GIAC Certified Enterprise Defender credential artwork

GIAC Certified Enterprise Defender (GCED)

Validates knowledge of enterprise defense, including hardening, detection, network and identity analysis, incident response and malware triage.

Summary

GCED is GIAC's certification for enterprise defenders. It covers attack surface management, hardening, detection engineering, network and identity analysis, incident response and malware triage, tested in an open book, multiple choice exam.

Good fit if

  • You have GSEC-level skills and want a broader defensive credential
  • You work in a SOC, network security or incident response
  • You prefer an exam without CyberLive lab tasks

Look elsewhere if

  • You have no security background: GSEC or Security+
  • You specialize in forensics or traffic analysis: GCFA or GCIA
  • You want hands-on skills tested directly: GSEC or GCIH

Salary & jobs

Prerequisites

No required prerequisites. No course, degree or work experience is required before you buy an attempt.

GSEC-level security skills

Recommended

GIAC describes GCED as building on the skills GSEC measures. SANS recommends SEC401 or equivalent knowledge before SEC501.

SANS SEC501: Applied Cyber Defense

Recommended

GIAC names its affiliated SANS course as the best preparation for GCED. You can buy an attempt without it.

Cost

USD · Standard GIAC pricing
$999
A retake costs $899 and a 45-day extension costs $479. Adding the attempt to a SANS course also costs $999 and includes two practice tests.

What holders say

Useful as a broad survey, less so if you already work across these areas

One holder with incident response, pentesting and forensics experience called it a good introduction to security roles, but it added little for him. He advises taking it only for that exposure.

r/GIACReddit: GIAC cert for Network Security, November 2022

Renewal

GCED is valid for 4 years.

Validity
4 years
Renewal requirement
36 CPEs per cycle
Renewal fee
$499 USD
$249 for each extra GIAC renewal within 2 years

You can renew by passing the current exam again instead of submitting CPEs. Renewal opens 2 years before your expiry date, and SANS courses or new GIAC certifications can supply all 36 CPEs.

GIAC renewal ↗

Alternatives

GIAC Certified Incident Handler credential artwork
GCIH$999 required · Intermediate

Narrower credential on incident response and attacker tools, with CyberLive tasks.

GIAC Certified Intrusion Analyst credential artwork
GCIA$999 required · Intermediate

Narrower and more technical, focused specifically on network intrusion and packet analysis.

FAQ

Is GCED hard?

It is broad: 12 objectives across defense, detection, response and malware. Most of the challenge is covering that range and pacing 115 questions in 3 hours.

Do I need GSEC before GCED?

No. GIAC describes GCED as building on the skills GSEC measures, but nothing is required to buy an attempt.

Is the GCED exam open book?

Yes, for printed books and notes. Laptops, phones, electronic files and printed practice questions are not allowed.

Does GCED use CyberLive?

No. Every question is multiple choice.

How long is GCED valid for?

4 years. Renew with 36 CPEs and a $499 fee, or by passing the exam again.

Last updated October 2026