BTL1 vs CCD: Which Blue Team Cert Should You Take First? (2026)

Two certifications keep showing up in blue team threads: BTL1 and CCD. Then you open the sites and the picture gets messier. BTL1 is now sold by Centri, not Security Blue Team. And CyberDefenders' CCD has been renamed CCDL2, with a new entry-level cert, CCDL1, beside it.

This post sorts out what each one actually is, using the vendors' own pages, and helps you pick one. We can't tell you which one employers prefer, and we won't pretend to. Everything below is as of 24 October 2026, and certs change their prices and terms, so check each site before you pay.

What happened to the names?

• BTL1 (Blue Team Level 1) is sold by Centri. The old Security Blue Team site now redirects to centri.org.
• CCD (Certified CyberDefender) is now listed as "Threat Hunting & DFIR Certification - CCDL2 (formerly CCD)".
• CCDL1 is CyberDefenders' entry-level SOC analyst certification.

So when someone says "BTL1 vs CCD", the fair comparison is BTL1 against CCDL1 for beginners, or against CCDL2 (the old CCD) if you have some experience already.

What is BTL1?

According to the Centri page, BTL1 is training plus a practical exam, sold together.

• Price: £399 for training and exam
• Training: 4 months of on-demand access to 330+ lessons, videos, activities and quizzes, plus 23 browser labs with 100 hours of access
• Exam: one 24-hour practical incident response exam, graded immediately, with one free resit voucher
• Topics: security fundamentals, phishing analysis, threat intelligence, digital forensics, SIEM, incident response and exam preparation
• Entry requirements: none. Centri recommends 0 to 2 years of experience
• Validity: the page describes it as a lifetime certification with no expiry stated

The page gives two different study-time estimates: about 30 hours in the overview, and 40 to 50 hours in the FAQ. Plan for the higher number. For a longer look, see our BTL1 review.

What is CCDL1?

CCDL1 is CyberDefenders' SOC analyst training and certification. Its page lists six areas: phishing analysis, network and endpoint security, SIEM and log analysis, digital forensics, cloud threat detection and the incident handling process. It recommends Windows and Linux fundamentals, basic command line use and general networking knowledge.

CyberDefenders' help center describes the exam like this:

• Format: 48 multiple-choice questions, with a live virtual machine in the browser
• Time: 6 hours
• Passing score: 70%
• Attempts: 2
• Weighting: SIEM basics (Splunk) at about 33%, network and endpoint essentials about 26%, DFIR about 20%, phishing and email security about 10% and cloud security about 10%

So CCDL1 is a different shape from BTL1: multiple choice with a live machine, not one long practical.

What is CCDL2 (the old CCD)?

CCDL2 is the threat hunting and DFIR certification. The page calls it "a 48-hour practical exam that tests real investigation skills across enterprise environments."

• Exam: text-based practical questions based on real-world scenarios, no report to submit. You get browser-based lab access and a dedicated instance for the 48 hours, and the exam is open book
• Training: the help center lists 25+ browser labs, with four months of lab access
• Recommended experience: 1+ years in cybersecurity or a related IT field, plus a solid grasp of Windows and Linux
• Exam areas: threat hunting, disk forensics, memory forensics and network forensics

CyberDefenders also says exam purchases include two attempts. The first is valid for 3 months from purchase and the second for 4 months, with a 14-day wait after a failed attempt. All CyberDefenders certifications are valid for four years, renewable by retaking the exam or submitting 36 CPE credits.

We could not find a price on the CyberDefenders certification pages we read, so we won't quote one. Check their certification store.

BTL1 vs CCDL1 vs CCDL2: side by side

Level it targets:

• BTL1: entry level, 0 to 2 years recommended
• CCDL1: entry level SOC analyst
• CCDL2: 1+ years of experience recommended

Exam format:

• BTL1: one 24-hour practical, incident response focus
• CCDL1: 6-hour, 48 multiple-choice questions on a live VM
• CCDL2: 48-hour practical questions, open book, DFIR and hunting focus

What it leans on:

• BTL1: broad, including phishing, threat intel, forensics, SIEM and IR
• CCDL1: SIEM (Splunk) is the biggest slice, with cloud and DFIR included
• CCDL2: forensics and hunting depth

Validity:

• BTL1: no expiry stated
• CCDL1 and CCDL2: four years

Price:

• BTL1: £399 for training and exam
• CCDL1 and CCDL2: not stated on the pages we read, check the store

Which blue team cert should you take first?

Let's be direct. There is no universal answer, and nobody can promise a cert will get you a job. Here is how the three differ.

BTL1 makes sense if:

• You are new or fairly new and want one bundled price with training and exam
• You want a long practical rather than multiple choice
• You like the idea of a certification without an expiry date

CCDL1 makes sense if:

• You want a time-boxed, 6-hour exam with a live machine
• You want Splunk-heavy SIEM content to be the biggest part of the exam
• You prefer to be marked on questions with clear right answers

CCDL2 makes sense if:

• You already have a year or more in security or IT
• You want to go deep on memory, disk and network forensics and hunting
• You are comfortable being tested over 48 hours

Maybe wait if:

• You have not yet used Windows and Linux comfortably, or read a log. Build that first
• You are not sure you want a blue team career yet. A free case or two costs nothing

Do you need Security+ first?

Not necessarily. These certs are practical and tool-focused. CompTIA Security+ is a broader, multiple-choice exam that many people study for to show the fundamentals. If you are weighing it, see our Security+ exam prep guide. The choice depends on what the jobs you are applying to ask for, so read those listings.

How can you prepare before you spend money?

Whichever cert you pick, the exam rewards people who have already investigated things. You can build that for free first.

• Work free Cases covering email analysis, SIEM correlation, endpoint forensics and threat intelligence
• Play Adventures Season Zero, a free story-driven SOC investigation
• Practice explaining your findings out loud, which helps on a practical exam and in interviews. Our SOC analyst interview questions are good drilling

If you are comparing CyberDefenders' labs and other platforms, our CyberDefenders review covers that.

FAQs

Is CCD the same as CCDL2?

CyberDefenders lists its threat hunting and DFIR certification as CCDL2 and says it was formerly CCD.

Which is harder, BTL1 or CCD?

They test differently. BTL1 is one 24-hour practical. CCDL2 is a 48-hour practical aimed at people with 1+ years of experience. CCDL1 is 6 hours of multiple choice on a live machine. We can't give you a difficulty ranking we haven't measured.

How much does BTL1 cost?

£399 for training and exam on the Centri page. Check the site for the current price.

Is BTL1 still from Security Blue Team?

It is now sold by Centri. The Security Blue Team site redirects to centri.org.

Do these certs expire?

CyberDefenders says its certifications are valid for four years. Centri's BTL1 page describes a lifetime certification with no expiry stated.

TL;DR

BTL1 (Centri) is £399 for training plus one 24-hour practical, aimed at 0 to 2 years of experience. CyberDefenders' CCD is now CCDL2, a 48-hour practical for people with 1+ years, and the entry level is CCDL1, a 6-hour multiple-choice exam on a live VM. Pick by exam format, your experience and the jobs you want. Neither is a promise of a job.

Sources:

• Centri: Blue Team Level 1
• CyberDefenders: CCDL1
• CyberDefenders: CCDL2
• CCDL1 exam outline
• CCDL2 exam format
• CCDL2 training overview
• Exam attempts and retakes
• Certification validity, expiry and renewal

How EpicDetect Can Help

Before you pay for any exam, find out whether you enjoy the work. Our Cases are free, hands-on investigations that make you read evidence and commit to a verdict.

Adventures Season Zero is a free story-driven way in, and the EpicDetect Atlas maps out structured learning paths when you want them.