Skip to main content
Back to certifications

CyberDefenders · Cybersecurity

Certified CyberDefender Level 2 (CCDL2)

Defensive investigation using endpoint, network and other incident evidence.

View certification details
Understand the subject

Defensive investigation using endpoint, network and other incident evidence.

Apply it to the work

Useful when an analyst must connect several artefacts into an account of attacker activity and explain the limits of the conclusion.

Build practical evidence

Have some investigation practice already. Build timelines, keep evidence references and be prepared to revisit an early assumption when new information arrives.

Level
Intermediate+

What you will learn to do

Understand the subject

Defensive investigation using endpoint, network and other incident evidence.

Apply it to the work

Useful when an analyst must connect several artefacts into an account of attacker activity and explain the limits of the conclusion.

Build practical evidence

Have some investigation practice already. Build timelines, keep evidence references and be prepared to revisit an early assumption when new information arrives.

Certification essentials

Requirements, costs and keeping it current.

Check the vendor record and ongoing commitment alongside the career guidance.

Pricing view
Market

Vendor record

Renamed

CyberDefenders now names this credential CCDL2, formerly CCD. The vendor describes a 48-hour practical exam covering threat hunting and forensic investigation. This is a CyberDefenders credential, not a Hack The Box certification.

Source: CyberDefenders · Read 19 September 2026

Sourced fields only; this does not mean every exam detail has been verified. Pricing and renewal policies have their own sources and check dates. Confirm the currency, tax and final booking total with the vendor.

Role-fit guidance is TechWaymark editorial interpretation. It is separate from the recorded vendor facts and does not measure hiring outcomes.

Costs and renewal

Exam cost
US$849 exam / US$1,499 prep bundle
Exam format
Exam format not yet verified — check the vendor's exam page
Keeping it current

Renew every 4 years by submitting 36 CPE credits or passing the latest certification exam. There is no fee to renew or maintain the badge.

Renewal sources & exceptions

Relevant training, conferences and work can count towards CPE. CyberDefenders does not require you to repurchase training for renewal.

Renewal policy checked 2026-09-28. Check the linked provider policy for current fees and eligibility.

CCDL2 exam-only includes two attempts within four months. The prep bundle adds four months of course and CyberRange access, labs and practice investigations. Confirm tax at checkout. This replaces older CCD package prices. Vendor price checked 2026-09-24. Check the vendor record before booking.

Current vendor pricing source ↗
Preparation and practical skills

Recommended prior knowledge

  • BTL1 or hands-on SOC experience

Common misconceptions

  • Certified CyberDefender Level 2 (CCDL2) may meet a named requirement; it does not guarantee shortlisting or replace documented work.

What this cert does NOT guarantee

  • Guaranteed interviews, a salary increase or proof of production experience.
Alternatives and related certifications

Where this fits

  • None required
This cert
Certified CyberDefender Level 2 (CCDL2)
  • Top of this lane

Alternative routes

No single right path. These adjacent options reach similar roles.

  • GCIH
    Common follow-on or adjacent credential, see the graph for full lineage.
  • GCFA
    Common follow-on or adjacent credential, see the graph for full lineage.

Adjacent & overlapping

  • GCIH
  • GCFA
Career outcomes and limitations

Realistic first roles

Defensive-security investigation practice

How people actually get here

    Real-world career variations

    Timeline expectations

    1. Months 0–2Foundation reading, concepts, vocabulary.
    2. Months 2–4Hands-on labs, documented home projects.
    3. Months 4–6Practice exams, weak-area drills, exam.
    4. Post-examUse target vacancies to guide applications and projects. There is no guaranteed time to a first role.

    Study resources

    Study options

    Choose the right mix for your goals and experience. Links below go to official and third-party resources.

    Guided study

    Structured resources from established providers can help build knowledge and skills.

    Compare study options →

    Third-party providers. Commercial terms, pricing and availability apply.

    Practice environments

    Explore suitable environments for practical work. Check the tools, features and access you need.

    Compare practice resources →

    External resources. Check current costs and access requirements.

    Resources are selected for relevance. Compare access, syllabus coverage and total cost; a listing does not imply a commercial partnership.

    Compare the resources for Certified CyberDefender Level 2 (CCDL2)
    CourseExternal resource

    Security Blue Team. CCD training (official)

    Video + Labs

    Check the resource provider for current local pricing
    View resource
    LabExternal resource

    CCD 48-hour simulated SOC exam environment

    Hands-on

    Check the resource provider for current local pricing
    View resource
    ReferenceExternal resource

    CCD syllabus and exam structure

    Reading

    Free resource; confirm current access terms
    View resource

    Check the current syllabus, access terms and total cost before choosing. Resource inclusion does not guarantee exam success.

    Optional home projects

    Build something you can explain.

    Ideas to explore after choosing a certification, using your own tools and keeping evidence of your work.

    Example project evidence
    Project evidence map (example)
    Detection specification and queryScope and inputs
    Test fixtures and analyst triage guideDecisions and reasoning
    Evidence record (example)
    EvidenceWhat to capture
    Detection specification and queryShow the inputs, scope and decisions behind this record. Each exclusion has an evidence-based purpose.
    Test fixtures and analyst triage guideInclude the evidence supporting your conclusion. The test set includes at least one plausible false positive and one missed-case risk.

    Develop a detection from a hypothesis and test cases

    A defence team wants to detect unexpected scheduled-task creation in a lab dataset. The rule must distinguish an administrator’s planned change from suspicious behaviour.

    Local lab Your own tools Evidence guidance
    View project guide
    Track this certification

    Editorial route and career guidance. No separate external evidence review is recorded for this assessment.

    Editorial evidence review: pending · UK market. Vendor facts and prices elsewhere on this page have their own sources and check dates.