CDEP Study Tracker
What is the HTB CDEP?
The HTB Certified Detection Engineering Principal (CDEP) is Hack The Box's master-level, hands-on detection engineering certification. It tests whether you can investigate low-level attacker tradecraft on Windows and Linux and turn it into detection logic that holds up. The path covers ETW and kernel telemetry, process injection, token abuse, persistence and credential theft.
You earn it by completing the Detection Engineer Job-Role Path (13 modules, 250 sections, rated Hard) and then passing the exam. HTB estimates the path takes 75 days (about 600 hours at 8 hrs/day), and you have to finish 100% of it before the exam unlocks. HTB treats the SOC Analyst path as assumed knowledge, strongly recommends x86/64 assembly and C/C++, and suggests earning the CDSA first.
The exam
The CDEP exam runs for 10 days in a dedicated lab you can reset, and Pwnbox is enough. A letter of engagement sets the scope, and you investigate a realistic enterprise attack chain, submitting flags as you go. HTB has not published the exact pass mark.
You also upload a commercial-grade report in English within 10 days of entering the exam, using the template HTB gives you in the exam (there's no public sample yet). It covers your investigation, the TTPs mapped to MITRE ATT&CK, your evidence, and the detection logic you'd build along with its limits. An instructor grades both the points and the report. You get 2 attempts per voucher, the free retake has to start within 14 days of your feedback, and results arrive within 20 business days.
What it costs
You pay for two things: access to the modules, and the exam voucher. The CDEP voucher is $450 on its own, and the path needs modules up to Tier IV, which only the Platinum plans include.
| Plan | Price | Modules | Exam voucher |
|---|---|---|---|
| Platinum monthly | $125/month | Up to Tier IV | Buy separately, $450 |
| Platinum Annual | $2,000/year | Up to Tier IV | Included, plus a CJCA voucher and one more |
HTB Labs is optional extra practice outside the Academy, billed separately. You don't need it for this exam.
| Labs plan | Monthly | Yearly | What it opens |
|---|---|---|---|
| VIP+Optional | $25/month$223/year | $223/year | Retired machines, challenges and Sherlocks |
| HTB PROOptional | $49/month$490/year | $490/year | Everything in VIP+, plus 10 Pro Labs |
Academy prices from October 12, 2026 and Labs prices from October 2, 2026, in USD before tax. Plans change, so check HTB's Academy and Labs subscription pages before you buy.
The 13 modules in order
- Foundations & Telemetry: Detection & OpSec Cyber Range · Introduction to Detection Engineering
- Debugging & Injection: Introduction to Dynamic Analysis with WinDbg · Process Injection Attacks and Detection · Linux Process Injections & Detections
- Windows Internals & Hooking: Windows Low Level Detectability · Detecting Access Token Manipulation Attacks · Windows API Monitoring and Hooking
- Tradecraft Analysis: Privilege Escalation Tradecraft Analysis · Persistence Tradecraft Analysis · WMI Tradecraft Analysis · Credential Access Tradecraft Analysis
- Kernel Telemetry: Windows Kernel Telemetry & Detection Techniques
Top tips to prepare
- Finish the whole path first. The exam unlocks only after 100% of the Detection Engineer path, and the path runs about 600 hours. (HTB)
- Cover the prerequisites. HTB treats the SOC Analyst path as assumed knowledge, strongly recommends x86/64 assembly and C/C++, and suggests the CDSA first. (HTB)
- Map everything to ATT&CK. The report has to show the TTPs you found across every attack phase, mapped to MITRE ATT&CK. (HTB)
- Write detections, not just findings. For each stage, the report needs the detection logic you'd build and where that logic falls short. (HTB)
- Always submit a first report. If you don't upload a report on your first attempt, you lose the free retake. (HTB)
The full list of tips is at the bottom of the Resource Library tab.
How to use this tracker
- Set your start date at the top. Every day's calendar date and your pace indicator are computed from it.
- Pick a timeline (90/110/145/220/270 days). They all cover the same curriculum, just packed into more or fewer days, and your progress carries across when you switch.
- Tick each task as you finish it. A day is marked complete when all its tasks are done.
- Use the Notes field on each day as a journal for telemetry sources, queries and detection logic that worked, and techniques to revisit.
- All progress is saved in your browser. Use Export backup regularly to keep a copy.
This is an independent study aid and is not affiliated with or endorsed by Hack The Box. Always confirm current module counts, exam format, and pricing on the official HTB Academy site.
Built on and inspired by mattrfield's coae-study-tracker.