Security BTL1 Review
Reviewing Security Blue Team Level 1 certification.
3 min readcert-review
table of contents
What is the BTL1?
Blue Team Level 1 (BTL1) is a defensive cybersecurity certification provided by Security Blue Team.
It’s a beginner level certification, so don’t expect it to delve too deep into these topics. However, the course currently covers the following 6 domains which will provide a great deal of knowledge for any junior SOC analyst:
- Security Fundamentals
- Phishing Analysis
- Threat Intelligence
- Digital Forensics
- Security Information and Event Management
- Incident Response
How did I prepare for the exam?
The exam is fairly straight-forward and you will only need to enter the correct values to a set of questions. Yes, CTF style sort of thing. No report writing needed!
The course content itself is definitely enough for individuals to understand the key tools that will be assessed in the exam. However, I highly recommend practicing on resources other than the course labs to gain practical forensic experience. Eventhough the course labs and exam share a similar CTF format, the ability to “connect the dots” in a breach scenario is key to fully understanding what happened.
Prior to attempting the exam, I’ve completed most of the suggested BTLO labs mentioned in the exam preparation section. In retrospect, I’ve also added several specific CyberDefenders labs that will help greatly. I can’t recommend CyberDefenders enough as it’s a great resource for beginners to target weaker areas or knowledge gaps.
Resources
-
BTLO labs I no longer have access to the course content but they are mentioned in the last module.
-
CyberDefender labs
Final Thoughts and Advice
As it’s a beginner friendly course, I personally don’t believe it will be too challenging for any tech savvy individuals to complete it in 4 months with dedication. In my opinion, the price was fair for the content and quality received at the time. I’ve completed BTL1 in early 2024 and if I recall correctly, Security Blue Team was one of the more well-known vendors providing practical blue team certifications.
However, this has changed drastically in the last year with HackTheBox’s CDSA and CyberDefenders’ CCD gaining more traction in the industry. Offensive Security has also introduced their first ever defensive SOC-200 course and respective certification.
A quick review of their course syllabuses seem to indicate a wider coverage of topics and may actually better allign with BTL2 which costs approx. USD $2715. If we were to complete both BTL1 and BTL2, it would have cost approx. USD $3260. That’s insane!
Let me break down the costs of these certifications:
| Course Name | Lab Access | Price (USD) |
|---|---|---|
| BTL1 | 4 Months | approx. 550 |
| BTL2 | 5 Months | approx. 2715 |
| HTB CDSA | 12 Months | 490 |
| CyberDefender CCD | 4 Months | 800 |
| OffSec OSDA | 3 Months | 1749 |
Lab Access refer to the duration in which access to course labs are available to students.
Um yeah… BTL certifications are pricey. The content in CCD seems to be the closest to the combination of both BTL1 + BTL2 and coming in at only USD $800. HTB CDSA on the other hand offers the longest lab access period which provides the most flexibility, I would also say it’s more on par with BTL2 rather than BTL1 so it’s not a real apples-to-apples comparision. For Offsec’s OSDA, it’s pricey as well but it does include Active Directory sections that can be beneficial for almost all organisations out there so definitely an extra point to go into the resume. None of the other certifications contain dedicated AD content as far as I know.
It’s difficult to pick the best one out of these but it’s for sure not the BTL1 + BTL2 combo.
If I were to start over again and had to pay out of pocket for certifications, my pick would be HTB CDSA given HTB’s reputation and the content covered overlaps with almost everything in BTL1 + BTL2.