BTL1 Review 2026: Is It Worth It, What It Costs, and How It Compares

BTL1 used to be the obvious answer to "which cert proves I can actually do blue team work?" In 2026 it has company. TryHackMe, Hack The Box and CyberDefenders all now sell entry-level certifications built around hands-on SOC work, and Security+ is still sitting on most job posts.

So the question isn't just "is BTL1 good?" It's "is BTL1 the right one for you, right now, out of five or six reasonable options?" Let's work through it.

Last checked: October 2026. Prices change, check each provider's site before you buy.

What is BTL1, and who sells it now?

BTL1 (Blue Team Level 1) is a practical blue team certification. It was built by Security Blue Team, and if you go to their old website today you land on centri.org: the company now trades as Centri (formerly Security Blue Team), and BTL1 is sold on the Centri BTL1 page.

Here is what Centri lists for it, as of October 2026:

• Price: £399 GBP for the training and the exam together.
• Recommended experience: 0-2 years.
• Time: approximately 30 hours to complete the training.
• Access: on-demand, and you complete it within 4 months.
• Exam: a practical exam.
• Challenge coin: a silver challenge coin when you pass, gold if you score 90% or more on your first attempt.

That last one sounds like a gimmick, but a physical token for a hard pass is a nice touch.

Is BTL1 the same as Blue Team Labs Online?

No, and this trips people up. Blue Team Labs Online (BTLO) is a separate lab platform from the same company. Its free tier gives you every security challenge (downloadable content such as memory dumps, phishing emails, packet captures and logs). BTLO PRO adds 274 in-browser investigation labs on top of those challenges, at £15/month, £40.50 for 3 months, £76.50 for 6 months or £144/year, as of October 2026 (source).

BTLO's own FAQ describes it as built for defenders who already have experience with security tools, a place to keep skills sharp. So think of it as practice, not as the BTL1 course itself.

How much does BTL1 cost in 2026?

£399, as of October 2026, for training plus exam (Centri). That single number is the honest answer. Older articles (including an earlier version of this one) quoted dollar ranges and retake prices; we've removed them because we couldn't confirm them on Centri's public page. If you need retake or exam-length details, ask Centri directly before you buy.

What £399 buys you is a bundle: you're paying for the course and the exam in one go. That's good value if you need the training. It matters less if you already have the skills and just want a credential.

How do BTL1, SAL1, CDSA, CCDL1, Security+ and CySA+ compare?

Here's the field of entry-level and early-career certs a SOC-bound beginner is most likely weighing in 2026. Where a price isn't on the provider's public page, we say so instead of guessing.

Prices change, check their site before you buy.

A few things worth pulling out of that table.

BTL1 and CDSA are the two "hands-on all the way" options. BTL1 is a practical exam with the training bundled. CDSA is a hands-on exam that also asks for a commercial-grade report, which is real work but also a real portfolio piece.

SAL1 is the blend. Multiple-choice plus a practical section in a SOC simulator. If you've already done TryHackMe's SOC Level 1 path, it's the natural next step on the same platform.

CCDL1 leans on SIEM work. If Splunk queries are where you want reps, the prep is built around them.

Security+ is a different kind of thing. It's broad, vendor-neutral fundamentals, not a hands-on SOC cert, and it's the one HR filters look for.

BTL1 vs Security+: which should you get first?

In our view, for most people looking for their first security job in the US, Security+ first.

That's an observation, not a rule: when we read entry-level SOC and security analyst job posts in the US, Security+ is the cert we see listed most often. A cert the filter doesn't recognise can't get you past the filter.

Where BTL1 wins: it's a practical exam, so it tests whether you can actually investigate. In our view that's a stronger signal to a hiring manager who knows the cert. If you're in the UK or Europe, already have Security+, or your target employer is a SOC that values practical certs, BTL1 is a strong second credential.

One timing note: Security+ SY0-701 retires on 11 June 2027, and V8 (SY0-801) is expected around 17 November 2026. If you're deciding when to sit, our Security+ V8 release date breakdown covers whether to wait. For a deeper look at the CompTIA ladder, see Security+ vs CySA+.

BTL1 vs CDSA: which is the better practical cert?

Both are practical. The differences are in shape, not quality:

• Bundling. BTL1 is £399 for training and exam together. CDSA requires you to complete the Academy SOC Analyst job-role path first, so your cost depends on how long you spend in HTB Academy and which plan you're on. HTB's Academy prices changed on 12 October 2026: Silver Monthly is $30/month, Student $10/month, Silver Annual $550/year, as of October 2026 (source).
• The report. CDSA asks for a commercial-grade report. If you want proof you can write up an investigation for a client or manager, that's a plus. If writing is the part you dread, factor in the time.
• Time box. BTL1 gives you 4 months to finish. That deadline is motivating for some people and stressful for others.

Our take: if you want a defined bundle and a deadline, BTL1. If you're already in HTB Academy or want the report on your CV, CDSA. Our TryHackMe vs Hack The Box comparison goes deeper on the HTB side.

Is BTL1 worth it?

It depends on where you are.

BTL1 is worth it if:

• You have 0-2 years' experience and want a practical cert with the training included.
• You already have Security+ (or don't need it for your market) and want something that proves hands-on skill.
• You can commit about 30 hours inside a 4-month window.
• You're in a market or company where BTL1 is known.

Look at something else first if:

• You're in the US and have no cert yet. Security+ is, in our view, the better first spend.
• You're already deep in TryHackMe or HTB Academy. SAL1 or CDSA builds on work you've already done.
• You've never looked at a log. Start with free practice and fundamentals, then come back. BTL1 recommends 0-2 years, but "0" still assumes you're ready to learn fast.

None of these certs gets you hired on its own. Interviewers ask you to walk through an investigation, and you need stories for that. See SOC analyst certifications ranked for the wider field, including vendor certs.

What should you do before buying any of them?

Three cheap steps that make the expensive one go better:

1. Check job posts in your area. Search 20 entry-level SOC listings and count which certs appear. That's your market, not ours.
2. Do free practice first. BTLO's free challenges, TryHackMe's free content, HTB's free Labs plan and CyberDefenders' free start all exist. Use them to find out if investigation work suits you before you pay £399 to find out.
3. Take a baseline test. If Security+ is on your list, find out where you stand now. A short scored test tells you if you're weeks away or months away.

FAQ

How much does BTL1 cost?

£399 GBP for the training and exam together, as of October 2026, per Centri's BTL1 page. Prices change, check their site before you buy.

Who runs BTL1 now?

Centri, formerly Security Blue Team. Security Blue Team's old site now redirects to centri.org, which is where BTL1 is sold.

Is BTL1 better than Security+?

They do different jobs. BTL1 is a practical blue team exam with training included. Security+ is broad fundamentals. In our experience reading US job posts, Security+ appears far more often, so we'd usually take it first and add BTL1 if you want proof of hands-on skill.

BTL1 vs CDSA: which is harder to get?

We won't rank difficulty we can't measure. Structurally, CDSA needs you to complete 100% of HTB Academy's SOC Analyst job-role path before the exam and to write a commercial-grade report. BTL1 bundles about 30 hours of training with a practical exam and gives you 4 months to finish.

How long does BTL1 take?

Centri estimates approximately 30 hours, and you have 4 months of on-demand access to complete it.

Sources

• Centri, Blue Team Level 1
• Blue Team Labs Online
• TryHackMe pricing
• TryHackMe SAL1
• HTB CDSA
• HTB Academy pricing
• CyberDefenders CCDL1
• CompTIA Security+
• CompTIA CySA+

How EpicDetect Can Help

If Security+ is on your list, start with the free 20-question Security+ practice test. No account needed. It scores you against the pass line and shows your weakest domain, so you know whether you're weeks or months out before you spend anything.

If you'd rather get investigation reps first, Adventures Season Zero is five free episodes of one continuous SOC investigation, roughly 3-4 hours in total, in the browser. To be clear about what we aren't: EpicDetect doesn't sell a certification, and we don't have memory or disk forensics labs, so for BTL1-style forensics practice you'll want BTLO or similar alongside us.

When you're ready for structured study, Premium adds the full Security+ track and a timed exam simulator scored by domain. Start free. No card needed.