GIAC Certifications Explained (2026): Which GIAC Cert for Which Job

Published November 10, 2026. Exam facts come from GIAC and SANS pages linked in each section, checked on that date. GIAC changes exam versions and passing scores from time to time, and fees change, so we link to the official pages instead of listing prices.

GIAC (Global Information Assurance Certification) is the certification body affiliated with the SANS Institute. Its catalog listed 63 certifications on November 10, 2026: 57 Practitioner certifications and 6 Applied Knowledge certifications, sorted into focus areas such as cyber defense, digital forensics and incident response, offensive operations, cloud security, industrial control systems, leadership and AI (GIAC).

That many acronyms makes the first question hard: which one fits the job you have or want? This guide maps GIAC certifications to jobs, explains how the exams work, and covers the cost question people search for most, which is really a question about who pays.

Short answer: new to security, start with GFACT or GSEC. Analysts and responders usually go to GCIH or GCIA, forensic examiners to GCFE and GCFA, penetration testers to GPEN, cloud engineers to GCLD, OT engineers to GICSP and managers to GSLC. Each Practitioner exam pairs with a SANS course, but GIAC also sells an attempt without training (GIAC).

Which GIAC certification for which job

The table pairs common roles with the GIAC certification that matches the work, the next step up, and the SANS course GIAC ties to that certification on its page. GIAC does not require a set order, so treat the “next” column as a typical path, not a rule.

Sources: each certification links to its GIAC page; course codes come from the training justification letters, course-author notes and affiliated-training listings on those pages. GIAC’s focus areas page groups the full catalog by domain.

We cover several of these paths in more depth: GSEC vs Security+, incident response certifications (GCIH and GCFA), blue team certifications (GCIA), digital forensics certifications, ethical hacking certifications (GPEN), cloud security certifications, OT security certifications (GICSP and GRID) and AI security certifications.

GIAC exam format for the most popular certifications

Figures are from each certification’s GIAC page on November 10, 2026. GIAC sets passing scores through psychometric standard-setting studies and can change them with a new exam version. The GSEC page, for example, says the 72% score applies to the exam version released on or after April 6, 2026, and tells candidates to confirm their own attempt’s format and passing score in their GIAC account (GSEC).

How GIAC exams work

• Proctored and web-based. Every GIAC exam must be proctored, either remotely through ProctorU or at a Pearson VUE test center. GIAC notes that both options may not be available for every attempt, and that U.S. sanctions rules bar its exams in a list of countries and regions (GIAC proctoring).
• Open book, paper only. GIAC exams are open book. Printed books, notes and study guides are allowed; digital items are not. GIAC encourages candidates to build their own index of the course books (GIAC exam prep).
• CyberLive. Many Practitioner exams include CyberLive questions, which put you in a virtual machine to complete tasks with real tools. GIAC’s catalog flagged 29 certifications with CyberLive on November 10, 2026 (GIAC).
• Time to test. An attempt is open for 120 days from activation. Extensions can be bought, but the total access period, including extensions and retakes, cannot exceed 570 days. You can attempt an exam up to three times per year, and a retake must be bought within 30 days after your deadline (GIAC attempt delivery policy).
• Practice tests. GIAC sells practice tests that simulate the real exam and report which objectives you need to revisit (GIAC).

Practitioner, Applied Knowledge, GSP and GSE

Practitioner certifications are the job-focused exams in the tables above. Applied Knowledge certifications, such as GX-CS, GX-IA and GX-IH, are 100% CyberLive: you solve multi-step problems in a virtual machine (GIAC). The GX-IH page, for example, lists an open-book, open-notes exam with a four-hour time limit (GIAC).

The two types stack into portfolio certifications. The GIAC Security Professional (GSP) requires any three Practitioner certifications plus any two Applied Knowledge certifications. The GIAC Security Expert (GSE), which GIAC calls its highest level, requires any six Practitioner and any four Applied Knowledge certifications. Your other GIAC certifications co-terminate with the portfolio credential (GIAC portfolio certifications).

Some older certifications are in abeyance. GSNA, for example, is no longer sold, and existing holders can renew it with CPEs only (GSNA). Check a certification’s page before you plan around it.

Renewal: every four years

GIAC certifications renew every four years. You either collect 36 CPE credits over the four years or retake the exam, then pay the certification maintenance fee (GIAC how to renew). Renewal registration opens two years before your expiration date. SANS courses and new GIAC certifications count, as do other accredited training, graduate courses, conference training, cyber ranges and CTFs, relevant work experience and community activity, each with its own cap (GIAC renewal knowledge base).

GIAC and SANS certification cost: who pays

“GIAC certification cost” and “SANS certification cost” are really two different purchases. GIAC sells the certification attempt. SANS sells the training course. GIAC’s pricing page lists the fee for a certification attempt, exam retakes, attempt extensions, renewal, practice exams and demo questions. If you buy the attempt as an add-on to a SANS course, the SANS affiliate pricing page applies instead. GIAC states that orders are non-transferable and non-refundable once access is granted.

Most GIAC candidates do not pay alone. The usual routes:

• Your employer. Most certification pages link a training justification letter for your manager; GSEC’s is for SEC401. Tie the request to your current duties and note that the training also counts toward renewal CPEs.
• DoD 8140. DoD 8140 covers service members, DoD civilians and contractors in cyberspace work roles. GIAC’s catalog tagged 29 certifications for DoD 8140 on November 10, 2026 (GIAC DoD 8140, GIAC catalog). If your role falls under it, ask your command or contract lead how certification is funded, and see our DoD 8140 certifications guide.
• SANS Work Study. You help run a SANS course in exchange for a reduced-cost training experience that SANS says will often include a GIAC certification attempt. You have to apply (SANS).
• SANS Cyber Academies. SANS runs academies for aspiring professionals across the United States, including legal permanent residents, that include GIAC certifications, plus programs in Europe, the Middle East and Africa (SANS).
• Attempt only. If you already know the material, GIAC lets you register for an attempt without SANS training (GIAC).

If you are paying yourself, compare the total with other options in our certification cost calculator and cheapest cybersecurity certifications list. Many self-funded career changers take Security+ before any GIAC exam.

Our cybersecurity certification path and map shows where GIAC certifications sit next to CompTIA, ISC2 and ISACA credentials by level and domain.

GIAC certification questions

Sources

• GIAC, Certifications catalog
• GIAC, Focus Areas
• GIAC, Pricing
• GIAC, Get Started: Practitioner Certifications
• GIAC, Applied Knowledge Certifications
• GIAC, Portfolio Certifications (GSP and GSE)
• GIAC, Proctoring
• GIAC, Practitioner exam preparation
• GIAC, Certification Attempt Delivery Policy
• GIAC, How to Renew
• GIAC, Renewal knowledge base
• GIAC, DoD 8140
• GIAC, GFACT certification page
• GIAC, GISF certification page
• GIAC, GSEC certification page
• GIAC, GCIA certification page
• GIAC, GCDA certification page
• GIAC, GMON certification page
• GIAC, GSOC certification page
• GIAC, GCIH certification page
• GIAC, GCFE certification page
• GIAC, GCFA certification page
• GIAC, GNFA certification page
• GIAC, GREM certification page
• GIAC, GCTI certification page
• GIAC, GPEN certification page
• GIAC, GWAPT certification page
• GIAC, GXPN certification page
• GIAC, GCPN certification page
• GIAC, GCLD certification page
• GIAC, GPCS certification page
• GIAC, GCSA certification page
• GIAC, GDSA certification page
• GIAC, GICSP certification page
• GIAC, GRID certification page
• GIAC, GSLC certification page
• GIAC, GSTRT certification page
• GIAC, GCIL certification page
• GIAC, GCCC certification page
• GIAC, GPYC certification page
• GIAC, GAIPS certification page
• GIAC, GXIH certification page
• GIAC, GSNA certification page
• GIAC, SEC401 training justification letter (Word document)
• SANS, GIAC affiliate pricing
• SANS, Work Study Program
• SANS, Cyber Academies

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.