Updated September 2026: GIAC set the GSEC passing score at 72% for everyone who receives the exam version released on or after April 6, 2026. The exam has 106 questions in four hours and includes CyberLive hands-on questions in real virtual machines. A certification attempt costs $999 on its own (GIAC, GIAC).
GIAC Security Essentials (GSEC) is a practitioner certification that proves you understand security well beyond vocabulary and can apply it hands-on. It covers a very wide range: networking and protocols, defense in depth, access control, cryptography, Windows, Linux, macOS and container security, cloud basics on AWS and Azure, logging and SIEM, incident response and vulnerability scanning. GSEC is best known as the certification that goes with the SANS SEC401 course, and it is respected in government, defense and large enterprise security teams.
This guide covers who GSEC is for, the exam facts, the objectives, the real cost with and without SANS training, a study plan, career value, and how GSEC compares with Security+, CISSP and CySA+. For the wider picture, see Best Cybersecurity Certifications in 2026.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Who GSEC is for
- New security professionals with a background in IT systems or networking
- Security administrators, engineers and operations staff who need broad, hands-on fundamentals
- IT engineers and supervisors moving into security responsibilities
- Forensic analysts, penetration testers and auditors who want a proven foundation
- Candidates whose employer pays for SANS training, which is the most common way people earn GSEC
GIAC lists no formal prerequisites. SANS describes SEC401 as assuming a basic understanding of technology, networks and security, so GSEC is not a first step for someone with no IT background.
GSEC exam facts (2026)
| Item | Details |
|---|---|
| Level | GIAC practitioner certification with CyberLive hands-on testing |
| Exam | One proctored exam |
| Questions | 106 |
| Time limit | 4 hours |
| Passing score | 72% (exam versions released on or after April 6, 2026) |
| Where you test | Remote proctoring through ProctorU or on site at Pearson VUE |
| Attempt window | 120 days from activation to complete your attempt |
| Price | $999 per certification attempt; $899 retake; $479 extension |
| Renewal | Every four years: 36 CPE credits plus a $499 renewal fee |
Sources: GIAC’s GSEC page, pricing page and renewal page (September 2026). GIAC tells candidates to confirm the format and passing score that apply to their own attempt in their GIAC account.
What GSEC covers
GIAC publishes 26 GSEC objectives rather than weighted domains. Grouped by theme (GIAC):
| Theme | GSEC objectives |
|---|---|
| Networking and network defense | Networking and protocols, defensible network architecture, network security devices (firewalls, NIDS, NIPS), wireless network security |
| Defense in depth and access | Defense in depth, access control and password management, security frameworks and CIS Controls (with the NIST CSF and MITRE ATT&CK), data loss prevention and mobile device security |
| Attacks and response | Vulnerability scanning and penetration testing, malicious code and exploit mitigation, web communication security, log management and SIEM, incident handling and response |
| Cryptography | Cryptography concepts and algorithms, and applying cryptography with VPNs, GPG and PKI |
| Endpoints and platforms | Endpoint security, Windows security infrastructure, Windows as a service, Windows access controls, enforcing Windows security policy, Windows automation, auditing and forensics, Windows services and Microsoft cloud, Linux fundamentals, Linux security and hardening, container and macOS security |
| Cloud and AI | Virtualization, cloud security and AI essentials |
The breadth is the challenge. You won’t need deep expertise in any one area, but you do need working knowledge of all of them, and CyberLive questions ask you to use real tools in a lab rather than just recognize an answer.
What GSEC costs in 2026
- Certification attempt only: $999 from GIAC. A retake costs $899, and extending your 120-day window costs $479.
- With SANS training: SANS SEC401: Security Essentials is the course built around the GSEC objectives. SANS lists it at $8,780 in the U.S. (September 2026), as six days live or 46 hours self-paced with four months of access. Adding a GIAC certification attempt to the course includes two free practice tests (SANS).
- Renewal: $499 every four years with 36 CPE credits. GIAC charges $249 for additional renewals within two years of paying a full-price renewal.
- Practice tests: GIAC sells extra practice tests if you want more than the two that come with a SANS bundle.
That makes GSEC expensive compared with Security+ unless your employer pays. Most GSEC holders earned it through employer-funded SANS training.
A 10-week GSEC study plan
This assumes about eight to ten hours a week and some IT experience. If you take SEC401, follow its six sections in order instead.
- Weeks 1 to 2: networking and cloud. TCP/IP, packet analysis with tcpdump and Wireshark, defensible network architecture, wireless, and virtualization and cloud basics.
- Weeks 3 to 4: defense in depth. Access control, authentication and passwords, the CIS Controls, the NIST CSF and MITRE ATT&CK, DLP and mobile security.
- Weeks 5 to 6: attacks and response. Vulnerability scanning with Nmap, penetration testing concepts, malware, web application security, logging and SIEM, and incident handling.
- Week 7: cryptography. Symmetric, asymmetric and hashing, how VPNs, GPG and PKI apply them, and firewall, IDS and endpoint protection concepts.
- Week 8: Windows and Azure. Active Directory and Group Policy, permissions, security templates, updates, PowerShell for auditing, and Microsoft cloud security features.
- Week 9: Linux, containers and macOS. Permissions, hardening, logging and auditing on Linux, Docker and Kubernetes basics, and macOS security features.
- Week 10: practice. Take the practice tests under exam conditions and keep practicing hands-on with the tools the objectives name. Finish within your 120-day attempt window.
Is GSEC worth it? Jobs and salary
GSEC is widely recognized in government and defense work and by employers who know SANS training. The U.S. Bureau of Labor Statistics reports a median pay of $129,180 in May 2025 for information security analysts, with 21% projected growth from 2025 to 2035 (BLS). GSEC alone won’t set your salary, but it tells employers you have tested, broad fundamentals.
If you pay out of pocket, compare the $999 attempt with Security+, which costs much less and is the more common entry-level choice. If your employer offers SANS training, GSEC is one of the best-value foundations you can get.
GSEC vs Security+, CISSP and CySA+
- GSEC vs Security+: Both are foundational. Security+ is cheaper and the usual first choice when you’re paying yourself. GSEC is broader and more hands-on, with CyberLive lab questions. Many professionals hold both.
- GSEC vs CISSP: CISSP needs five years of experience and leans toward management and architecture. GSEC is a practitioner certification with no experience requirement.
- GSEC vs CySA+: CySA+ focuses on analyst work such as detection, vulnerability management and incident response. GSEC covers wider ground at a foundational level.
- Coming from CompTIA A+ or Network+? GSEC is a solid next step if your employer funds SANS; otherwise, Security+ first.
Planning your next certification? See the full certification roadmap for the order to take them by career goal.
What I would tell a friend starting GSEC
Practice with the actual tools: tcpdump, Wireshark, Nmap, PowerShell and the Linux command line. The CyberLive questions reward people who have used them, and the breadth means you need to recognize a lot of situations quickly. Keep up with real incidents too. GSEC’s scope is basically the list of places attackers get in, and the news shows you which ones they are using this month.
The essentials change every week. Stay current in five minutes. The CyberExperts Daily Brief covers what changed in security and why it matters, in five minutes, weekday mornings. Get tomorrow’s brief.
Frequently asked questions
How many questions are on the GSEC exam?
106 questions in four hours, including CyberLive hands-on questions in real virtual machines.
What is the passing score for GSEC?
72% for exam versions released on or after April 6, 2026. GIAC says to confirm the passing score for your own attempt in your GIAC account.
How much does GSEC cost?
$999 for a certification attempt on its own. A retake is $899. SANS SEC401 training is listed at $8,780 in the U.S., and adding a certification attempt to the course includes two practice tests.
Do I need SANS training to take GSEC?
No. You can buy a GSEC attempt on its own from GIAC and self-study, though most candidates take SANS SEC401.
How do I renew GSEC?
Every four years, with 36 CPE credits and a $499 renewal fee.
Is GSEC harder than Security+?
GSEC is broader and includes hands-on CyberLive questions, and it has a four-hour time limit. Many candidates find it more demanding than Security+, especially without SANS training.
Where can I take the GSEC exam?
Online with ProctorU remote proctoring or in person at a Pearson VUE test center. You have 120 days from activation to take it.
Sources
- GIAC, GIAC Security Essentials (GSEC): giac.org
- GIAC, Certification pricing and fees: giac.org
- GIAC, Renewing your GIAC certification: giac.org
- SANS, SEC401: Security Essentials (course price and GSEC alignment): sans.org
- BLS, Information security analysts: bls.gov
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
