Blue Team Level 1 (BTL1)
Lessons available in 9 languages with native text-to-speech (beta)
BTL1 is our leading certification, designed to train technical defenders who can defend networks and respond to real-world cyber incidents. The skills and tools you learn apply directly to security roles and are used by defenders worldwide
In the past five years, more than 10,000 students have earned BTL1, joining a global community of over 100,000 learners, across 80+ countries, making it one of the most recognised and trusted blue team qualifications
Skills you'll gain
Blue Team Level 1 (BTL1)
BTL1 is our leading certification, designed to train technical defenders who can defend networks and respond to real-world cyber incidents. The skills and tools you learn apply directly to security roles and are used by defenders worldwide
In the past five years, more than 10,000 students have earned BTL1, joining a global community of over 100,000 learners, across 80+ countries, making it one of the most recognised and trusted blue team qualifications
Recommended experience
0-2 years experience
Estimated time to complete
approximately 30 hours to complete
On-demand access
Complete in 4 months
Training and exam price
£399.00 GBP
NICE Mapping
Cyber Defense Analyst
60% Topics, 60% Knowledge, 67% Ability
Who is the course for?
BTL1 is perfect for security enthusiasts or professionals that want to develop their practical defensive cyber skills. Roles that we believe would benefit from this course include:
- Students/IT Personnel
- Security Analysts
- Incident Responders
- Threat Intelligence Analysts
- Forensics Analysts
Whilst our content is aimed primarily at entry-level or junior roles, read our course syllabus to see if BTL1 is the right choice for you or your team!
Why choose BTL1?
BTL1 goes beyond theory. Every lab, tool, and scenario is modelled on real incidents, so you learn to detect, investigate, and respond the way professionals do in live environments.
Build a Defender Skillset
BTL1 develops practical capability across all core areas of cyber defense, giving you a wider skill base than courses focused only on SOC analysis. You'll gain experience in;
- Analyzing and responding to phishing attacks
- Performing forensics investigations to collect and analyze digital evidence
- Using a SIEM platform to investigate malicious activity
- Interpreting logs and network traffic to identify threats and malware
- Researching and profiling threat actors
- … And much more
Gain Skills Employers Trust
Over 10,000 students have used BTL1 to start or progress their careers in security operations, incident response, and digital forensics. The certification proves you have the operational skills to do the job, not just the theory.
Security Fundamentals
35 topics
3 quizzes
What you'll learn
Lessons
- Introduction to Security Fundamentals
- Soft Skills
- Security Controls
- Networking 101
- Management Principles
- Active Directory
Skills you'll gain
Phishing Analysis
Threat Intelligence
Digital Forensics
Security Information and Event Monitoring
Incident Response
BTL1 Exam Preparation
Frequently asked questions
Are there any exam entry requirements? If so, what are they?
No, there are no entry requirements for the exam. You can take the exam whenever you feel ready, however we strongly recommend you complete all the labs, as they are designed to prepare you for the practical exam.
What are the prerequisites for enrolling in this certification?
BTL1 is suitable for security enthusiasts or professionals looking to develop practical defensive cyber skills. Ideal candidates include students, IT personnel, security analysts, incident responders, threat intelligence analysts, and forensics analysts. The course is primarily aimed at entry-level or junior roles and is designed to train technical defenders capable of protecting networks and responding to cyber incidents. The skills and tools taught are directly applicable to various security roles and are widely used by defenders globally.
How long does it take to complete the certification?
Completing the BTL1 certification typically takes between 40 to 50 hours. However, the actual time may vary based on your prior knowledge of the course materials, your working speed, and the amount of time you can dedicate. Everyone's pace is different, so you might complete it more quickly or take a bit longer.
What's included in the price?
The price includes 4 months of on-demand access to 330+ lessons, videos, activities, and quizzes, along with 23 browser labs providing 100 hours of access. You'll also get one 24-hour practical incident response exam with immediate grading and feedback, and one free exam resit voucher (additional resits can be purchased for each). Detailed feedback is provided for all exams to help you improve. Upon passing, you'll receive lifetime BTL1 certification, digital and printed certificates, a Credly digital badge, and a silver challenge coin (or gold if scoring 90%+ on the first attempt).
Does the cost of the course include all resources needed to pass the exam?
Yes, there is nothing in the exam that hasn't been covered in the course, or without clear instructions being provided. The exam features a select subset of the tools covered in the course, similar to real incident response engagements. On average 70% of students pass on their first attempt. Over 99% of students that use their free retake pass the exam.
How long is the access?
Individual Students: Once you purchase BTL1, it will immediately appear in your account. You will then be free to start the course whenever you want. Corporate Clients: Purchased licenses can be issued at any time within 12 months from the purchase date, providing you the flexibility to start the training when your team is ready. After gaining access to the course, you have 4 months on-demand access to the training material.
Are there any discounts available?
A 10% discount is available to verified students that are actively studying with an established educational institute. There are also discounts available to military personnel, first responders, and veterans. Read more here: https://support.securityblue.team/hc/en-gb/articles/11802106331164-Discounts-for-Students-and-Service-Members . Corporate discounts are available based on the number of licenses purchased.