Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
What you need to know about EC-Council’s threat intelligence certification as of 2026: the eight domains of the CTIA v2 exam blueprint, the 312-85 exam format, eligibility, cost, renewal, career paths, and how CTIA compares to ECIH, Certified SOC Analyst (CSA) and CompTIA CySA+. A reference guide for anyone considering CTIA or trying to work out what it actually tests.
CTIA is EC-Council’s specialist certification for cyber threat intelligence, now in its second program version (CTIA v2) and tested by exam 312-85.
It covers the whole intelligence cycle: deciding what the organization needs to know, collecting data from feeds, open sources, and malware, analyzing it with structured methods, and getting finished intelligence to the people who will act on it. The v2 blueprint also covers threat hunting and how intelligence supports SOC operations, incident response, and risk management.
EC-Council says CTIA was built from an industry-wide job task analysis and is fully compliant with the NICE Cybersecurity Workforce Framework (NIST SP 800-181) and the CREST Certified Threat Intelligence Manager (CCTIM) framework. CTIA is issued and maintained by EC-Council, which also publishes the CTIA v2 exam blueprint the current exam follows. CTIA is not on EC-Council’s list of ANAB-accredited (ISO/IEC 17024) certifications, though its sibling ECIH is, and that matters if an employer asks for accreditation by name.
Decide what the organization needs to know and who needs it. Domain 3, 14% of the exam.
Pull data from feeds, open sources, people, malware, and scripts. Collection and processing is the largest domain at 24%.
Turn processed data into assessed intelligence using structured techniques. Domain 5, 16%.
Get reports to the right audience and feed indicators into the tools that use them. Domain 6, 14%.
Three things that set CTIA apart from analyst certifications that give threat intelligence a single chapter, and one limit to check before you rely on it.
EC-Council says CTIA came out of an industry-wide job task analysis of threat intelligence roles, and it maps the program to the NICE framework (NIST SP 800-181) and to CREST CCTIM. In practice the eight domains follow an analyst’s actual workflow, from writing requirements to shipping a report, instead of touring every corner of security.
EC-Council puts about 40% of CTIA training time into labs, 27 of them in all. They cover OSINT collection, malware analysis, threat modeling, report writing, and running a hunt.
Python shows up in three places: collecting data, sharing intelligence, and automating threat hunts. If you’ve only ever read a vendor feed, this is where CTIA asks more of you.
EC-Council’s own military and DoD 8140 page lists CEH, CEH (Practical), CND, CHFI, and CCISO as approved credentials and maps ECIH to DCWF work role 531. CTIA isn’t on that list, so don’t count on it alone to meet a DoD 8140 requirement.
If a federal or contractor job needs one, check the current DoD 8140 Approved Qualifications Matrix at the DoD Cyber Exchange. For intelligence work roles, our CySA+ guide covers a credential that qualifies at the Advanced level for DCWF 111, All-Source Analyst.
The certification, the 312-85 exam, and what it takes to keep CTIA current, as EC-Council publishes them in October 2026.
EC-Council groups CTIA with its other blue-team credentials. Three of them are the usual next step, depending on whether you’re moving toward incident response, the SOC, or forensics.
EC-Council Certified Incident Handler, exam 212-89: 100 questions over 3 hours across nine domains. It picks up where intelligence turns into action, once an incident is declared.
Certified SOC Analyst, exam 312-39: 100 multiple-choice questions in 3 hours. Written for Tier I and Tier II analysts working logs, SIEM alerts, and triage, one of the main consumers of what a CTIA analyst produces.
EC-Council’s Computer Hacking Forensic Investigator. The forensics credential in the same blue-team group, for analysts who want to take evidence handling and investigation further than CTIA’s collection labs go.
EC-Council pitches CTIA at mid- to high-level professionals, and candidates who skip training need two years in information security. It usually follows a foundation credential and some SOC, response, or network defense work, then opens into response, SOC, or leadership tracks.
Build the baseline
The threat intelligence analyst seat
Two questions to answer before you commit: can you take the exam, and should you take CTIA specifically. Here’s a straight answer to both.
You can apply to sit the exam directly.
Submit an exam eligibility application to EC-Council with proof of at least two years of information security work experience and pay the non-refundable $100 application fee. Once approved, you buy the $450 exam voucher and schedule 312-85 through the ECC Exam Center. EC-Council’s $250 e-courseware is study material only and doesn’t replace the application.
Official training waives the requirement.
Complete official EC-Council training through an Accredited Training Center (Training Camp’s CTIA boot camp qualifies) and the experience review no longer applies. Your exam voucher comes with the training, so you can sit for CTIA right after the course ends.
CTIA is written for the people who tell everyone else what attackers are likely to do next. These are the roles EC-Council itself names for the credential:
Collects and analyzes threat data, tracks the actors that target the organization, and writes the reports that tell defenders and leadership what to expect. This is the role CTIA is named for.
Searches the environment for attackers that alerts missed, starting from a hypothesis built on intelligence about how real actors behave. CTIA’s threat hunting domain covers the process and how to automate it.
Sits inside the SOC and feeds it: enriching alerts, running the threat intelligence platform, and turning new indicators into detections the Tier 1 and Tier 2 analysts can use.
Builds and runs the plumbing, from feed ingestion and normalization to the integrations that push intelligence into SIEM, EDR, and ticketing tools. EC-Council lists engineer and specialist titles for the credential.
Produces deeper work on specific actors, campaigns, or sectors, often for clients, where attribution and judging how far to trust a source carry the most weight.
Owns the intelligence requirements, the collection plan, and the sharing relationships, and answers to leadership for whether the program is producing anything useful. EC-Council lists lead, manager, and director titles for CTIA holders.
CTIA isn’t the only credential that touches threat intelligence. Here’s how it lines up against EC-Council’s own ECIH and CSA and against CompTIA CySA+, using each issuer’s published figures in 2026.
| CTIA | EC-Council ECIH | EC-Council CSA | CompTIA CySA+ | |
|---|---|---|---|---|
| Issuer | EC-Council | EC-Council | EC-Council | CompTIA |
| Exam | 312-85: 50 multiple-choice, 2 hours | 212-89: 100 multiple-choice, 3 hours | 312-39: 100 multiple-choice, 3 hours | CS0-004: max 85 multiple-choice and performance-based, 165 minutes |
| Passing Score | 70% | 60% to 85%, varies by exam form | 70% | 750 on a 100 to 900 scale |
| Exam Cost | $450 voucher without training, plus $100 application fee | $450 voucher without training, plus $100 application fee | $450 voucher without training, plus $100 application fee | $439 retail voucher |
| Experience | 2 years infosec, or official training | 1 year infosec, or official training | 1 year network admin or security, or official training | About 4 years recommended, none enforced |
| Renewal | 120 ECE credits over 3 years, $80 annual fee | 120 credits over 3 years, $80 annual fee | 120 ECE credits over 3 years, $80 annual fee | 60 CEUs over 3 years, annual CE fee |
| ANAB Accredited | No | Yes (ISO/IEC 17024) | No | Yes (ISO/IEC 17024) |
| DoD 8140 | Not on EC-Council’s 8140 list | Mapped by EC-Council to DCWF 531, confirm on the current matrix | Not on EC-Council’s 8140 list | Approved (10 DCWF work roles) |
| Focus | Threat intelligence lifecycle, 8 domains | Incident handling and response, 9 domains | SOC monitoring, detection, and triage, 8 domains | Security operations, vulnerability management, response, reporting |
| Best For | Intelligence analysts, threat hunters, SOC intel roles | Responders, CSIRT staff, Tier 2 analysts | Tier I and Tier II SOC analysts | Generalist SOC analysts |
These certifications overlap, but CTIA is the only one of the four built around the intelligence lifecycle itself. If an employer needs an ANAB-accredited or DoD 8140 listed credential, ECIH or CySA+ is the one to pair with it.
Certification Matchups puts the published facts, strengths and weak spots of two certifications side by side.
Our official EC-Council CTIA boot camp covers the threat intelligence curriculum in three days, live in person or online, with official EC-Council courseware, six months of iLab access, exam review sessions, your 312-85 exam voucher, and a free retake included. See the rest of our official EC-Council courses if you are planning a longer path.
OSINT investigations, real intrusions, attacker tradecraft, and the sources analysts read every morning.
One suspicious storefront turned into a map of 47 counterfeit domains, an SEO poisoning campaign, and a Python script for checking sellers. It’s the same collect, pivot, and verify work that CTIA’s heaviest domain is built on, applied to a case anyone can follow.
Strangers identified two people, their employer, and their job titles from public data within a day. What that speed means for executive exposure and for the security teams who have to plan around it.
Government networks breached through zero-days in Ivanti Connect Secure and Policy Secure. What happened, who is exposed, and why a fast patch doesn’t prove an attacker never got in.
Attackers exploited Web Help Desk servers and then deployed Velociraptor, a legitimate open-source response tool, for reconnaissance. A useful case for analysts who track behavior and not only known-bad files.
A former incident response manager and a former ransomware negotiator were sentenced to four years for running BlackCat attacks. A reminder that threat actor profiles can include people with defender training.
A look at the analyst seat, from alert triage to escalation, including the moment an analyst checks an IP address against threat intelligence databases. Useful if you’re weighing a SOC credential against an intelligence one.
News sites, official sources such as CISA, NIST, and MITRE ATT&CK, and expert blogs, sorted into three groups, with the case that a short list of trusted sources beats a long list of feeds. Collection management on a personal scale.
The 312-85 exam follows the CTIA v2 blueprint, with eight domains weighted from 6 to 24 percent. Data Collection and Processing alone is nearly a quarter of the exam, while threat hunting and the SOC domain are 6 percent each. The CTIA v2 course teaches the same material as eight modules. Click any domain for what it covers.
What intelligence is, how cyber threat intelligence differs from raw threat data, and the lifecycle and frameworks used to produce it. Also covers threat intelligence platforms (TIPs), intelligence work in cloud environments, and where the field is heading.
Threat categories, threat actors and what they are after, and how advanced persistent threats (APTs) operate. Then the models analysts use to describe an intrusion: the Cyber Kill Chain, MITRE ATT&CK, the Diamond Model, and indicators of compromise (IoCs).
Working out which threats matter to the organization and turning that into intelligence requirements, a program plan, and management support. Building the team, setting up sharing relationships, and reviewing whether the program is delivering what it promised.
The heaviest domain by a wide margin. Collection management, feeds and sources, collection and acquisition methods, and bulk data collection, followed by processing and exploitation of what was gathered and collection and enrichment in cloud environments.
Analysis techniques and the threat analysis process, then fine-tuning that analysis and evaluating the intelligence it produces. Also covers writing runbooks, building a knowledge base, and the tools analysts work in.
Writing threat intelligence reports, choosing delivery mechanisms, and taking part in sharing relationships and sharing platforms. Also covers the acts and regulations that govern sharing, integrating intelligence into other tools, and sharing and collaboration with Python scripts.
Threat hunting concepts, from the types of hunts and the hunting process to the hunting loop and maturity models. Then automating hunts, including with Python scripts and threat intelligence tools.
How intelligence feeds day-to-day SOC work and the threat intelligence platforms a SOC runs on. How it fits into the incident response process and into risk management, including recovery and resilience after an incident.
Official EC-Council training follows this module order, one module per blueprint domain. EC-Council lists labs for modules 04 through 08, which is where most of the hands-on work sits.
Intelligence and CTI concepts, the threat intelligence lifecycle, strategy and maturity model, TIPs, threat intelligence in the cloud, and career paths in the field.
Threat actors and their objectives, the APT lifecycle, the Cyber Kill Chain, MITRE ATT&CK, the Diamond Model, IoC categories, and the Pyramid of Pain.
Intelligence requirements, MoSCoW prioritization, program scope and rules of engagement, the project charter and policy, team roles, and choosing sharing partners.
Labs on OSINT collection through search engines, footprinting, and DNS interrogation, plus counterintelligence, malware analysis, Python scripting, IoC collection, and normalizing what you gather.
Statistical analysis, ACH and SACH, threat modeling, the Diamond Model analysis process, attribution, and runbooks, with labs on threat modeling and working a case through threat intelligence tools.
Report types and writing tools, sharing models and communities, YARA rules, sharing standards and formats, and sharing with Python, with a lab on producing and sharing a report.
Hunting types, the hunting loop, the Threat Hunting Maturity Model (HMM), TaHiTI, and hunt automation, with labs using Python scripts and threat intelligence tools.
Building SOC threat intelligence, SOC TIPs, and folding intelligence into risk management and incident response, with a lab on SOC threat intelligence platforms.
Domains and weights reflect EC-Council’s CTIA v2 Exam Blueprint. Modules reflect the CTIA v2 course outline on eccouncil.org. EC-Council publishes no per-domain question counts.
The questions candidates ask most often when researching the EC-Council Certified Threat Intelligence Analyst certification.
CTIA is EC-Council’s specialist credential for cyber threat intelligence. The current program is CTIA v2, tested by exam 312-85, and it covers the full intelligence lifecycle: setting requirements, collecting and processing data, analyzing it, and reporting and sharing the results. The v2 blueprint also covers threat hunting and how intelligence supports SOC operations, incident response, and risk management.
There are two routes. You can complete official EC-Council training, which makes you eligible for the exam without an experience review, or you can apply directly with at least two years of information security work experience and pay a non-refundable $100 application fee. Training Camp’s CTIA boot camp is official EC-Council training, and the exam voucher comes with the course.
Exam 312-85 is 50 multiple-choice questions in 2 hours, and EC-Council lists the passing score as 70%. It’s delivered through the ECC Exam Center, and EC-Council sells the voucher for online, remotely proctored delivery. With only 50 questions, each miss costs more than it would on EC-Council’s 100-question exams such as ECIH or CSA.
The CTIA v2 blueprint has eight domains: Introduction to Threat Intelligence (12%), Cyber Threats and Attack Frameworks (8%), Requirements, Planning, Direction, and Review (14%), Data Collection and Processing (24%), Data Analysis (16%), Dissemination and Reporting of Intelligence (14%), Threat Hunting and Detection (6%), and Threat Intelligence in SOC Operations, Incident Response, and Risk Management (6%). Collection and analysis together make up 40% of the exam.
As of October 2026, EC-Council lists the CTIA v2 exam voucher at $450 for candidates applying without training, plus a non-refundable $100 application fee. Official e-courseware on its own is $250, but it’s study material only and doesn’t make you eligible. If you train through an official course, the voucher is normally part of the course fee, which is how Training Camp’s boot camp works.
CTIA is valid for three years and falls under EC-Council’s continuing education (ECE) scheme. To renew it you earn 120 ECE credits within the three-year cycle and pay the $80 annual continuing education fee. Credits come from activities such as conferences, webinars, teaching, writing, and passing other IT security exams, but not from the work you do in your day job.
EC-Council doesn’t list it. Its DoD 8140 page names CEH, CEH (Practical), CND, CHFI, and CCISO as approved credentials and maps ECIH to DCWF work role 531, and CTIA isn’t among them. If you need a credential for a DoD or contractor position, check the current DoD 8140 Approved Qualifications Matrix at cyber.mil before you rely on CTIA, and plan to pair it with a credential that is listed for your work role.
Both are EC-Council blue-team credentials, but they sit at different points on the timeline. CTIA is about knowing the threat before and during an attack: requirements, collection, analysis, and reporting, tested by 50 questions in 2 hours. ECIH (Certified Incident Handler) picks up once an incident is declared and covers triage, containment, eradication, and recovery, tested by 100 questions in 3 hours. ECIH is also on EC-Council’s ANAB-accredited list and its DoD 8140 mapping, and CTIA is on neither.
CySA+ is CompTIA’s broader security analyst credential. Its CS0-004 exam mixes multiple-choice and performance-based questions across security operations, vulnerability management, incident response, and reporting, and threat intelligence is one topic inside the security operations domain. CTIA spends the whole exam on intelligence work. If your job is the SOC in general, CySA+ covers more ground and is on the DoD 8140 matrix. If your job is producing intelligence, CTIA is the closer match.
EC-Council names cyber threat intelligence analyst, threat hunter, SOC threat intelligence analyst, threat intelligence engineer, researcher, and consultant roles, along with lead, manager, and director positions in threat intelligence. It also groups CTIA with its other blue-team credentials (CND, ECIH, CSA, and CHFI) for people building toward SOC, incident response, or forensics work.
It depends on how much intelligence work you already do. Analysts who already work with threat feeds, MITRE ATT&CK, and IoCs mostly need EC-Council’s vocabulary and the planning, requirements, and reporting material. Newer candidates should plan for longer and put the most time into Data Collection and Processing, which is 24% of the exam on its own. Training Camp’s boot camp compresses the instruction into three days, which works best when you already have a couple of years of security experience.
If your job involves turning threat data into something a SOC, a response team, or leadership can act on, yes. CTIA spends its entire blueprint on the intelligence lifecycle, from requirements to dissemination, and EC-Council maps it to the NICE framework and CREST CCTIM. It’s a weaker choice if you need an ANAB-accredited credential or a DoD 8140 listing, since CTIA has neither, or if you want a broad first security certification, where Security+ or CySA+ fits better.
The 312-85 exam follows CTIA v2 and its eight-domain exam blueprint. EC-Council lists CTIA version 1 as retired, with an expiry date of August 21, 2024, so v2 is the only version you can test on in 2026. EC-Council’s retirement notices as of October 2026 don’t include CTIA v2.
Tell us where you are, whether that’s weighing the certification, working out funding, or standing up a threat intelligence team, and we’ll help you map out the right path.