IICTI Certified Cybersecurity

Holders demonstrate that they can apply and evaluate threat-informed defense and adversary-driven threat modeling, security architecture and defense-in-depth trade-off analysis, identity threat defense and phishing-resistant authentication and detection engineering and SOC analytics, plus 8 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Cybersecurity.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Threat-informed defense and adversary-driven threat modeling5% of the exam

   • Evaluate an organization's control coverage against relevant adversary behaviors and prioritize defensive investments accordingly.
   • Scope: STRIDE, PASTA and attack trees, MITRE ATT&CK and D3FEND mapping, threat intelligence integration via STIX/TAXII, and control coverage gap analysis against prioritized adversary TTPs.
2. 02Security architecture and defense-in-depth trade-off analysis16% of the exam

   • Architect layered security controls that balance risk reduction, operability and cost across hybrid environments.
   • Scope: SABSA and secure-by-design/default principles, segmentation and trust boundaries, zero trust alignment with NIST SP 800-207, compensating controls and failure-mode analysis of layered defenses.
3. 03Identity threat defense and phishing-resistant authentication14% of the exam

   • Design an identity security architecture that eliminates high-risk attack paths and resists credential and token compromise.
   • Scope: NIST SP 800-63-4 assurance levels, FIDO2/passkeys, privileged access management and tiering, Active Directory and Entra ID attack path reduction, OAuth/OIDC token theft and ITDR.
4. 04Detection engineering and SOC analytics8% of the exam

   • Design, validate and tune a detection portfolio that measurably improves coverage while controlling analyst workload.
   • Scope: Detection-as-code, Sigma, KQL/SPL analytics, ATT&CK-mapped coverage metrics, alert fidelity tuning, UEBA, SOAR playbook design and purple-team validation of detections.
5. 05Incident response leadership and digital forensics6% of the exam

   • Lead a major incident from triage through containment, forensic analysis, regulatory notification and lessons learned.
   • Scope: NIST SP 800-61r3 and CSF 2.0 Respond/Recover, memory, disk and cloud forensics, evidence handling and chain of custody, ransomware containment, and NIS2/GDPR notification timelines.
6. 06Risk-based vulnerability and exposure management3% of the exam

   • Evaluate exposure data to build a remediation program that targets exploitable, business-critical risk first.
   • Scope: CVSS v4.0, EPSS, CISA KEV and SSVC prioritization, continuous threat exposure management (CTEM), external attack surface management and risk-based remediation SLAs.
7. 07Applied cryptography and post-quantum migration14% of the exam

   • Design a cryptographic architecture and post-quantum transition plan that preserves interoperability and key hygiene.
   • Scope: TLS 1.3 and PKI lifecycle, HSM/KMS key management, crypto agility and cryptographic inventories (CBOM), and migration to FIPS 203/204/205 (ML-KEM, ML-DSA, SLH-DSA).
8. 08Cloud, application and software supply chain security14% of the exam

   • Evaluate cloud workloads and software delivery pipelines and specify controls that secure them end to end.
   • Scope: CNAPP/CSPM, OWASP ASVS 5.0 and Top 10, NIST SSDF SP 800-218, SBOM, SLSA provenance and Sigstore signing, and third-party component risk.
9. 09Securing AI and LLM-enabled systems3% of the exam

   • Assess AI-enabled systems for adversarial risk and design proportionate technical and governance safeguards.
   • Scope: OWASP Top 10 for LLM Applications 2025, MITRE ATLAS, prompt injection and data poisoning defenses, model and data supply chain, NIST AI RMF and ISO/IEC 42001 controls.
10. 10Cyber risk quantification and security governance9% of the exam

    • Evaluate cyber risk in financial and business terms and govern the security program against an agreed risk appetite.
    • Scope: ISO/IEC 27001:2022 and 27005:2022, NIST CSF 2.0 Govern, FAIR quantification, risk appetite and tolerance, KRIs and board-level reporting.
11. 11Regulatory compliance and third-party cyber risk5% of the exam

    • Design a compliance and third-party assurance model that satisfies overlapping regulatory obligations efficiently.
    • Scope: NIS2, DORA, EU Cyber Resilience Act, GDPR Art. 32, third-party risk management lifecycle, reliance on SOC 2 and ISO certifications, and contractual security clauses.
12. 12Cyber resilience and security program leadership3% of the exam

    • Lead a security program that sustains critical services through disruption and demonstrates measurable maturity gains.
    • Scope: ISO 22301 and resilience engineering, crisis management and tabletop exercises, maturity models (C2M2, CMMI), security metrics, operating model and capability roadmap design.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner