If you're targeting a SOC analyst role and trying to figure out which cert to do first, you've probably gone back and forth between these two. CompTIA Security+ and the BTL1 from Security Blue Team are the most commonly recommended entry-level options — and they're genuinely different products aimed at different goals.
Here's an honest breakdown of both, and a straight answer on which to do first depending on your situation.
CompTIA Security+
Security+ is a broad, vendor-neutral certification covering everything from cryptography to incident response to governance frameworks. It's been around for decades and is one of the most recognised security credentials in HR systems.
Who recognises it: Almost every employer. It's listed as a baseline requirement on many junior security job postings, and it satisfies DoD 8570 requirements in the US — which is why it's widely used in government and defence contracting internationally.
What the exam is like: 90 questions, a mix of multiple choice and performance-based questions (drag-and-drop, simulation). 90 minutes. You need 750/900 to pass. Most estimates put first-attempt passing at around 60–70% for prepared candidates.
Cost: Around £350–£400 for the exam in the UK, depending on where you buy the voucher. Study materials are additional — though Professor Messer's free video series covers the full exam objective list.
Study time: 2–3 months if you're working alongside it.
What you'll actually learn: How to talk about security concepts correctly — risk, threats, cryptography, network security, identity management, PKI. It's theory-heavy. You will not leave Security+ knowing how to investigate an alert.
BTL1 (Blue Team Level 1)
BTL1 is from Security Blue Team, a UK-based training company. It's a practical, hands-on certification focused specifically on defensive security — the exact work L1 SOC analysts do.
Who recognises it: Growing recognition in the UK SOC market. It's not on HR tick-lists the way Security+ is, but hiring managers who actually conduct technical interviews know it and often prefer it. It signals you've done the practical work, not just passed a multiple-choice exam.
What the exam is like: A 24-hour practical exam. You're given a set of compromised machines and have to investigate, document your findings, and answer questions about what happened. It's the closest thing to a real incident response exercise you'll do without being in a job.
Cost: £399 for the course and exam combined — training included.
Study time: The included course is substantial. Most people finish in 6–8 weeks at a few hours a day.
What you'll actually learn: SIEM log analysis, network traffic analysis, disk and memory forensics, phishing investigation, endpoint analysis — things you will do in your first week as an L1 analyst.
The honest comparison
| | Security+ | BTL1 | |---|---|---| | HR recognition | High | Medium (growing) | | Practical relevance | Low | High | | Cost (UK) | ~£370 exam only | £399 course + exam | | Pass format | Multiple choice | 24-hr practical | | Time to prepare | 2–3 months | 6–8 weeks | | Job-readiness | Broad baseline | Direct SOC skills |
Which one first?
Do Security+ first if: your employer is paying for it, you're applying to large enterprise or government roles where HR filters on certifications, or you genuinely have gaps in foundational knowledge.
Do BTL1 first if: you're self-funding your learning, you want the skills to pass a technical interview (rather than an HR screen), or you're applying to MSSPs and smaller security teams where the hiring manager actually reviews CVs.
Do both if: you have the time and budget. They're complementary — BTL1 gives you the practical skills, Security+ gives you the recognisable credential.
The thing most people don't say out loud: passing Security+ won't teach you to investigate a brute force alert. BTL1 will. If your goal is to perform well in a SOC from day one, BTL1 is the more direct route.
For more on what the job actually pays once you have the cert, see the SOC analyst salary guide for the UK in 2026.
Put theory into practice before your exam. SOCentre gives you realistic alert triage scenarios that mirror exactly what BTL1 tests you on. Start training free — no card required.