GIAC Certified Enterprise Defender (GCED) Courses

Validates knowledge of enterprise defense, including hardening, detection, network and identity analysis, incident response and malware triage.

A good GCED course teaches the hardening, detection, response and malware material behind the exam and gives you books you can index for the open-book test. We compared the options on coverage, labs and price.

SANS SEC501 is GIAC's affiliated course and the source of the books you bring to the open-book exam. Take it when your employer funds the $8,780 cost; paying yourself, it costs almost nine times the exam fee.

Employer-funded study

SANS SEC501: Applied Cyber Defense

A six-day course, or 38 hours self-paced, on hardening, detection, response and malware analysis, with 26 labs and a capture-the-flag. It earns 38 CPEs and comes with the course books that the GCED exam is written from.

Great fit if your employer funds training and you want the books the exam is written from

Poor fit if you are paying yourself; the course costs almost nine times the exam fee

How to choose a GCED course

Decide whether you need a course. GIAC requires no course, degree or experience before you buy an attempt. SEC501 is the affiliated course, and GIAC recommends GSEC-level skills before it.
Plan for the open-book exam. The exam allows printed books and notes, so what you can find fast matters. Build your index while you study, and expect the course books to be your main reference.
Look for hands-on labs. SEC501 includes 26 labs and a capture-the-flag across hardening, detection, response and malware analysis. Labs are the part that self-study replaces least easily.
Check who pays. SEC501 costs $8,780 and the exam attempt adds $999. Employer funding changes the answer completely.

Recommended GCED course combinations

Employer pays: SEC501 ($8,780) with the GCED attempt added ($999), which includes two GIAC GCED practice tests.
Working full time: SEC501 OnDemand (38 hours self-paced, 4 months of access) with the two GIAC practice tests that come with the attempt.
Paying yourself: Skip the course, build your own index from your study material and use a GIAC GCED practice test ($399) to check readiness before the exam.

Compare all GCED practice tests →

GCED course FAQ

What is the best GCED course?

SANS SEC501: Applied Cyber Defense, GIAC's affiliated course and the source of the books you bring to the open-book exam.

Can I pass GCED without SEC501?

Yes. GIAC does not require the course before you buy an attempt. Candidates who skip it build their own index from other study material.

How long does the GCED course take?

SEC501 runs six days live or about 38 hours self-paced. Plan for about 95 hours of preparation in total, including building your index and practice tests.

Is the GCED exam open book?

Yes. You can bring printed books and notes to the 115-question, 3-hour multiple-choice exam, with no hands-on tasks.