experienced practitioners moving into leadership usually look at management credentials such as the EC-Council CCISO Certification Guide covers.

EC-Council does not publish pass rates or salary figures on the pages checked for this guide, and we do not quote third-party estimates. For the full landscape by level and specialism, see the Cybersecurity Certifications Guide.

Practitioner checklist

• Match the credential to the role: CND for network defence, CSA for SOC analysis, ECIH for incident handling.
• Check whether your employer or contract needs an ANAB accredited or DoD 8140 listed credential, and confirm the current listing.
• Confirm the current version, outline and exam code with EC-Council or your training centre before you start.
• If you are not taking official training, read EC-Council's eligibility application rules first.
• Note the voucher expiry and lab access end dates, and finish the labs first.
• Sit two timed mocks of 100 questions and score at least 80% before booking.
• Add credential revocation and machine identity questions to your incident revision.
• After passing, log ECE credits each year and register them by 1 February; budget USD 80 a year.

Standards and references

• EC-Council: Certified Network Defender (CND)
• EC-Council: Certified SOC Analyst (CSA)
• EC-Council: Certified Incident Handler (ECIH)
• EC-Council: Continuing Education (ECE) Policy

Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Blue Team Certifications Guide · Incident Response and Forensics Certifications Compared Guide · SOC Analyst Career Guide