The eCIR puts you inside a simulated corporate breach and asks scenario questions you can only answer by investigating it: logs, packet captures, endpoint artifacts and a malicious document or two. INE Security relaunched it in September 2025 with five domains built around security operations center (SOC) work. The certification is valid for three years, and the voucher price has risen since launch, from the $399 regular price INE quoted then to $450 now.
Who the eCIR suits
INE describes the audience as people with intermediate experience in incident detection, analysis and response: tier 1 and tier 2 SOC analysts, IT security staff who handle incidents alongside other duties, and aspiring incident responders. It also lists red teamers and penetration testers, which makes sense if you want to see your own techniques from the defender's side.
If you're still learning what an alert is, start with CySA+, CompTIA's vendor-neutral analyst certification. If your employer or a contract asks for GIAC, GCIH is the established choice: 106 questions in four hours, proctored, with CyberLive hands-on items.
eCIR exam facts
| eCIR (September 2025 version) | |
|---|---|
| Format | Practical lab simulating a corporate breach; you answer scenario-based questions from your investigation |
| Questions, time, pass mark | Not stated on INE's public pages |
| Price (US) | $450 voucher for current INE Premium subscribers; $599 eCIR + 3 months of Premium |
| Voucher terms | Valid 180 days; one free retake, taken within 14 days of a failed attempt and before expiry |
| Results | Auto-graded, shown directly after the exam, with a score report by section |
| Prerequisites | None; aimed at people with intermediate incident response experience |
| Validity | Three years; renew with 36 CPE credits plus $99, a higher INE certification plus $99, or by passing the latest version at no fee |
After its first three months, the bundle bills $350 for nine more months of Premium and then $799 a year, unless you cancel.
Five domains, centred on endpoint and network evidence
INE's weights:
- Endpoint & Network Analysis: 35%
- Threat Detection & SIEM Operations: 20%
- Digital Forensics & Evidence-Based Analysis: 20%
- Reporting & Communication: 15%
- Threat Intelligence & Attribution: 10%
Endpoint & Network Analysis is the core. Its objectives ask you to spot enumeration, privilege escalation, persistence and credential theft in endpoint telemetry, then follow the same incident through packet captures to command-and-control traffic, lateral movement and data exfiltration. You'll need to be equally comfortable in Windows logs and in a packet capture, because the objectives join the two.
Each objective is tagged with a level (Understand, Apply, Analyze or Evaluate), which tells you what kind of question to expect. Analyze is the most common, on 7 of the 17 objectives. Persistence, attribution and the recovery recommendations are marked Evaluate, so expect to judge which explanation fits the evidence as well as finding it.
Digital forensics here means three things: pulling the macro code out of malicious Office documents, static analysis of Windows executables, and reading Registry artifacts. There's no memory forensics objective in the outline. Threat intelligence is 10% and centres on mapping behaviour to MITRE ATT&CK and attributing it to known groups.
Reporting at 15% is less clear. INE's exam page says the questions "mirror the type of findings" an incident report would contain, while the launch blog talks of documenting findings in professional reports. Read the instructions when your exam starts, and assume you'll be asked for timelines, impact and containment steps either way.
Practising the investigation
INE's Incident Handling & Response Professional learning path is the official preparation, included with Premium and the bundle. The launch blog describes six courses with browser-based labs, so there's nothing to install.
Beyond the path, practise with the tools the objectives imply. Work through Windows event logs and a packet capture of the same incident until you can line up timestamps across both in Wireshark. Use oletools (olevba in particular) to extract macro code from a sample document, and a PE viewer such as PEStudio to read imports and metadata. Keep the MITRE ATT&CK matrix open while you work, and label each finding with a technique as you go, since that's what the attribution domain tests.
A split that follows the weights: about a third of your time on endpoint and network analysis, a fifth each on SIEM work and forensics, and the rest on writing timelines and mapping behaviour to ATT&CK. INE doesn't name the SIEM used in the exam on its public pages, so practise writing queries in whichever one the learning path uses.
Renewal and next steps
The eCIR is valid for three years from the award date. Renewal takes 36 continuing professional education (CPE) credits or a more advanced certification on the same INE path, each with a $99 fee, or a pass on the newest eCIR at no fee. You can renew up to 18 months early, and the 90-day grace period after expiry costs $199.
INE places eCIR in the middle of its defensive paths, after eSOC or eEDA and before the forensics (eCDFP) and threat hunting (eCTHP) certifications; either of those renews eCIR. Outside INE:
Our view
The 2025 eCIR asks for the right kind of work. Following one breach across logs, network traffic and malware samples is closer to an analyst's day than a bank of standalone multiple-choice items. The drawbacks are transparency and portability. INE doesn't publish the exam length or pass mark publicly, and a contract that names GCIH won't accept eCIR in its place. At $599 with three months of training, we'd recommend it to SOC analysts who want to prove they can investigate, and GCIH to anyone whose employer or contract names a specific credential.
Sources
- INE eCIR certification page: exam format, domains, weights, objectives and levels, audience, voucher and retake terms, results, validity, checked October 2026
- INE: New eCIR certification: September 2025 launch, six courses, launch and regular prices, checked October 2026
- INE press release: eCIR certification launch: practical exam and report emphasis, checked October 2026
- INE checkout: eCIR voucher and bundle: $450 voucher, $599 bundle, renewal billing, checked October 2026
- INE certification renewal: CPE routes, fees, defensive career paths, checked October 2026
- GIAC GCIH: 106 questions, four hours, proctoring, CyberLive, checked October 2026
- oletools: Office document and VBA macro analysis tools, checked October 2026
- pestudio: static analysis of Windows executables, checked October 2026
- MITRE ATT&CK: technique framework named in the objectives, checked October 2026