Threat Intelligence Certifications Compared: GCTI, CTIA, CREST Exams and Free Training Paths

Threat intelligence has no single entry credential, and candidates often buy an exam that tests a different level of the job from the one they are applying for. The three certifying bodies most often named in cyber threat intelligence (CTI) job adverts test different things: CREST runs a three-step ladder from entry analyst to intelligence manager, EC-Council's CTIA tests knowledge of the intelligence lifecycle in a short multiple-choice exam, and GIAC's GCTI tests analysis with hands-on CyberLive items. This guide compares them on audience, exam design, experience expected, preparation, cost and renewal, with worked scenarios and a decision checklist, and sets out the free training that covers much of the same method. It is written for analysts choosing a credential and for CTI and SOC managers planning team development. Certifying bodies are listed alphabetically (CREST, EC-Council, GIAC), and the order is not a ranking. All facts come from the certifying bodies' own pages, checked on 13 November 2026; formats and prices change, so confirm before booking.

Key takeaways

• Decide the level of the job first. CREST CPTIA and EC-Council CTIA suit people proving foundation knowledge; CREST CRTIA and GIAC GCTI suit working analysts; CREST CCTIM is the only one aimed at people who lead a CTI team.
• Exam design signals what is tested. CTIA is 50 multiple-choice questions in two hours; GCTI is 82 questions in three hours with CyberLive lab items; CRTIA and CCTIM add long-form written answers, and CCTIM adds a scenario element.
• Experience expectations differ. CPTIA has no experience requirement, CRTIA expects at least two years collecting, analysing and documenting intelligence, and EC-Council expects at least two years in cyber security or IT for CTIA.
• Renewal costs add up. GIAC renews every four years with 36 CPE credits and a USD 499 fee; EC-Council requires 120 ECE credits over three years and USD 80 a year.
• Free training covers the method. MITRE's ATT&CK CTI training (about four hours) and the FIRST CTI SIG curriculum teach mapping, sourcing and analysis before you spend on an exam.

The short answer

If you are new to CTI and need a credential that buyers of intelligence services recognise, start with CREST CPTIA. If you already work in a SOC, incident response or threat hunting team and want to show you can analyse intrusions and pivot through data, GCTI tests that with hands-on lab items. If your employer already standardises on EC-Council training, or you want a structured course on the intelligence lifecycle with a short exam, CTIA fits. If you run or are about to run a CTI function, CREST CCTIM is the only exam in this set designed for that job. None of these replaces a portfolio of real intelligence products, which is what most CTI hiring managers ask for. See the Threat Intelligence Analyst Career Guide for the wider route into the role.

Comparison at a glance

CREST: a three-level ladder for service delivery

Who it is for: CREST accredits companies that sell security services, and its individual exams are designed to show that the people delivering those services meet a standard. That makes CREST credentials most valuable where you work for, or sell to, organisations that buy intelligence services and ask for named, qualified staff. The CREST Certifications page covers the scheme across penetration testing and incident response too.

• CPTIA: an entry-level qualification for people starting in the threat intelligence industry, with no stated experience requirement. CREST describes it as demonstrating competence to do operational threat intelligence work under the supervision of a CREST Certified Threat Intelligence Manager. The exam is a multiple-choice written paper with a two-thirds pass mark.
• CRTIA: aimed at people who are part of a team delivering threat intelligence services, with at least two years collecting, analysing and documenting intelligence. It combines a multiple-choice paper with long-form questions that need detailed written answers, so it tests whether you can explain an assessment, not just recognise a term.
• CCTIM: aimed at professionals who lead a team producing intelligence. It has short-form, long-form and scenario-based written elements that reflect what a CTI manager does, delivered in two parts, with Part 2 taken within three months of Part 1.

What it tests well: written communication and the safe, legal and ethical conduct of intelligence work, which CREST names as the point of CRTIA. Plan for: exams sit in test centres, and the syllabus detail lives in downloadable PDFs and candidate notes, so plan time to read them. Common pitfall: treating CPTIA as proof of analytical skill; it shows foundation knowledge, and an employer will still look for written products.

EC-Council CTIA: a structured lifecycle course with a short exam

Who it is for: EC-Council aims CTIA at mid to high-level professionals in information security, network security and incident response. Holders of its CEH and CND certifications can enrol, and the eligibility guidance asks for at least two years of experience in cyber security, IT or a related field.

What the course covers: eight modules that follow the intelligence lifecycle:

1. Introduction to Threat Intelligence
2. Cyber Threats and Attack Frameworks
3. Requirements, Planning, Direction, and Review
4. Data Collection and Processing
5. Data Analysis
6. Intelligence Reporting and Dissemination
7. Threat Hunting and Detection
8. Threat Intelligence in SOC Operations, Incident Response, and Risk Management

Format: training runs self-paced (iLearn), live online (iWeek) or in person, as a three-day course with 27 hands-on labs that EC-Council says make up 40% of training time. The exam is 50 multiple-choice questions in two hours on the EC-Council Exam Portal, with a 70% pass mark.

What it tests well: breadth across the lifecycle, including requirements and dissemination, which newer analysts often skip. Plan for: the exam is multiple choice, so pair it with a portfolio of written analysis to show applied skill. Common pitfall: letting ECE credits lapse; EC-Council suspends a certification if 120 credits are not met by the end of the three-year cycle, and revokes it if the shortfall is not fixed within the suspension period.

GIAC GCTI: analysis tested with hands-on items

Who it is for: GIAC lists incident response team members, threat hunters, SOC staff, information security practitioners, experienced digital forensic analysts, and federal agents and law enforcement officials. The GIAC GCTI page covers it in single-certification depth; this section compares it.

What it tests: GIAC's nine objectives are Analysis of Intelligence; Campaigns and Attribution; Collecting and Storing Data Sets; Intelligence Application; Intelligence Fundamentals; Kill Chain, Diamond Model and Courses of Action Matrix; Malware as a Collection Source; Pivoting; and Sharing Intelligence.

Format: one proctored exam of 82 questions in three hours with a 71% pass mark, including CyberLive items that put candidates in virtual machines with real tools. Candidates have 120 days from activation to sit it. The affiliated SANS course, FOR578: Cyber Threat Intelligence, runs six days live or 36 hours self-paced with 20 labs and 36 CPEs; SANS lists no strict prerequisites but expects familiarity with security terminology and some Linux command-line comfort.

What it tests well: pivoting, intrusion analysis and attribution reasoning under time pressure. Plan for: budget for the course if self-funded, and add reading on strategic and geopolitical intelligence if that is your focus, since the objectives centre on technical analysis. Common pitfall: sitting the exam without practising pivots on real data; CyberLive items reward doing, not reading.

Free and low-cost training paths

Much of the CTI method is taught free by the bodies that maintain the frameworks. Use these before paying for an exam, or alongside one.

MITRE notes that the CTI training exercises are based on an older ATT&CK version and suggests using ATT&CK v8 to match the answers; practise the same skill against the current matrix afterwards. ATT&CK itself lists a threat intelligence programme as mitigation M1019; see M1019 Threat Intelligence Program.

Which frameworks and skills each covers

This mapping uses only the published objectives, module names and exam descriptions.

For the models themselves, see the Cyber Kill Chain and Diamond Model Guide and the STIX and TAXII Guide.

Cost, renewal and continuing education

Prices exclude tax and training. Training is usually the larger cost: SANS FOR578 and EC-Council's CTIA course are both sold separately from or bundled with the exam. If you hold several credentials, align renewal cycles and count one activity against several where the rules allow; the Certification Renewal and CPE Requirements Guide explains how.

When to choose each: decision guidance

• Choose CREST when you work in, or want to join, a consultancy or managed service that sells intelligence to clients who ask for CREST-qualified staff, and when you want a progression path from entry to management within one scheme.
• Choose EC-Council CTIA when you want structured coverage of the whole lifecycle in a short course, when your organisation already trains on EC-Council, or when a shorter exam with a fixed time commitment fits your schedule.
• Choose GIAC GCTI when your work is technical intrusion analysis in a SOC, IR or hunting team, and you want a credential that tests performed analysis with lab items.
• Choose free training only when you are testing whether CTI suits you, or when your employer values published analysis over credentials. Write and publish two or three intelligence products using the Threat Intelligence Report Template.
• Small teams where CTI is one person's part-time duty get more from free training plus one hands-on credential than from a ladder. Large CTI functions often use a ladder for juniors and a management credential for leads, so that progression is visible.

Worked scenarios

• SOC analyst, three years in, moving to the CTI team: already knows logs and detections and needs to show pivoting and attribution reasoning. GCTI fits; complete MITRE's CTI training first to practise ATT&CK mapping, then FOR578 or self-study against the nine objectives.
• Graduate joining a UK intelligence consultancy: employer bids for work where clients ask for CREST staff. CPTIA in the first year, then CRTIA after two years of documented intelligence work, keeps the credential aligned with client requirements.
• Network security engineer in an organisation that trains on EC-Council: wants a structured introduction to requirements, collection and dissemination. CTIA fits, with the ECE cycle planned from day one.
• New head of CTI building a function: needs to set requirements, run collection and manage output quality. CCTIM is the only exam here built around that job; pair it with the Threat Intelligence Maturity Model and the Threat Intelligence Policy Template.

Preparation plan

1. Weeks 1 to 2, method: complete MITRE ATT&CK Fundamentals and CTI training, and read the FIRST CTI SIG curriculum sections on source evaluation and communicating uncertainty.
2. Weeks 3 to 4, syllabus: download your chosen exam's syllabus or objectives and score yourself against each line from 0 to 3.
3. Weeks 5 to 8, practice: build a small lab platform, map two public reports to ATT&CK, and write one strategic and one tactical product against a stated requirement.
4. Weeks 9 to 10, exam technique: for GCTI, use the practice exams and build an index; for CRTIA and CCTIM, practise timed long-form answers; for CTIA, revise module by module.
5. After the exam: log continuing education from the start, and keep the products you wrote as a portfolio.

Common failure patterns

• Buying the wrong level: an experienced analyst sits an entry exam, or a newcomer attempts a manager exam, and the credential neither stretches nor fits the job.
• No portfolio: candidates arrive at interviews with a certificate but no written intelligence product, which is what hiring managers ask to see.
• Framework recall without application: memorising the Diamond Model or ATT&CK tactics without practising mapping real reports leaves analysts unable to answer scenario or hands-on items.
• Ignoring requirements and dissemination: technical candidates study collection and analysis and neglect the requirement and reporting steps that all three bodies cover.
• Lapsed renewals: continuing education is logged late, leading to suspension (EC-Council) or a missed renewal window (GIAC).

Practitioner checklist

• Write down the CTI level you work at or want: tactical, operational or strategic, analyst or manager.
• Check job adverts in your target market for which credentials employers and clients name.
• Complete MITRE's ATT&CK CTI training before paying for any exam.
• Download the syllabus or objectives and score yourself line by line.
• Confirm current price, delivery and experience rules on the certifying body's own page.
• Build two or three written intelligence products as a portfolio alongside study.
• Plan the renewal cycle and continuing education log on the day you pass.
• Managers: map each credential to a role level in your team development plan.

Standards and references

• CREST: CREST Practitioner Threat Intelligence Analyst
• CREST: CREST Registered Threat Intelligence Analyst
• CREST: CREST Certified Threat Intelligence Manager
• EC-Council: Certified Threat Intelligence Analyst
• EC-Council: Continuing Education (ECE) Policy
• GIAC: Cyber Threat Intelligence (GCTI)
• GIAC: Pricing
• MITRE ATT&CK: CTI Training

Related NHI Mgmt Group resources: Threat Intelligence Analyst Career Guide · GIAC GCTI · CREST Certifications · Threat Intelligence Guide