- What it is: the ISTQB Certified Tester Security Tester (CT-SEC), formerly called Advanced Level Security Tester, certifies that you can plan, design, execute and evaluate security tests aligned with the organization's risks and policies.
- Version: 2016 syllabus (a Spanish translation, v1.25, is also available).
- Prerequisites: the Foundation Level (CTFL) certification and, according to ISTQB, at least 3 years of relevant academic, practical or consulting experience.
- Exam: 45 questions, 80 points, pass mark 52 points (65%), 120 minutes (150 if it isn't your native language).
- How it relates to CT-STE: ISTQB split CT-SEC content into two new certifications: Security Test Engineer (CT-STE), launched in 2025, and Security Test Analyst (CT-STA), announced for 2026. There is no automatic transfer.
- Which one to pick? If you are starting today and your role is executing tests, CT-STE is the more current option. CT-SEC is still in the portfolio and, unlike CT-STE, iSQI also offers it in Spanish.
If you want an ISTQB security testing certification, you will run into two similar names: Security Tester (CT-SEC) and Security Test Engineer (CT-STE). They are not the same thing, and one does not automatically replace the other. This guide covers CT-SEC in depth (what the syllabus includes, what the exam looks like, who it makes sense for) and how it relates to the new security certifications, based on what ISTQB has published.
What CT-SEC is and where it sits in the ISTQB portfolio
CT-SEC was born in 2016 as a specialist module of the ISTQB Advanced Level, under the name Advanced Level Security Tester. Today it appears in the ISTQB portfolio as Certified Tester Security Tester (CT-SEC) in the Specialist stream, and its current syllabus is still the 2016 version.
Its scope is broader than CT-STE's: it combines risk and policy analysis, test strategy, the full test process, evaluation of protection mechanisms, human factors and communication of results. That breadth is exactly why ISTQB decided to split it into two profiles.
How CT-SEC, CT-STE and CT-STA relate, according to ISTQB
This is what ISTQB has published on its official site (istqb.org):
- The 2016 CT-SEC syllabus combined various roles and activities in one certification.
- ISTQB split it into two certifications to draw a clearer distinction between key security testing responsibilities:
- CT-STE, Security Test Engineer: focused on the practical execution of security testing activities. Launched in January 2025 (syllabus v1.0.1).
- CT-STA, Security Test Analyst: focused on analyzing business security risks and defining security testing strategies. ISTQB scheduled it for 2026; check istqb.org to see whether it is available yet.
- No automatic transfer or grandfathering: if you hold CT-SEC and want CT-STE or CT-STA, you have to pass the corresponding exam.
One important point: ISTQB has not published a retirement date for CT-SEC. As of October 2026, the certification is still listed on its site, its exam structure is still in the official ISTQB exam structure tables (May 2026 version) and iSQI still sells it. Your CT-SEC certificate remains valid; what has changed is that newer, more specialized certifications now exist.
| Aspect | CT-SEC (Security Tester) | CT-STE (Security Test Engineer) |
|---|---|---|
| Syllabus | 2016 | v1.0.1 (2025) |
| Focus | Broad: risk, strategy, process, mechanisms, human factors, reporting | Execution: techniques, environment, standards (OWASP, CWE, CVSS), tools, reporting |
| Prerequisites | CTFL + at least 3 years of relevant experience | CTFL |
| Exam | 45 questions, 80 points, 120 min | 40 questions, 43 points, 75 min |
| K-levels on the exam | 20 K2, 15 K3, 10 K4 | 24 K2, 13 K3, 3 K4 |
| Languages at iSQI (at the time of writing) | English, Spanish, German and Brazilian Portuguese | English |
| Modern topics | Does not cover Zero Trust, DevOps or SAST/DAST/IAST as modern categories | Includes Zero Trust, DevOps, ISMS, SCA, IAST |
Who it is for and prerequisites
According to the syllabus, CT-SEC is aimed at people who have already reached an advanced point in their testing careers and want to build expertise in security. It fits well with:
- Testers and test analysts with several years of experience who are taking on security responsibilities.
- Test leads and managers who need to plan and defend a security testing strategy.
- Quality or security consultants who audit policies, procedures and controls.
- Information security professionals who want a formal testing framework.
Official requirements
- A valid Foundation Level (CTFL) certification.
- Experience: the syllabus asks candidates to satisfy the exam board that they have sufficient practical experience, which should be no less than 3 years of relevant academic, practical or consulting experience. Each board or exam provider decides how to verify it, so confirm before you buy.
- An accredited course is optional: you can take the exam independently.
What you will be able to do
The 2016 syllabus doesn't include the business outcomes table that newer syllabi have, but its learning objectives make the profile clear. A certified Security Tester can:
- Use risk assessment to plan and design security tests aligned with the business, identifying assets, their value and the level of protection they need.
- Analyze security policies and procedures alongside test results to determine whether they are effective.
- Define security testing objectives, scope and approach, and identify why an approach failed.
- Define a security test process and analyze a security test plan, pointing out strengths and weaknesses.
- Analyze requirements and design documents from a security perspective to find deficiencies.
- Test the effectiveness of mechanisms such as hardening, authentication and authorization, encryption, firewalls, intrusion detection, malware scanning, data obfuscation and security training.
- Analyze attack scenarios, social engineering and security awareness across the organization.
- Analyze status reports and KPIs to improve security testing practices, and document tool needs.
The CT-SEC syllabus chapter by chapter
The syllabus has nine chapters with examinable content (the tenth is references). Together they add up to 1,110 minutes, about 18.5 hours of minimum training.
| Chapter | Time | Max K-level | Key topics |
|---|---|---|---|
| 1. The basis of security testing | 105 min | K4 | Risks, asset identification, risk assessment techniques, policies and procedures, auditing |
| 2. Purposes, goals and strategies | 130 min | K4 | Why test security, organizational context, objectives, scope, approaches, stakeholders, KPIs |
| 3. Security testing processes | 140 min | K4 | Process definition, test plan, design, environment and approvals, evaluation, maintenance |
| 4. Security testing throughout the lifecycle | 225 min | K4 | Requirements, design, component, integration, system, acceptance, maintenance |
| 5. Testing security mechanisms | 240 min | K3 | Hardening, authentication and authorization, encryption, firewalls and network zones, IDS, malware, obfuscation, training |
| 6. Human factors | 105 min | K4 | Attackers and motivations, reconnaissance, social engineering, security awareness |
| 7. Evaluation and reporting | 70 min | K4 | Changing acceptance criteria, confidentiality of results, dashboards, status reports |
| 8. Tools | 55 min | K4 | Static and dynamic analysis, tool needs, open source, vendor evaluation |
| 9. Standards and industry trends | 40 min | K2 | Regulatory vs. contractual standards, normative vs. informative clauses, trends |
Chapter 1. The basis of security testing
It all starts with risk. The chapter explains how risk assessment feeds security test planning and design, and asks you, at K4, to identify the significant assets, their value and the data needed to decide how much protection each one requires. Example: at an insurer, policies, medical records and agent credentials carry different values and risks, which changes how deep testing goes.
It also covers security policies and procedures: how they are applied and how to analyze, together with test results, whether they actually work. It closes with the security audit: its purpose, risk identification and mitigation, and the people, process and technology view.
Chapter 2. Purposes, goals and strategies
This answers the question: why do we test security? To reduce risk and give the organization confidence. The chapter shows how project, business and lifecycle constraints affect the security testing team's mission, and why objectives must align with the security policy.
The K3 and K4 objectives are very practical: identify security test objectives from functionality, technology and known vulnerabilities; analyze which approach is most likely to succeed; analyze why an approach failed; identify stakeholders and the benefit for each; and analyze KPIs to see which practices to improve. It also separates information assurance from security testing: the former is broader, just as quality assurance is broader than testing.
Chapter 3. Security testing processes
It adapts the ISTQB test process to security and aligns it with different lifecycle models. It prepares you to analyze a security test plan and give feedback on its strengths and weaknesses, implement abstract tests based on functional and structural risks, and design test cases that validate policies and procedures.
One point that prevents a lot of trouble in practice: planning and approvals before any security test. A penetration test without written authorization can take a service down or have legal consequences. The chapter closes with evaluating results (nature, extent and impact of the vulnerability, suggested remediation and how to report it) and maintaining the process as threats evolve.
Chapter 4. Security testing throughout the software lifecycle
The second-longest chapter. It explains why security is best achieved within the lifecycle and which activities belong to each phase. It includes two very valuable K4 objectives: analyzing requirements and analyzing design documents from a security perspective to find deficiencies. Example: a requirement says "users can recover their password by email" but says nothing about link expiration, attempt limits or what happens when the email doesn't exist.
It then works through the test levels: component tests from a coding specification and analysis of their results, component integration tests, end-to-end scenarios in system testing, security acceptance criteria and a retest and regression approach in maintenance.
Chapter 5. Testing security mechanisms
The longest chapter (240 minutes) and the most technical. For each mechanism you understand the concept (K2) and demonstrate how to test its effectiveness (K3):
- Hardening: unnecessary services disabled, ports closed, default accounts removed.
- Authentication and authorization: who you are and what you may do; for example, trying to reach an admin function with a regular user.
- Encryption: algorithms, keys and configuration in transit and at rest.
- Firewalls and network zones: traffic between zones follows the defined rules.
- Intrusion detection: a simulated attack triggers the expected alert.
- Malware scanning: the tool detects harmless test files designed for that purpose.
- Data obfuscation: masked data cannot be used to rebuild the original information.
- Security training: how to measure whether training changed behavior, for example with authorized phishing simulations.
Chapter 6. Human factors in security testing
Most incidents have a human component. The chapter explains the attacker mindset, how attackers discover information about a target (reconnaissance) and how to protect against it, the types of attackers (from script kiddies to organized groups) and their motivations. It includes a K4 objective: analyze an attack scenario that has already happened and been discovered, and identify its likely source and motivation. It also covers social engineering and security awareness, and how to act on test results to raise it.
Chapter 7. Evaluation and reporting
It covers revising expectations and acceptance criteria as the project evolves, the confidentiality of security test results, and mechanisms for timely, accurate status data, such as a security test dashboard. The K4 objective is to analyze an interim status report and judge whether it is accurate, understandable and right for its audience.
Chapter 8. Security testing tools
It explains the role of static and dynamic analysis tools, how to analyze and document the needs a tool must cover, the issues with open-source tools (support, licensing, reliability) and why you should evaluate a vendor's ability to update its tool frequently as new threats appear.
Chapter 9. Standards and industry trends
The shortest chapter: the benefits of using standards and where to find them, how their applicability differs in regulatory versus contractual situations, the difference between mandatory (normative) and optional (informative) clauses, and where to keep up with information security trends.
Download the official syllabus
The syllabus is available in English and in a Spanish translation:
The CT-SEC exam
Official structure according to the ISTQB exam structure tables:
| Item | Value |
|---|---|
| Number of questions | 45 (multiple choice) |
| Total points | 80 |
| Pass mark | 52 points (65%) |
| Duration | 120 minutes; 150 minutes if you take it in a language that isn't your native language (+25%) |
| Distribution by K-level | 20 K2 questions, 15 K3 and 10 K4 |
| Prerequisites | CTFL and relevant experience (recommended minimum of 3 years) |
It is a demanding exam: 10 analysis questions (K4), which tend to be worth more points and come with long scenarios. Manage your time: 120 minutes gives you just over 2.5 minutes per question.
Exam formats
- Online with remote proctoring (iSQI FLEX): from home, 24/7, with a webcam, microphone, a second camera on your phone and a government-issued ID. For advanced exams, iSQI asks you to book at least 48 hours ahead.
- Pearson VUE: iSQI states this exam is also available at Pearson test centers; check the OnVUE online option when you book.
- At your company: groups of 6 or more can take it in person with a proctor brought by Cool Testers.
Paper exams are no longer offered. At the time of writing, iSQI offers CT-SEC in English, Spanish, German and Brazilian Portuguese. The certification is worth the same in any language; if a company working on US projects prefers the English exam, that is the company's preference, not a feature of the certification.
Where to buy it
- Directly from iSQI, our partner and official exam provider, if you are paying yourself.
- Through Cool Testers, with 1 or 2 attempts and 1 year to take it, if your company pays, you get reimbursed or you need an invoice: buy or get a quote for your certification exam.
Before you buy, confirm how your experience will be verified. Questions? Message us on WhatsApp.
How to prepare
Cool Testers doesn't currently offer a dedicated CT-SEC course. This is the path we recommend:
- Decide between CT-SEC and CT-STE first. If your job is executing security tests and you are comfortable with English material, CT-STE is more current. If you already have several years of experience, your role includes strategy and risk, or you prefer to test in Spanish, CT-SEC is still a valid choice.
- Master Foundation Level. It is mandatory and the basis of the exam vocabulary. If you don't have it yet, start with our ISTQB Foundation Level (CTFL 4.0) course, with 40 live hours, a pre-recorded course, an Express review course and 4 practice exams, and use the ISTQB certification guide.
- Give chapters 4 and 5 more time (225 and 240 minutes) and practice the K4 objectives: analyzing requirements, designs, plans and reports through a security lens.
- Practice with scenarios: take a real requirement from your project and list its security gaps; review a test plan and point out which risks it misses.
- Take the official sample exam under timed conditions.
Need to train your team in security testing? Request a corporate training proposal.
Benefits and career paths
- A senior security profile: CT-SEC shows you can connect business risk, policies and testing, something regulated sectors such as banking, insurance, healthcare and government especially value.
- Available in Spanish: a practical advantage for Spanish-speaking teams.
- International recognition: ISTQB is the most widespread testing certification scheme in the world.
Related roles: Security Tester, test lead with security responsibilities, quality and compliance consultant, IT risk analyst or technical controls auditor.
How it relates to other certifications and what comes next
- Security Test Engineer (CT-STE): the successor on the execution side; useful if you hold CT-SEC and want to update your knowledge with Zero Trust, DevOps, CWE/CVSS and modern tools. Remember you have to take its exam.
- Test Management (CTAL-TM): if your next step is leading complete test strategies, including security.
- Technical Test Analyst (CTAL-TTA): for the technical side of non-functional quality characteristics and white-box techniques.
- Quality in DevOps (CT-QDO): to bring security testing into continuous delivery pipelines.
Frequently asked questions
Is CT-SEC still current?
Yes. As of October 2026, ISTQB has not published a retirement date: the certification is still in its portfolio and official exam tables, and iSQI still offers it. Certificates already issued remain valid.
What is the difference between CT-SEC and CT-STE?
CT-SEC (2016) combines several roles: risk, strategy, process, mechanisms and reporting. ISTQB split that content into CT-STE, focused on executing security tests, and CT-STA, focused on analyzing business risks and defining strategies.
If I hold CT-SEC, do I get CT-STE automatically?
No. ISTQB confirmed there is no grandfathering or automatic transfer. To earn CT-STE or CT-STA you have to pass its exam.
What are the CT-SEC exam prerequisites?
You need the Foundation Level (CTFL) certification and relevant experience, which according to ISTQB should be no less than 3 years of academic, practical or consulting experience. An accredited course is optional.
What is the CT-SEC exam like?
It has 45 questions worth 80 points in total; you pass with 52 points (65%). It lasts 120 minutes, or 150 if you don't take it in your native language.
Which languages is CT-SEC available in?
At the time of writing, iSQI offers it in English, Spanish, German and Brazilian Portuguese.
Which is better for me, CT-SEC or CT-STE?
If you are new to security and your role is executing tests, CT-STE is the more current option. If you have several years of experience, your role includes strategy and risk, or you prefer to take the exam in Spanish, CT-SEC is still a good choice.