Hack The Box has launched Certified Detection Engineering Principal (HTB CDEP), its first principal-level certification, for experienced defenders specializing in advanced threat detection. Announced on October 13, 2026, the credential combines a 13-module Detection Engineer learning path with a 10-day practical assessment.
What CDEP Assesses
According to HTB’s enterprise launch notice, candidates investigate adversary behavior and develop detection logic grounded in evidence from realistic attack chains. The assessment includes a mandatory technical report explaining the investigation, supporting evidence, and limitations of the available telemetry.
HTB’s certification guide lists a 10-day CDEP exam window. Candidates must complete their entire associated learning path and hold a valid exam voucher before starting. The launch announcement specifies that completion includes every end-of-module practical skills assessment.
What the Training Covers
The Detection Engineer path focuses on translating attacker behavior into detections that can be tested and improved. Topics include:
- Windows and Linux telemetry, including visibility at user and kernel level.
- Process injection, malware behavior and API monitoring.
- Detection development and validation using MITRE ATT&CK-aligned analysis.
The curriculum recommends prior SOC analyst knowledge, along with a basic understanding of x86/x64 assembly and C or C++. These recommendations help learners judge their readiness for the technical material.
Who This Is For
HTB positions CDEP for detection engineers, experienced L2/L3 SOC analysts, threat hunters and DFIR practitioners. It recommends completing HTB CDSA first, while explicitly stating that CDSA is not a mandatory entry requirement. The material may interest readers progressing in these roles:
- SOC Analyst — moving from alert investigation toward developing and validating detections.
- Incident Responder — using evidence from investigations to improve defensive coverage.
Access and Launch Offer
HTB’s launch announcement says its new Platinum Annual Academy plan includes the path and a CDEP voucher with up to two attempts. Learners can alternatively unlock the path with Cubes and purchase the voucher separately.
The announcement advertises 25% off the first year of Platinum Annual using code PLAT25OFF26, valid through November 12, 2026. Confirm the current price, taxes and voucher terms at checkout before buying.
New to the platform? Start with our guide to what Hack The Box is, see how it stacks up in Hack The Box vs. TryHackMe, or compare it with other options in our roundup of the best hands-on cybersecurity labs and practice platforms.
Reading about detection engineering is the easy part.
CDEP is a 10-day practical exam, and you pass it by writing detections, not by memorizing them.
HTB Academy’s Detection Engineer path puts you inside realistic attack chains so you can build and validate detection logic yourself.
Start training on HTB Academy →This is an affiliate link. If you sign up, The Cybersecurity Trail earns a commission at no cost to you.
