Candidates must hold an ISTQB® Certified Tester Foundation Level (CTFL) certificate before taking either examination.

Both certifications are suitable for professionals interested in security testing. CT-STA focuses on security risk analysis, planning, and strategy, while CT-STE focuses on technical security testing activities.

The original CT-SEC syllabus combined several security testing roles and responsibilities. The new certifications provide greater specialization and a clearer distinction between two important areas:

• CT-STE, released in January 2025, focuses on the practical execution of security testing activities.
• CT-STA, released in November 2026, focuses on analyzing security risks, defining security testing strategies, planning testing activities, and evaluating results.

Together, they provide complementary coverage of security testing responsibilities.

No. There is no automatic transfer or grandfathering from CT-SEC to either CT-STE or CT-STA.

Existing CT-SEC certificate holders wishing to obtain either new certification must pass the respective examination. Existing CT-SEC certificates remain valid.

Penetration testing is only one aspect of security testing. ISTQB® takes a broader approach, emphasizing the integration of security testing throughout the software development lifecycle.

CT-STA addresses security risk analysis, test strategy, planning, and evaluation, while CT-STE addresses technical security testing activities. Together, they help organizations integrate security testing into their established development and quality assurance processes.

Programming experience is not a mandatory prerequisite for either certification.

CT-STA focuses on the analytical and planning aspects of security testing, including risk assessment, security test strategies, and interpreting test results. A programming background is therefore not essential, although an understanding of security concepts and technical environments is beneficial.

CT-STE has a stronger technical focus, so familiarity with networks, security controls, vulnerabilities, and technical testing practices is particularly beneficial.

Yes. Both certifications address security testing principles that can be applied across different industries.

CT-STA specifically covers the relationship between risk management, internal control systems, and regulations, including how regulatory requirements influence security testing activities.

CT-STE provides technical security testing knowledge that can support the assessment of security controls and requirements.

Software quality involves more than functional correctness. Security testing helps identify vulnerabilities and risks that may affect software, systems, and their users.

CT-STA and CT-STE enable experienced testers to broaden their knowledge into security testing, developing analytical, strategic, or technical capabilities according to their professional responsibilities.

CT-STA focuses on the analytical and strategic aspects of security testing. The syllabus covers six key areas:

• Assets and their security risks
• Understanding the attacker’s mindset
• Risk management, internal control systems, and regulations
• Defining security test objectives, strategies, and activities
• Specifying security testing work packages
• Interpreting security test results and defining appropriate actions

CT-STA complements CT-STE, which focuses on the technical execution of security testing activities.

Following the release of CT-STA on November 10, 2026, the existing CT-SEC certification will enter its sunset period.

Examinations (including retakes) and accredited training will remain available until:

• November 10, 2027 – English-language examinations and accredited training.
• May 10, 2028 – Non-English-language examinations and accredited training.

After these dates, CT-SEC examinations and accredited training will no longer be available. Existing CT-SEC certificates remain valid.