Specialist certification guide
CT-SEC v1.0: Security Tester
Consider this qualification when you already have relevant experience and need broader reasoning about security risks, test planning and evaluation. Check the entry requirements below before you book.
Syllabus: ISTQB CT-SEC Syllabus v1.0 2016. Exam facts checked: October 4, 2026
Is CT-SEC the right certification for you?
Consider this qualification when you already have relevant experience and need broader reasoning about security risks, test planning and evaluation.
When to choose another route: The experience requirement makes this a poor first security qualification for someone with no relevant background. Compare CT-STE if you want a more execution-focused scope, while checking its CTFL prerequisite and your practical learning needs.
Exam at a glance
45multiple-choice questions
80total available points
52 / 80minimum passing score in points
120 minstandard exam duration
These figures describe CT-SEC v1.0. Use the listed point threshold, rather than assuming a fixed number of correct answers on a weighted exam.
Source: Official exam structures and rules. Appointment arrangements and any approved extra time must be confirmed with your provider.
How the exam is weighted
| Cognitive level | Questions | Points |
|---|---|---|
| K2: understand | 20 | 20 |
| K3: apply | 15 | 30 |
| K4: analyze | 10 | 30 |
| Total | 45 | 80 |
Source discrepancy: the detailed chapter callouts in tables v1.19 add up to 43 questions and 76 points, while the overall structure specifies 45 questions and 80 points. We therefore do not present the chapter split as a reliable complete allocation. Study every chapter and use the overall format when planning a timed sample.
Source: ISTQB Exam Structures & Rules Tables v1.19, pages 32 and 33, checked October 4, 2026.
Entry requirements
CTFL and at least three years of relevant academic, practical or consulting experience are required. Confirm the acceptable evidence and specific experience criteria with the board or provider.
Also known as: CT SEC, Security Tester, Certified Tester Security Tester.
Source: Official syllabus and qualification overview.
What the syllabus covers
Use these chapters to organize your reading. The practice prompts are our editorial guidance. Use the official learning objectives to check the required depth.
Chapter 1: Introduction to security testing
Connect assets and protection needs with security risks and policy. Write down what is in scope before selecting an investigation.
Chapter 2: Security testing purposes, goals and strategies
Explain the purpose and coverage of a security test strategy. Include organizational constraints instead of assuming one technical approach fits every context.
Chapter 3: Security testing processes
Trace a security test from objective through design, execution and evaluation. Keep evidence sufficient to support the reported conclusion.
Chapter 4: Security testing throughout the software lifecycle
Place security activities across delivery and maintenance. Identify which decisions need earlier evidence and which behaviors must be investigated in operation.
Chapter 5: Testing security mechanisms
Relate protection mechanisms to the risks they address. Explain how a mechanism can be configured or used incorrectly rather than assuming its presence establishes protection.
Chapter 6: Human factors in security testing
Include human and organizational factors in the risk picture. Use fictional scenarios to practice describing their contribution without attributing blame to an individual.
Chapter 7: Security test evaluation and reporting
Write a security finding with evidence, impact, limitations and a proposed next action. Separate a confirmed observation from a suspected broader exposure.
Chapter 8: Security testing tools
Compare tool categories by purpose and limits. Explain how you would validate a tool’s finding before escalating it as a confirmed vulnerability.
Chapter 9: Standards and industry trends
Use standards and industry developments as context for decisions. Distinguish the syllabus’s examinable material from a claim about every current regulation or threat.
Source: ISTQB CT-SEC Syllabus v1.0 2016. ISTQB and the syllabus authors own the official syllabus. The study prompts above are original editorial guidance.
How to prepare
The suggestions below are our editorial advice, not ISTQB requirements.
- Link each security test idea to an asset, threat or requirement.
- Practice stating scope and assumptions so that a finding is not overgeneralized.
- Distinguish a technical weakness from its business consequence in your reports.
- Review how human behavior and organizational processes affect the risks you are testing.
Try this study exercise
For an invented customer portal, list valuable assets, likely misuse cases and relevant access boundaries. Choose one risk and draft a test objective, scope, evidence to collect and reporting approach. Explain the difference between finding an issue and demonstrating that a fix addresses it. Use a fictional or explicitly authorized environment for practical work.
A study plan with milestones
Use four passes through the material rather than a guaranteed number of weeks. The pace depends on your experience and available study time. This plan is our editorial recommendation, not an official course duration.
| Pass | Focus | Evidence of progress |
|---|---|---|
| 1. Orient | Read the learning objectives and Introduction to security testing, Security testing purposes, goals and strategies, Security testing processes, Security testing throughout the software lifecycle | A chapter map with terms you can explain and objectives you cannot yet demonstrate. |
| 2. Apply | Testing security mechanisms, Human factors in security testing, Security test evaluation and reporting, Security testing tools, Standards and industry trends | A scoped security testing plan and an evidence-based finding, showing the connection between asset risk, investigation and evaluation. |
| 3. Diagnose | Take the matching official sample without looking at the answers | An error log separating missing knowledge, reasoning mistakes and rushed reading. |
| 4. Consolidate | Rework weak objectives and repeat the relevant exercises | A reasoned explanation of corrected answers, plus a confirmed exam version and booking checklist. |
For each uncertain answer, record the learning objective, why your choice seemed plausible, the official explanation and the example you will use to check your understanding again. Revisit guesses even when they happened to be correct.
Use the official sample exams
Take one sample under timed conditions before you open the answers, then review every guess as well as every wrong answer. Our sample exam guide shows how to turn a practice score into a study plan.
Before you book
Confirm the exam version, language and your eligibility with the provider before you pay. Use our booking checklist, the USA and India guides, and the exam day checklist.
Common questions
How much experience does CT-SEC require?
The official overview specifies at least three years of relevant academic, practical or consulting experience, in addition to CTFL. Ask the provider how it evaluates and documents that experience.
Does CT-SEC replace Security Test Engineer?
They are separately listed qualifications. Compare their scope and eligibility rather than assuming that a newer or differently named security certificate is equivalent.
Is security testing only penetration testing?
The syllabus covers a wider test process, lifecycle, protection mechanisms and human factors. Preparation should not be limited to operating a penetration-testing tool.
Should I use real targets for the study exercises?
Use fictional examples or an environment you are explicitly authorized to test. Exam preparation does not provide authorization to investigate someone else’s systems.
Related certification guides
Return to the full certification directory →
Fees and booking
Use our exam fees overview to compare exam prices, taxes, retake charges and booking terms. Check the dated fee records in our USA guide or India guide. For other countries, use the member board directory to find the appropriate booking route. Check the final amount and terms with your provider before you pay.
Sources and how we checked
Syllabus and exam facts checked on October 4, 2026. Scope summaries are based on the official documents linked below. Decision advice, study routines and the worked exercise are our editorial guidance. Provider availability and booking terms can change.