Security Analyst Training

# Certifications

Practical SOC certifications compared: BTL1, CCDL1, HTB CDSA and TryHackMe SAL1

Published Published by Security Analyst Training

Multiple-choice exams such as Security+ test what you know. A practical exam puts you in front of logs, emails, disk images or a simulated alert queue and asks you to work an incident. For a first SOC role, many candidates want both: a recognised name for applications, and evidence that they can do the work. These four certifications are the practical options most often compared.

How are the four exams assessed?

BTL1 CCDL1 HTB CDSA TryHackMe SAL1
Provider Centri CyberDefenders Hack The Box TryHackMe
Format One practical incident-response exam Investigation-based practical exam Hands-on exam on hosted networks, plus a written incident report 80 multiple-choice questions, then two SOC simulator scenarios
Time 24 hours Not stated on the pages we checked Not stated on the pages we checked 6 hours of timed sections inside a 24-hour window
Multiple choice? No No No Yes, one section

Sources: BTL1[Centri (BTL1)], CCDL1[CyberDefenders], HTB CDSA[Hack The Box], SAL1[TryHackMe].

HTB CDSA is the only one of the four that states a report requirement: completing the technical objectives is not enough, and candidates must write a commercial-grade incident report[Hack The Box]. If report writing is something you want to practise for interviews, that matters.

What do they cost, and what is included?

Price on official page Included
BTL1 £399 GBP (training and exam) 4 months of course access, 23 browser labs with 100 hours of lab time, one exam and one free resit
CCDL1 $599 USD (one-time) Course, exam with 2 attempts, 4 months of CyberRange labs
HTB CDSA No price shown on the certification page Exam access after completing the SOC Analyst path
SAL1 Conflicting: “$209” in one panel and “£299” in the FAQ Exam plus one free retake; purchase valid for 12 months

Sources: BTL1[Centri (BTL1)], CCDL1 pricing[CyberDefenders], HTB CDSA[Hack The Box], SAL1[TryHackMe].

BTL1 and CCDL1 bundle the training with the exam, so their prices are not directly comparable with an exam-only price. For HTB CDSA, the cost of the Hack The Box Academy access needed to complete the SOC Analyst path also has to be counted; we could not capture that pricing from an official page on our check date.

What do you need before you start?

  • BTL1: no exam entry requirements; recommended experience shown as 0–2 years[Centri (BTL1)].
  • CCDL1: recommended Windows and Linux fundamentals, basic command-line use and general networking knowledge[CyberDefenders].
  • HTB CDSA: every module of the Academy’s “SOC Analyst” job-role path must be 100% complete before the exam can start[Hack The Box].
  • SAL1: no formal prerequisites[TryHackMe].

Which one fits you?

Editorial judgment, based on the facts above rather than on hands-on testing of each exam:

  • Lowest commitment, fastest start: SAL1, if you already use TryHackMe. Confirm the price at checkout.
  • Broadest single practical exam at a mid-range price: BTL1 — its provider lists phishing analysis, forensics, SIEM investigation, log and network-traffic analysis and threat-actor research[Centri (BTL1)], with a free resit.
  • Most lab time bundled, with Microsoft Sentinel and Splunk work: CCDL1.
  • Most report-heavy, most up-front learning: HTB CDSA — good if you want the structure of a long path and a written deliverable, less good if you need a credential quickly.

None of these replaces a recognised knowledge exam for HR filters, and none is a guarantee of a job. The training planner shows how a practical exam can sit alongside a knowledge exam for your budget.

Certification records used here

Sources

  1. Centri (BTL1): www.centri.org/certifications/blue-team-level-1 — checked 2026-10-22, direct HTTP fetch and rendered in a headless browser
  2. CyberDefenders: cyberdefenders.org/certifications/certified-cyberdefender-level1/ — checked 2026-10-22, rendered in a headless browser
  3. CyberDefenders: cyberdefenders.org/pricing/ — checked 2026-10-22, rendered in a headless browser
  4. Hack The Box: academy.hackthebox.com/preview/certifications/htb-certified-defensive-security-analyst — checked 2026-10-22, rendered in a headless browser
  5. TryHackMe: tryhackme.com/certification/security-analyst-level-1 — checked 2026-10-22, rendered in a headless browser

Related guides