IICTI Certified Threat Intelligence Analyst

Holders demonstrate that they can apply and evaluate intelligence requirements and CTI programme governance, collection management and source evaluation, structured analytic techniques and cognitive bias mitigation and adversary tracking, attribution and threat actor profiling, plus 7 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Threat Intelligence Analyst.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Intelligence requirements and CTI programme governance8% of the exam

   • Design a CTI programme driven by prioritised intelligence requirements and measurable stakeholder outcomes.
   • Scope: Priority intelligence requirements (PIRs), stakeholder mapping, intelligence lifecycle, CTI-CMM maturity model, FIRST CTI SIG guidance, programme metrics and value demonstration.
2. 02Collection management and source evaluation10% of the exam

   • Evaluate collection sources and design a collection plan that closes identified intelligence gaps.
   • Scope: Collection plans, OSINT, technical telemetry, commercial feeds, closed and dark web sources, Admiralty Code (NATO source reliability and information credibility), legal and ethical collection limits.
3. 03Structured analytic techniques and cognitive bias mitigation10% of the exam

   • Apply structured analytic techniques to produce defensible judgements with calibrated confidence.
   • Scope: Analysis of competing hypotheses, key assumptions check, red teaming and devil's advocacy, words of estimative probability (ICD 203), confidence levels, cognitive bias countermeasures.
4. 04Adversary tracking, attribution and threat actor profiling16% of the exam

   • Evaluate adversary activity to build threat actor profiles and assess attribution claims critically.
   • Scope: Diamond Model, activity clustering, MITRE ATT&CK v16+ mapping, intrusion set naming conventions, attribution confidence and limits, nation-state, criminal and hacktivist ecosystems.
5. 05Technical intelligence: malware, infrastructure and pivoting8% of the exam

   • Analyse technical artefacts to derive infrastructure and capability insights that support detection.
   • Scope: Malware family and capability analysis at report level, YARA and Sigma rules, passive DNS, certificate and infrastructure pivoting, sandbox output interpretation, C2 infrastructure patterns.
6. 06Indicator lifecycle, enrichment and intelligence platforms12% of the exam

   • Design an indicator management pipeline that delivers high-fidelity, well-handled intelligence to consumers.
   • Scope: Pyramid of Pain, indicator validation, scoring and decay, STIX 2.1 and TAXII 2.1, MISP and OpenCTI, TLP 2.0, deduplication and false-positive control, platform architecture.
7. 07Intelligence-driven detection engineering and threat hunting7% of the exam

   • Lead the translation of threat intelligence into prioritised detections and hunting hypotheses.
   • Scope: Detection-as-code, ATT&CK coverage gap analysis, hypothesis-driven hunting (PEAK, TaHiTI), behaviour-based detections, purple teaming feedback loops, detection efficacy metrics.
8. 08Strategic intelligence and geopolitical risk analysis7% of the exam

   • Evaluate strategic threat trends and translate them into business risk judgements for executive decision-makers.
   • Scope: Geopolitical and sectoral threat landscapes, regional threats to Western Balkans and EU, threat-informed risk assessment, scenario planning, executive briefing techniques.
9. 09Vulnerability intelligence and exploitation prioritisation5% of the exam

   • Prioritise vulnerabilities by combining exploitation likelihood, threat actor interest and asset exposure.
   • Scope: CVE, CVSS v4.0, EPSS, CISA KEV, exploit availability and threat actor usage, attack surface correlation, risk-based patch prioritisation.
10. 10Intelligence reporting, dissemination and sharing communities11% of the exam

    • Produce and disseminate tailored intelligence products and lead participation in sharing communities.
    • Scope: Product types (tactical, operational, strategic), BLUF writing, audience tailoring, feedback loops, ISACs and CSIRT networks, NIS2 information sharing obligations, legal and privacy constraints.
11. 11CTI support to incident response and crisis decision-making6% of the exam

    • Lead intelligence support during incidents and evaluate adversary intent to inform response decisions.
    • Scope: Intelligence support during incidents, ransomware and extortion negotiation context, victimology, adversary next-step forecasting, post-incident intelligence and lessons learned.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner