What's next: BTL1 and eCPPT, defending and attacking the same thing

After Security+ and the eJPT I spent a while turning over what should come next. I had a few Microsoft ones in mind, some cloud ones… and in the end I settled on two that at first glance don’t seem to go together: BTL1, which is pure defense, and eCPPT, which is offense. Let me explain.

BTL1 first

Blue Team Level 1, from Security Blue Team, is a hands-on defensive certification. The exam lasts 24 hours and puts an incident in front of you to investigate with real tools: phishing analysis, forensics, SIEM, threat intelligence and incident response.

I’m doing it first because it’s exactly what I’ve done at work, just without a syllabus behind it. At the SOC I triaged alerts, later I had to investigate a compromised website, clean up webshells, review machines after Wazuh alerts… I learned all that on the fly. BTL1 helps me put it in order, fill the gaps I know I have (forensics, mainly) and have a way to prove it that isn’t “trust me, I’ve done it”.

There’s another thing too: Security+ gave me the theory of defense, but not the practice. BTL1 is the step I was missing.

Then eCPPT

eCPPT, from INE, is the next step after the eJPT on the offensive side. The exam is fully practical and almost a third of it is about attacking Active Directory.

That’s the whole point for me. I’ve spent a lot of time administering AD: GPO, accounts, groups, permissions… I know it pretty well from the inside, but I’ve never attacked it seriously. I want to know what an attacker sees when they land in a domain like the ones I’ve managed, what leaves a trace in the logs and what leaves none. That’ll make me a better admin and a better defender at the same time.

Why both

Because what interests me is in the middle. I don’t see myself only building systems or only watching alerts. I like understanding how something is built, how it breaks and how you can tell someone’s breaking it. People call that purple team, though I’m happy just saying I want to see the full picture.

How I’ll go about it

No fixed dates, because I’ve learned that setting them just stresses me out. The order is clear though: BTL1 first, then eCPPT. And while I study, the plan is to keep putting things on the blog and on GitHub, like detection rules for AD attacks or incident response guides, so what I learn doesn’t stay inside an exam.

I’ll keep you posted.