Skip to content
CertGPS

Blue Team Level 2

Proves you can run a 72-hour intrusion investigation, from malware analysis to threat hunting, and write a hand-marked report

AdvancedCentri

The exam

Exam cost
$2,648
Study time
6-12 months
Passing score
70% (hand-marked report)
Valid for
Lifetime (no renewal)

Before you book

  • None required
  • Recommended: complete BTL1 first
  • Recommended: 2–4 years in a practical security operations role

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

    • Threat Intelligence Lead
    • IR Manager
    • Detection Engineer

  3. Senior level

    • Director of Threat Intelligence
    • CISO

Where it leads

  1. Blue Team Level 1

    Entry

    Comes before. Centri advises finishing BTL1 first, though BTL2 has no formal entry requirement

  2. Blue Team Level 2

    You are here

Study guide

Last updated

BTL2 Study Guide: A 72-Hour Intrusion Investigation, Hand-Marked at 70%

Blue Team Level 2 (BTL2) asks you to play incident responder for three days: investigate an advanced intrusion in a browser-based corporate network, then submit a written report that Centri's examiners mark by hand. Centri, the 2026 name for Security Blue Team, lists the course and exam at £1,999, five times the price of BTL1, so settle the budget before anything else.

Who it's built for

Centri aims BTL2 at analysts with two to four years in a practical security role: mid-level SOC analysts, incident responders, threat hunters, malware analysts and digital forensics and incident response (DFIR) specialists. There are no formal prerequisites. Centri suggests finishing BTL1 first unless you're confident in your skills, and it labels BTL2 intermediate.

If you mostly need forensic depth on disks and memory, GCFA is the closer match. For reverse engineering as a specialty, GREM goes further than BTL2's malware section. If you're still in your first SOC job, CDSA offers a seven-day report-graded exam for far less money.

The exam at a glance

BTL2
FormatPractical incident response investigation in a browser-based lab, written up in a report template
TimeUp to 72 hours, including report submission
Passing score70%; 90% or more on a first attempt earns the gold coin
MarkingBy hand; 20 working days per Centri's support centre (the product page still says 30); not eligible for manual review
Price£1,999 for training and exam, charged in local currency at checkout (about $2,648 at mid-October 2026 rates)
DeliveryOnline and open book, with no proctor; AI assistants are banned
AttemptsTwo included, at least 10 days apart; a third can be requested for £100
Access5 months of training and 120 lab hours; 12 months to use the attempts
PrerequisitesNone; BTL1 and 2+ years of experience recommended
ValidityLifetime, with no renewal

Where the syllabus puts its weight

Centri lists five areas and no weights: Malware Analysis, Threat Hunting, Advanced SIEM, Vulnerability Management and Adversary Emulation, plus exam preparation. The numbers it does publish tell you where to spend time. Malware Analysis alone has 107 topics, 4 quizzes and 17 of the course's 28 labs. It covers a home analysis lab, static and dynamic analysis, Windows internals, assembly language and C code constructs in reverse engineering, using tools such as pestudio, CAPA, YARA, ProcDOT, Regshot and OfficeMalScanner across executables, PDFs and Office documents.

The other sections are tool-heavy too. Threat hunting at scale uses Velociraptor, GRR and KAPE, along with Chainsaw, RITA and Wireshark. The adversary emulation section uses the ATT&CK Navigator and DeTT&CT to find gaps in SIEM detection rules. Vulnerability management covers OpenVAS, Nmap, Nikto and WPScan, a section we rarely see in a blue team course.

The exam is a single scenario. You get the scenario details, instructions for the environment and a report template, and the marks come from what you write down, so a finding you don't write up earns nothing. The final report must be a single PDF under 50 MB, and only your latest upload counts.

A preparation plan for the five-month window

Training access runs 155 days from activation, and Centri's estimates disagree: about 50 hours on the product page, 60 to 70 hours in its FAQ. Plan on the higher figure, and on more if assembly is new to you.

  • Months 1 and 2: Malware Analysis, every lab, with your own notes on each tool's useful flags. Build the home analysis lab the course describes; you'll want it after the course access ends.
  • Month 3: Threat Hunting and Advanced SIEM. Rerun each hunt from scratch without the lesson open.
  • Month 4: Vulnerability Management and Adversary Emulation, then a practice report. Pick a completed lab and write it up in full, with a timeline, affected hosts, indicators, root cause and recommendations.
  • Month 5: revision and the exam. Exam access lasts 12 months from activation, so there's no need to rush.

Spend at least a third of your exam window on writing, because turning three days of notes into a coherent narrative takes longer than it looks. Save screenshots and command output as you go, and keep a running timeline document from the first hour.

Results and afterwards

Expect to wait about four weeks for your mark. If you fail, there's a 10-day cooling-off period before the second attempt, which is free; plan both inside the 12-month window. BTL2 is a lifetime credential, with no renewal or CPE requirement, though Centri notes that employers who want recent dates must buy and pass it again.

Logical next steps:

  • GCFA for deeper forensic analysis.
  • GREM for malware reverse engineering.
  • GCIH if your organization standardizes on GIAC.

Our view

BTL2 is respected because it's marked by people reading a report, and because its malware and hunting content goes well past what entry-level blue team courses cover. Its weaknesses are price and verification. At £1,999 it's priced well above the other practical blue team exams covered here, the exam is unproctored and open book, and we don't expect hiring managers outside SOC teams to know the name. It's worth paying for when your employer funds it or when you need structured practice in malware analysis and hunting, which are hard to practise without prepared samples and labs. If you're paying yourself and only need a credential on your CV, CDSA costs a fraction of the price.

Sources