ISTQB CT - Security Tester Exam Questions

Updated on 22 September 2026. What’s new: added ISTQB's 2025 announcement of the CT-STE exam and what it means for the CT-SEC 2016 syllabus.

Picture a release that passed every functional test and still leaked customer data within a week: the checkout worked, the reports added up, yet one account could read another account's orders. The ISTQB Certified Tester Security Tester (CT-SEC) credential proves you can find that kind of gap. It is a 45-question, 120-minute exam, passed at 52 of 80 points, open to Foundation Level holders with relevant experience.

This article follows that leaky release from the post-mortem back to the syllabus. It explains why functional testing missed the problem, what the CT-SEC exam expects you to know, how its nine chapters are weighted, where security testing belongs in a lifecycle, why people are treated as a security surface of their own, and how to prepare without wasting weeks. It closes with an honest look at where CT-SEC stands now that ISTQB has introduced newer security testing certifications.

Why can a release pass every functional test and still leak data?

Go back to that release. The test team had done its job by the usual measure. Every user story had acceptance tests, every test passed, and the regression suite was green. The defect that reached customers was not a broken feature. It was a missing control: the order page trusted the order number in the address bar and never checked that the order belonged to the person asking for it. Change one digit and a stranger's delivery address appeared.