TH-200: Foundational Threat Hunting

TH-200 FAQ

• Who is the TH-200 course for?

  TH-200 is ideal for:

  • Individuals looking to build a strong foundation in threat hunting
  • Those aiming to transition into specialized security roles
  • SOC Analysts
  • IT Security Specialists
• What are the TH-200 prerequisites?

  While there are no formal prerequisites, it’s strongly encouraged that you have:

  • A solid foundation in TCP/IP networking
  • Familiarity with Linux and Windows operating systems
  • Basic understanding of cybersecurity concepts

  All of the above can be found in our Threat Hunting Foundations Learning Path

• Does the OSTH certification expire?

  Yes, the OSTH will expire 3 years after the date you passed the exam. To maintain the validity of your certification, consider one of the following renewal options before your expiration date:

  • Pass a Qualifying Exam: Take and pass an OffSec certification exam within the same category at the same level or higher before your certification expires.
  • Recertification Exam: Take and pass a recertification exam within six months before your certification’s expiration date to extend validity.
  • Continuing Professional Education (CPE) Program. You may refer to the CPE handbook for more information.

  Please note that, if your certification expires, you will need to retake and pass the same certification exam.

• What job roles do OSTH certified professionals often hold?

  The OffSec Threat Hunter (OSTH) certification is designed for cybersecurity professionals who want to specialize in proactively detecting and responding to threats within enterprise environments. It emphasizes advanced threat hunting techniques, including behavioral analysis, endpoint forensics, and adversary emulation.

  With the OSTH certification, you demonstrate the ability to go beyond alerts and logs—identifying stealthy intrusions, uncovering hidden attacker behaviors, and strengthening an organization’s overall security posture.

  Career roles suited to OSTH-certified professionals include:

  • Threat Hunter
  • Incident Responder
  • SOC Analyst (Tier 2 or 3)
  • Blue Team Analyst
  • Cyber Threat Intelligence Analyst
  • Defensive Security Engineer

  OSTH is especially valuable for professionals in environments where proactive defense and in-depth investigation are key to minimizing dwell time and reducing the impact of advanced persistent threats (APTs). It pairs well with other defensive or offensive certifications to round out a complete detection and response skill set.

• How do I get CPE points for the IR-200 course?

  All of our fully released courses may qualify students for up to 40 (ISC)² CPE credits. To know if you are eligible to request a completion letter or to find course completion requirements, please visit our How can I obtain (ISC)² CPE credits and/or a course completion letter for my course article.