- A standalone GIAC Defending Advanced Threats exam attempt costs USD 999, excluding applicable sales tax and training tuition.
- A retake costs USD 899; standard renewal costs USD 499 every four years, plus 36 CPE credits or a renewal exam.
- The SANS-associated attempt is also USD 999, but SEC599 course tuition is billed separately on top.
- Standalone attempts give 120 days of access from activation, so schedule prep before you activate.
GDAT Certification Cost 2026: What You Actually Pay
- What You Actually Pay
- The Core Price List
- Standalone Attempt vs. SANS-Associated Attempt
- Training Tuition: The Variable Cost
- The Separately Listed Practice Exam
- Testing Logistics and Their Cost Implications
- Retake Math and Attempt Windows
- Four-Year Renewal Costs
- Three Realistic Budget Scenarios
- Where to Spend Your Prep Hours
- Frequently Asked Questions
Key Takeaways
- A standalone GIAC Defending Advanced Threats exam attempt costs USD 999, excluding applicable sales tax and training tuition.
- A retake costs USD 899; standard renewal costs USD 499 every four years, plus 36 CPE credits or a renewal exam.
- The SANS-associated attempt is also USD 999, but SEC599 course tuition is billed separately on top.
- Standalone attempts give 120 days of access from activation, so schedule prep before you activate.
- No formal prerequisites exist, so the exam fee is the only mandatory entry cost.
GIAC Defending Advanced Threats (GDAT) is a proctored, open-book credential from GIAC Certifications, and its pricing structure is simple at the core but easy to misread at the edges. The headline number is the exam attempt fee. Everything else, including tuition, tax, practice testing, retakes, and renewal, layers on top depending on how you choose to prepare and how many tries you need.
This guide breaks down every cost line verified from GIAC's published pricing and policy pages, explains where the variable costs hide, and shows how to plan a budget around the way the exam is actually delivered. If you are still deciding whether the credential suits you, pair this with our ROI analysis of the GDAT certification and the GDAT salary guide.
The Core Price List
Here are the fixed fees published by GIAC for this certification. All figures are in US dollars and exclude applicable sales tax and training tuition.
| Cost Item | Amount (USD) | Notes |
|---|---|---|
| Standalone exam attempt | $999 | 120 days of access from activation |
| SANS-associated exam attempt | $999 | Course tuition is additional |
| Separately listed practice exam | $399 | Optional; sold apart from the attempt |
| Retake | $899 | Applies after an unsuccessful attempt |
| Standard renewal | $499 | Due on the four-year cycle |
| Prerequisite certifications | None required | Training is recommended, not mandated |
Standalone Attempt vs. SANS-Associated Attempt
GIAC lists two paths to the same exam fee. The standalone route lets you sit the exam without purchasing a course. The SANS-associated route bundles the attempt with a SANS Institute training pathway. In both cases the attempt itself is USD 999, which means the real price difference between the two paths is the tuition you choose to pay, not the exam fee.
What the standalone route gives you
- You buy the attempt directly from GIAC and receive access for 120 days from activation.
- You choose how to prepare: self-study, a study group, employer-provided labs, or an external course.
- There is no formal prerequisite, so experienced practitioners with purple-team or detection engineering backgrounds can go straight to the exam.
What the SANS-associated route adds
- The affiliated preparation course is SANS SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses.
- Tuition is billed separately from the $999 exam attempt, so the combined outlay is meaningfully higher than the exam fee alone.
- SANS publishes its affiliate pricing for GIAC certifications; the associated-exam pricing referenced here took effect November 4, 2024.
Because training is recommended but not required, the cheapest legitimate path is the standalone attempt plus whatever preparation resources you already own. The most expensive is the SANS-associated attempt with live or online course tuition. Which makes sense depends on how much of the ten-domain scope you already work with daily.
Training Tuition: The Variable Cost
Tuition is the line item that moves your total the most, and it is the one this article cannot reduce to a fixed number, because course pricing varies by delivery format and changes over time. What can be said with confidence is the relationship: exam attempt fee plus tuition equals your SANS-path cost, and tuition is excluded from every GIAC-published exam price above.
To decide whether tuition is worth it, map your current experience against the ten published GDAT domains:
Domains where practitioners often already have footing
If your daily work touches these, you may need less formal instruction:
- Active Directory/Domains and Administrative Access: common for sysadmins and identity engineers.
- Reconnaissance, Threat Handling, and Incident Response: familiar territory for SOC analysts and responders, and it includes threat hunting in its outcome statement.
Domains where structured training tends to pay off
If these are unfamiliar, a guided course or lab environment can save study hours:
- Adversary Emulation and Payload Delivery/Payload Execution: purple-team workflows that defenders may not practice routinely.
- Lateral Movement, Installation, Application Exploitation, and Data Exfiltration: attacker techniques you must be able to recognize and defend against.
For a domain-by-domain breakdown, see the complete guide to all 10 GDAT content areas.
The Separately Listed Practice Exam
GIAC lists a practice exam at USD 399, separate from the attempt fee. Whether it earns its place in your budget depends on your confidence with the format. The real exam is a single proctored, web-based sitting of 75 questions in 2 hours, with a minimum passing score of 70%. That works out to under two minutes per question, and because the exam is open book, speed of lookup through your index matters as much as raw recall.
- Worth considering if: you have never taken a GIAC exam and want to rehearse pacing and index navigation under realistic conditions.
- Possibly skippable if: you have prior GIAC experience, have built a tested index, and have access to other legitimate preparation material through your course or employer.
Our GDAT practice tests are built to help you rehearse domain recall before exam day; use them in preparation, not in the exam room. For format and difficulty context, read how hard the GDAT exam is.
Testing Logistics and Their Cost Implications
GIAC delivers the exam through Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules. The published price list shows no separate line item for choosing one over the other, but logistics can still cost you money indirectly.
- Onsite at Pearson VUE: expect travel time, possible transportation or parking costs, and a fixed appointment. Hardcopy references travel with you.
- Remote with ProctorU: no commute, but you need a compliant workspace, a stable connection, and equipment that meets proctoring requirements. Confirm current requirements in GIAC's proctor guidance before scheduling.
The 120-day access window for standalone attempts starts at activation, not purchase. That makes activation timing a cost-control tool: if you activate too early and your prep slips, you can burn the window and face additional fees. Review GDAT exam dates, testing windows, and scheduling before you commit.
Retake Math and Attempt Windows
The retake fee is USD 899, which is USD 100 less than the first attempt. That discount is small compared with the real cost of failing: the lost study momentum, a new scheduling cycle, and a second round of proctoring logistics.
| Scenario | Exam Fees Only (USD) |
|---|---|
| Pass on first attempt | $999 |
| Pass on second attempt | $999 + $899 = $1,898 |
| First attempt plus practice exam, pass first time | $999 + $399 = $1,398 |
| Practice exam, then pass on second attempt | $999 + $399 + $899 = $2,297 |
These totals exclude sales tax and any tuition. The arithmetic shows why the practice exam is not automatically a savings: it only pays for itself if it prevents a retake or meaningfully reduces your risk. The passing standard is a minimum of 70%, but that is a score threshold, not a statistic about candidates. No issuer-published pass rate was verified, so see our analysis in what the data shows on GDAT pass rates and the full explanation in GDAT passing score: exactly what you need to pass.
Key Takeaway
Treat the first attempt as the one you budget for and the retake as insurance. Delay activation until your index is built and your weakest domains have been drilled at least once; the 120-day window is generous only if you start it ready.
Four-Year Renewal Costs
The certification is valid for four years. To keep it active you renew with either 36 CPE credits or a renewal examination, and in both cases you also pay the standard renewal fee of USD 499. Budget that fee into your career plan from day one.
- CPE route: the credits themselves can often be earned through work-related learning, conferences, publications, or training, but verify GIAC's current acceptance rules in the renewal guide.
- Renewal exam route: useful if you would rather demonstrate current knowledge than document credits, but it is still subject to the renewal fee.
Amortized over four years, the $499 renewal fee is the ongoing carrying cost of holding the credential. GIAC's renewal documentation, including its 2026 how-to guide, is the authority on deadlines and process, so check it before your cycle ends.
Three Realistic Budget Scenarios
The totals below use only the verified fixed fees. Tuition, tax, travel, and printing are marked as additional because they vary.
| Profile | Fixed GIAC Fees | Additional Costs |
|---|---|---|
| Experienced purple-team or detection engineer, standalone, passes first try | $999 | Tax, printing, optional proctoring setup |
| Mid-level analyst, standalone with practice exam, passes first try | $1,398 | Tax, printing, study materials |
| Career switcher using SANS-associated path, one retake | $999 + $899 = $1,898 | SEC599 tuition, tax, travel or proctoring setup |
Where to Spend Your Prep Hours So the Fee Counts
Once you have paid for the attempt, the cost that matters most is your own time. A short, domain-driven plan keeps the 120-day window from being wasted. This is one approach tied to the ten published domains, not a one-size schedule:
Foundations You Can Lean On
- Review Active Directory/Domains and Administrative Access, since later attack-chain domains build on them.
- Start your open-book index with terms, tools, and techniques as you learn them.
The Attack Chain
- Work through Payload Delivery, Payload Execution, Installation, Lateral Movement, Application Exploitation, and Data Exfiltration in sequence.
- For each, note both the attacker technique and the defensive control that detects or blocks it.
Emulation and Response
- Cover Adversary Emulation and Reconnaissance, Threat Handling, and Incident Response, including threat hunting.
- Run timed sets of 75 questions in 2 hours to test index lookup speed.
For a fuller plan, use our GDAT study guide, and keep the GDAT cheat sheet handy for last-minute review. Then take a GDAT practice test to find gaps before you activate your attempt.
Frequently Asked Questions
A standalone GIAC Defending Advanced Threats exam attempt costs USD 999, and the SANS-associated attempt is also USD 999. Both exclude applicable sales tax and training tuition.
A retake costs USD 899, excluding applicable sales tax. Failing once therefore raises your exam-fee total from $999 to $1,898 before any tuition or other expenses.
There are no formal certification prerequisites; training is recommended, not required. If you choose the affiliated SANS SEC599 course, tuition is charged in addition to the $999 attempt fee.
The certification is valid for four years. Renewal requires 36 CPE credits or a renewal examination, plus the standard USD 499 renewal fee, excluding applicable sales tax.
Standalone attempt access runs 120 days from activation. Activate only when you are ready to schedule, and confirm Pearson VUE or ProctorU availability first. See GDAT requirements for eligibility details.