GIAC Certified Incident Handler credential artwork

GIAC Certified Incident Handler (GCIH)

Validates practical skills in detecting, investigating and responding to security incidents, including attacker techniques, credential attacks and exploitation.

Summary

GCIH is GIAC's practitioner certification for incident handlers. It tests how attackers scan, exploit, move and persist, and how you detect, investigate and respond, in an open book exam that includes CyberLive tasks in live virtual machines.

Good fit if

  • You want hands-on incident response and attacker-tool skills
  • You work in, or want to join, a SOC or IR team
  • You have IT or security fundamentals and want practitioner depth

Look elsewhere if

  • You have no security background: Security+ or GSEC
  • You want a management track: CISM
  • You want offensive depth: OSCP or CEH

Salary & jobs

Prerequisites

No required prerequisites. No course, degree or work experience is required before you buy an attempt.

SANS SEC504: Hacker Tools, Techniques, and Incident Handling

Recommended

GIAC names its affiliated SANS course as the best preparation for GCIH. You can buy an attempt without it.

Cost

USD · Standard GIAC pricing
$999
A retake costs $899 and a 45-day extension costs $479. Adding the attempt to a SANS course also costs $999 and includes two practice tests.

What holders say

Respected for incident response, but the official course is expensive

Commenters valued GCIH's hands-on format for SOC and incident response work, but call the SEC504 course out of reach unless an employer pays. The $999 attempt can be bought alone.

r/cybersecurityReddit: GCIH, April 2022

Renewal

GCIH is valid for 4 years.

Validity
4 years
Renewal requirement
36 CPEs per cycle
Renewal fee
$499 USD
$249 for each extra GIAC renewal within 2 years

You can renew by passing the current exam again instead of submitting CPEs. Renewal opens 2 years before your expiry date, and SANS courses or new GIAC certifications can supply all 36 CPEs.

GIAC renewal ↗

Alternatives

GIAC Security Essentials credential artwork
GSEC$999 required · Intermediate

Broader GIAC practitioner credential covering security fundamentals across many domains, rather than GCIH's focus on incident response and attacker techniques.

CompTIA CySA+ credential artwork
CySA+$439 required · Intermediate

Cheaper, vendor-neutral alternative focused on SOC and vulnerability-analyst work without the SANS-adjacent price tag.

Certified Ethical Hacker credential artwork
CEH$1,050 required · Intermediate

Covers overlapping attacker-tool and exploitation ground with a different, less hands-on exam format.

OffSec Certified Professional credential artwork
OSCP$1,749 required · Advanced

A harder, purely offensive hands-on credential if you want to go deeper into exploitation rather than incident response.

FAQ

Is GCIH hard?

It is a step up from GSEC, mainly because of the CyberLive lab questions. A well-built index and repeated labs matter more than memorizing.

Do I need the SANS SEC504 course to get GCIH?

No. You can buy the $999 attempt on its own. SEC504 is the affiliated course and costs $8,780.

Is the GCIH exam open book?

Yes, for printed books and notes. Laptops, phones, electronic files and printed practice questions are not allowed.

What happens if I fail GCIH?

You can buy a retake for $899 within 30 days of your attempt deadline and must wait 30 days before testing again. After three failed attempts you wait a year.

How long is GCIH valid for?

4 years. Renew with 36 CPEs and a $499 fee, or by passing the exam again.

Last updated October 2026