EC-Council's credential for cybersecurity professionals who specialize in threat intelligence — the practice of collecting, analyzing, and disseminating information about current and emerging cyber threats to support an organization's defensive decision-making. CTIA focuses specifically on the threat intelligence lifecycle rather than general security operations or penetration testing.
Who it's for
SOC analysts, threat intelligence analysts, incident responders, and security professionals who want to specialize in proactively identifying and analyzing cyber threats rather than purely reactive incident response. It's commonly pursued by professionals already working in a security operations center (SOC) who want to move into a dedicated threat intelligence function.
What's covered
- Threat Intelligence Fundamentals & Threat Landscape (25%) — core threat intelligence concepts, types of threat intelligence (strategic, tactical, operational, technical), and the current cyber threat landscape including threat actors and attack frameworks
- Intelligence Lifecycle: Planning, Collection & Processing (30%) — defining intelligence requirements, collection methods (OSINT, HUMINT, technical collection), and processing raw data into usable intelligence
- Data Analysis & Threat Modeling (25%) — analytical techniques, threat modeling frameworks like the Cyber Kill Chain and MITRE ATT&CK, and structured analytic methods
- Intelligence Reporting, Dissemination & Sharing (20%) — producing actionable intelligence reports, sharing standards like STIX/TAXII, and communicating findings to different stakeholder audiences
What to expect
The CTIA exam is a multiple-choice exam testing knowledge across the full threat intelligence lifecycle, from initial planning and requirements gathering through collection, analysis, and final dissemination. It draws heavily on named frameworks (Cyber Kill Chain, MITRE ATT&CK, the Diamond Model) and threat intelligence sharing standards, testing both conceptual understanding and practical application of the intelligence lifecycle.
How to prepare
Because threat intelligence is process-driven — following a defined lifecycle from requirements to dissemination — candidates benefit from learning that lifecycle as an organizing structure for the rest of the exam's content, rather than studying individual topics in isolation. Familiarity with core frameworks (Cyber Kill Chain, MITRE ATT&CK, Diamond Model of Intrusion Analysis) is essential, since these are referenced throughout multiple domains rather than confined to a single section.
Certification details
- Certifying body: EC-Council.
- Eligibility: EC-Council recommends security experience and familiarity with cybersecurity fundamentals; official training is available but not always strictly required to sit the exam.
- Exam format: Multiple-choice exam covering threat intelligence fundamentals, the intelligence lifecycle, analysis techniques, and reporting/dissemination.
- Renewal: Requires ongoing continuing education credits through EC-Council's continuing education program to maintain certification.