CDSA: HTB Certified Defensive Security Analyst

What CDSA is and who runs it

Hack The Box (HTB) runs the certification through its training arm, HTB Academy. CDSA sits on the defensive side: it targets people who want to work in a Security Operations Center (SOC) or move into detection and incident response. The syllabus covers SIEM work, log and network traffic analysis, endpoint and host investigation, detection engineering, threat hunting, and writing incidents up clearly. It’s positioned at an intermediate level — above pure beginner, below senior DFIR. Unlike multiple-choice certs, it’s practical throughout: you learn by doing labs, and the exam itself is a live investigation rather than a quiz.

Cost and what’s included

There’s no separate exam fee in the current model — the exam voucher comes bundled with an HTB Academy annual subscription. The Silver Annual plan is $490/year and includes one exam voucher you can spend on CDSA (or CPTS/CWES/COAE), plus a separate CJCA voucher. That subscription also unlocks the full SOC Analyst path you need to study. The cheaper Student plan ($8/month) unlocks modules but does not include a certification voucher. So budget the $490 as the realistic all-in figure if you want both the training and the exam attempt together.

Time: the exam and the report

The exam is seven days long. That’s calendar time, not an eight-hour sitting — you get a live environment and work realistic incident scenarios at your own pace. There is no separate post-exam report window: you write and submit the report inside those seven days. HTB then grades the report and returns results after review. Most people don’t need the full week of active work, but plan for long days — investigation, disciplined note-keeping, and report-writing all eat time faster than you expect.

How hard it is, honestly

It’s a fair exam, not a trick one, but people consistently underestimate it. The hard part is rarely finding a single answer; it’s methodical evidence-gathering across a lot of data and then writing it up clearly. Reviewers who came in with real SOC experience still say they never felt fully “ready,” which is normal for a scenario exam. If you finish the Academy path properly — labs included — you’ll have seen the tools and techniques the exam expects. Report quality matters: a correct investigation with a weak write-up can still cost you the pass.

Is it worth it — and for whom

For someone targeting a SOC analyst or junior detection/IR role, it’s one of the better-value blue-team certs because it’s hands-on and the report mirrors real work. It’s less useful if you’re already a senior responder, or if a specific employer’s HR filter keys on a different, better-known badge. It carries CPE credits and lands on Credly. Treat it as evidence you can actually investigate an incident end to end, not as a resume keyword to collect.

How to prepare

Complete the SOC Analyst job-role path to 100%, and don’t skip the labs — the muscle memory matters more than the reading. Build a personal note-taking system and a report template before exam day, because the write-up is graded and you don’t want to design it live. Get comfortable pivoting through a SIEM, correlating host and network evidence, and reconstructing an attack timeline. With seven days you can afford to step away, sleep, and return with fresh eyes rather than burning out on day one.

SourcesHTB Academy certificationsHTB Academy subscriptions