BTL1 (Blue Team Level 1)
BTL1 is a practical certification for junior defensive roles that covers phishing analysis, digital forensics, threat intelligence, SIEM and incident response. Centri aims it at students, IT staff, security analysts and incident responders with 0 to 2 years of experience.
Exam Details
Unproctored, open-book incident response exam in an in-browser lab with 20 task-based questions, graded immediately on submission. AI tools are prohibited.
Includes 4 months of course access, 23 browser labs with 100 lab hours and two exam attempts to be used within 12 months. Discounts are offered to verified students, military personnel, first responders and veterans.
Requirements and Renewal
Prerequisites
None. Centri recommends completing all course labs before the exam. The course is aimed at people with 0 to 2 years of experience.
Renewal
Does not expire. No renewal or CPE credits are required.
Exam Domains
6 domains| Domain |
|---|
| Security Fundamentals |
| Phishing Analysis |
| Digital Forensics |
| Threat Intelligence |
| SIEM |
| Incident Response |
Certification Lists
Related Tool Categories
Disk and memory forensics, malware sandboxes, and incident response collection platforms.
SIEM platforms, EDR agents, SOAR automation, and detection rule engines for security operations.
Threat intelligence platforms, IOC sharing communities, and STIX/TAXII tooling for collecting and distributing threat data.
Frequently Asked Questions
How much does BTL1 cost?→
Centri lists BTL1 at £399, which covers the training, labs and two exam attempts.
What is the BTL1 passing score?→
A score of 70% or higher passes. A score of 90% or higher on the first attempt earns the gold challenge coin.
How long is the BTL1 exam?→
The exam is a 24-hour practical incident response exam with 20 task-based questions. A failed attempt requires a 10-day wait before the free resit.
Does BTL1 expire?→
No. Centri certifications currently do not expire and need no renewal or CPE credits.
Is Security Blue Team the same as Centri?→
Yes. Centri describes itself as formerly Security Blue Team, and securityblue.team now redirects to centri.org.
Sources
Exam details are checked against official Centri pages. Fees, exam versions, and renewal rules change; confirm with Centri before registering. BTL1 is a trademark of its owner. This site is not affiliated with or endorsed by Centri.