Validates practical skills in detecting, investigating and responding to security incidents, including attacker techniques, credential attacks and exploitation.
999IntermediateNo prerequisites
Best GIAC Certifications in 2026
GIAC is a cybersecurity certification body affiliated with SANS Institute, whose hands-on certifications cover incident handling, forensics, intrusion analysis, security fundamentals and industrial systems security.
Validates knowledge of access control, networking, cryptography, Linux and Windows security, cloud security and incident handling.
999IntermediateNo prerequisites
Validates knowledge of digital forensics and incident response, including memory forensics, timelines, Windows artifacts and enterprise investigations.
999IntermediateNo prerequisites
Validates practical skills in network intrusion detection, including packet-level TCP/IP analysis, tcpdump, Wireshark, Snort, Zeek and network forensics.
999IntermediateNo prerequisites
Validates hands-on knowledge of securing industrial control systems, including architecture, threats and attacks, communications, hardening, governance and recovery.
999IntermediateNo prerequisites
Validates knowledge of managing security programs, including policy, risk, projects, vendors, SOC management and incident response.
999AdvancedNo prerequisites
Validates knowledge of enterprise defense, including hardening, detection, network and identity analysis, incident response and malware triage.
999IntermediateNo prerequisites
How GIAC certifications work
- Exam fees and attempts
- Most exams cost $999 per attempt. A retake costs $899 after a 30-day wait; after 3 failed attempts, wait a year before a new attempt
- Validity and renewal
- Certifications are valid for 4 years; renew with 36 CPE credits and a $499 fee, or retake the exam
- Delivery
- Pearson VUE test center or ProctorU online; candidates within 60 miles of a Pearson VUE center are expected to test there
- Open-book policy
- Printed books and notes are allowed; electronic materials, internet access and printed practice questions are not
Choosing the right GIAC certification
Where to start
- Broad security foundation: GIAC GSEC. Open-book exam on access control, networking, cryptography, Linux, Windows and cloud security basics. GIAC lists no formal prerequisites and describes it for new security professionals with an information systems and networking background.
- Incident response: GIAC GCIH. Covers detecting, responding to and containing incidents, including attacker tools and exploitation techniques. It suits SOC and incident response roles, and GIAC requires no prior certification.
- Network monitoring: GIAC GCIA. Covers packet-level traffic analysis and intrusion detection with tools such as Wireshark, Snort and Zeek. It suits intrusion analysts and SOC analysts who already know TCP/IP.
- Forensics and threat hunting: GIAC GCFA. Covers memory forensics, Windows artifact analysis and enterprise incident response. There is no formal requirement; SANS recommends Windows forensics fundamentals (FOR500/GCFE) or about two years of incident response experience.
- Industrial control systems: GIAC GICSP. Covers securing industrial control systems and OT, for people bridging IT security and ICS engineering. There is no formal prerequisite.