Become an elite defender with HTB CDEP: Master advanced threat detection and expose hidden threats.
Hack The Box (HTB) has just launched the Certified Detection Engineering Principal (HTB CDEP). It’s HTB's first principal-level certification built for experienced defenders ready to specialize in advanced threat detection.
Master the detection lifecycle, from low-level adversary tradecraft analysis to defensible detection logic, and validate your skills in a 10-day enterprise engagement.
Follow the attack into process memory. Trace the API calls. Inspect the operating system (OS) kernel telemetry that reveals how it executes.
HTB CDEP will take you beyond basic security information and event management (SIEM) query writing into the low-level mechanics behind adversary behavior. You’ll investigate adversary behavior at the process, memory, API, and operating system kernel level, identify the telemetry that exposes it, and engineer detections you can validate and defend.
For organizations, this is one of the hardest capabilities to build. Vendor detections are written to work across every customer, not tuned to your environment. The specialists who can engineer and maintain custom detection logic are scarce, and outsourcing that work is expensive. HTB CDEP gives security teams a structured way to build that expertise in-house.
The HTB CDEP combines a 13-module Detection Engineer Job Role Path with a 10-day hands-on enterprise engagement.
The new Platinum Annual plan on HTB Academy includes the Detection Engineer path and an HTB CDEP exam voucher with up to 2 attempts.
You can also unlock the path through Cubes and buy the voucher separately if preferred.
DISCOUNT CODE: PLAT25OFF26
Use the code above to get your first year of Platinum Annual with a 25% discount.
The offer is valid until November 12, 2026.
For organizations developing detection engineering capability, the Detection Engineer Job Role Path and HTB CDEP are available on HTB Enterprise Platform. If you’re interested in knowing more, talk to our team here →
The Detection Engineer path brings offensive tradecraft analysis into your defensive workflow. You’ll study the detection lifecycle and map techniques with MITRE ATT&CK and D3FEND.
Then it’s into the internals.
Interactive Splunk and Wazuh cyber ranges give you a place to validate your detection logic.
And you’ll work through the full detection lifecycle. Choose the telemetry, develop your logic, and test it. Tune the detection and document what it can tell you, including its limits.
The methods carry across tools. The focus stays on the behavior you’re trying to detect.
The HTB CDEP exam puts you into a realistic enterprise engagement with attack chains to investigate and live flags to submit.
You’ll also produce a mandatory commercial-grade technical report.
Your findings need to hold up on the page. Explain the attack progression, show the evidence behind your detection logic, and document the telemetry limitations.
The report is part of the assessment. You’ll need to turn your technical investigation into professional, client-ready findings.
Before attempting the exam, you must complete 100% of the Detection Engineer path, including every end-of-module practical skills assessment.
HTB CDEP is for practitioners ready to specialize. Detection engineers, experienced security operations center (SOC) analysts at L2/L3, and threat hunters are right at home here.
The path also fits digital forensics and incident response (DFIR) practitioners, malware analysts, and security researchers.
Coming from a red team background? You’ll get to examine familiar tradecraft from the defender’s side.
We strongly recommend completing HTB CDSA before starting. It’s recommended preparation, rather than a mandatory entry requirement.
This is advanced material. Give yourself room to work through the debugging and low-level telemetry exercises before jumping in.
Out-of-the-box detections cover the common cases. The threats that matter most to your organization often don’t fit them. Closing that gap takes detection logic engineered for your environment, your telemetry, and the adversaries you actually face.
That work is hard to staff. Engineers who understand adversary behavior at the process, memory, and kernel level are rare, and bringing in outside specialists is costly. When the engagement ends, the knowledge often leaves with them, while the detections they built still need tuning every time your environment changes.
HTB CDEP gives your team a structured path to build that expertise internally and a rigorous way to validate it. It helps you set a consistent standard for advanced detection skills, spot gaps before they turn into missed detections, and reduce dependence on external specialists for complex detection work.
The mandatory technical report matters here too. Certified engineers have shown they can document detection logic, supporting evidence, and telemetry limitations clearly enough for leadership, auditors, and other teams to act on.
The Detection Engineer path is also mapped to DoW Cyber Workforce Framework (DCWF) knowledge, skills, abilities, and tasks supporting key defensive work roles, including Host Analyst (463), Network Analyst (443), Cyber Defense Incident Responder (531), and Cyber Defense Forensics Analyst (212). This helps organizations develop role-aligned detection and defense capabilities in support of DoW 8140 workforce requirements.
Investigate adversary tradecraft. Find the telemetry behind hidden threats and build detection logic you can defend. Your preparation starts with the Detection Engineer path.