- What GDAT Means: The Plain Answer
- Reading the Name Word by Word
- Who Issues It and How the Exam Works
- The Ten Domains Behind the Name
- Why the Meaning Leans Toward Purple Team Thinking
- What It Costs and How You Sit It
- Who Cares About GDAT
- Sequencing Your Preparation Around the Domains
- Frequently Asked Questions
- GDAT stands for GIAC Defending Advanced Threats, a credential issued by GIAC Certifications.
- The exam is one proctored web-based test: 75 questions, 2 hours, 70% minimum passing score.
- Ten published domains run from Active Directory/Domains through Reconnaissance, Threat Handling, and Incident Response.
- The exam is open book with hardcopy materials only; electronic references are prohibited.
What GDAT Means: The Plain Answer
GDAT stands for GIAC Defending Advanced Threats. It is a cybersecurity certification administered by GIAC Certifications (GIAC, LLC), the Global Information Assurance Certification program. If you have landed here after searching the acronym, it is worth stating up front that this article covers only that credential. The same four letters can be shorthand for other things in other industries, but on this site, GDAT refers to the GIAC exam focused on defending against advanced adversaries.
If you want a shorter definition-style answer, our pages on what GDAT stands for and what GDAT is cover the basics. This article goes a step further and explains what the name tells you about the exam's content, structure, and audience.
Reading the Name Word by Word
The full title is compact, but each word signals something about the exam.
GIAC
GIAC is the certifying body. It issues a portfolio of security certifications, and GDAT sits within that family. GIAC exams are known for an open-book format paired with scenario-driven questions that reward applied understanding over rote memorization.
Defending
The verb matters. This is not an offensive security credential in the sense of testing whether you can break into systems for sport. It tests whether you understand how attacks unfold well enough to detect, disrupt, and respond to them. That said, the domain list is heavily attacker-shaped, which we'll unpack below.
Advanced Threats
"Advanced" points to adversaries that operate beyond commodity malware: attackers who move laterally, gain administrative access, deliver and execute custom payloads, and exfiltrate data. Defending against them requires layered controls and a working knowledge of how each stage of an intrusion looks from the defender's chair.
Who Issues It and How the Exam Works
The structural facts are straightforward, and they shape how you should interpret the credential's meaning.
| Attribute | GDAT Detail |
|---|---|
| Issuer | GIAC Certifications |
| Exam format | One proctored, web-based exam |
| Questions | 75 total |
| Time limit | 2 hours |
| Minimum passing score | 70% |
| Prerequisites | No formal certification prerequisites; training is recommended |
| Reference policy | Open book: hardcopy books, notes, and an index allowed; electronic references prohibited |
| Proctoring | Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules |
| Validity | Four years |
Two caveats are worth noting. First, the 70% minimum passing score is a scoring specification, not a pass-rate statistic. GIAC applies this specification to exam versions released on or after October 1, 2018, and no issuer-published pass rate has been verified. If you are curious about outcomes, our GDAT pass rate analysis explains what can and cannot be said from public information. Second, GIAC identifies the candidate's own account at exams.giac.org as the authority for attempt-specific objectives, question types, format, and passing score. The public outline is a guide, but your account is the final word on your assigned exam version. For the scoring details, see our page on the GDAT passing score.
On prerequisites, there is no formal requirement to hold another certification first. Training is recommended, which is a meaningful distinction: you can register without a prior credential, but the content assumes working familiarity with attacker tradecraft and enterprise defenses. Our GDAT requirements guide goes deeper on eligibility.
The Ten Domains Behind the Name
The clearest way to understand what GDAT means in practice is to read the ten published exam-objective headings. The public outline lists them without percentage weights, so no weighting is implied here. The headings, in source order, are:
- Active Directory/Domains
- Administrative Access
- Adversary Emulation
- Application Exploitation
- Data Exfiltration
- Installation
- Lateral Movement
- Payload Delivery
- Payload Execution
- Reconnaissance, Threat Handling, and Incident Response
Notice what the list is not: it is not a catalog of products or a list of regulatory frameworks. It reads like a map of an intrusion. That is the single most useful thing to understand about the credential's meaning.
Active Directory/Domains and Administrative Access
These two headings reflect the reality that enterprise compromise so often runs through identity infrastructure. Candidates should be comfortable reasoning about how attackers abuse domain environments and escalate privileges, and how defenders harden and monitor them.
- How domain trust and credential handling create attack paths
- What elevated access looks like when it is misused
- Which controls reduce the blast radius of a compromised account
Payload Delivery, Payload Execution, and Installation
This cluster covers the middle of the kill chain: how malicious content arrives, how it runs, and how it persists. Defensive thinking here is about stopping or detecting each hop, not just the first one.
- Delivery vectors and the controls that interrupt them
- Execution techniques and the telemetry they leave behind
- Persistence and installation mechanisms that survive reboots
Lateral Movement, Application Exploitation, and Data Exfiltration
Once an attacker is inside, they expand and extract. These headings focus on movement between systems, exploitation of application weaknesses, and the egress of stolen data.
- Detecting east-west movement rather than only perimeter events
- Recognizing exploitation of application-layer weaknesses
- Spotting and constraining exfiltration channels
Adversary Emulation
This is the heading that most clearly signals the purple-team flavor of the exam. Emulating adversary behavior lets defenders test whether controls and detections actually work, rather than assuming they do.
Reconnaissance, Threat Handling, and Incident Response
GIAC's exact heading is retained here, and its outcome statement discusses threat hunting. Candidates should connect early attacker reconnaissance to proactive hunting and structured response.
For a heading-by-heading walkthrough, see our complete guide to all ten GDAT content areas.
Why the Meaning Leans Toward Purple Team Thinking
The associated preparation course is SANS SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses. The course title itself explains a lot about the credential's orientation. "Purple team" describes the blending of offensive technique and defensive engineering: you study how an attack works specifically so you can build, tune, and validate the defense against it.
That lens is why the exam's domains read like attacker stages while the exam's name says "Defending." You are expected to understand each stage well enough to place a control, a detection, or a response action against it.
SANS has also publicized an updated version of the course, including a public agenda titled "Purple Teaming Reloaded: AI, Adversaries & the New SEC599" dated August 25, 2025. That agenda documents a preparation-course update, not an exam-version change. If you are taking the course, expect the material to evolve; if you are studying for the exam, anchor on the published objectives and your account's attempt details.
What It Costs and How You Sit It
The meaning of a credential includes its commitment. Based on GIAC's published pricing, the key figures are:
- Standalone exam attempt: USD 999
- Separately listed practice exam: USD 399
- Retake: USD 899
- Standard renewal: USD 499
- SANS-associated exam attempt: USD 999, with course tuition additional
Prices exclude applicable sales tax and training tuition. A standalone attempt gives you 120 days of access from activation, which is the window in which you must schedule and sit the exam. You test through Pearson VUE at a test center or through ProctorU remotely, subject to GIAC modality rules. For a full cost breakdown, see our GDAT certification cost guide, and for timing and deadlines, our GDAT exam dates page.
Open book, with limits
Permitted materials are hardcopy books, notes, and an index. Electronic references are prohibited, and so are practice or exam question-and-answer materials. In practice, this makes your index a genuine study artifact: building a good one forces you to organize the material by domain, and it speeds up lookups under a two-hour clock. With 75 questions in 2 hours, you have well under two minutes per question on average, which is not enough time to learn material from scratch at the desk.
Renewal
The certification is valid for four years. Renewal requires either 36 CPE credits or a renewal examination, plus the renewal fee. Keeping the credential current is part of its meaning: it signals ongoing engagement rather than a one-time snapshot.
Who Cares About GDAT
Because the credential spans the intrusion lifecycle from the defender's side, it maps naturally onto roles where people must detect and respond to sophisticated activity. Think security operations and detection engineering teams, incident response groups, threat hunters, and purple team or adversary-emulation practitioners who validate defenses. Security architects and senior analysts responsible for hardening Active Directory environments and tuning controls also fit the profile.
Hiring signals vary by employer, and no verified salary figures are published here. For a qualitative look at roles, see our GDAT jobs overview, and for compensation context, the GDAT salary guide. If you are weighing the investment, the GDAT ROI analysis walks through the trade-offs honestly.
Sequencing Your Preparation Around the Domains
Generic study advice is plentiful, so here is one GDAT-specific sequencing idea. Since the domains mirror an intrusion, studying them in kill-chain order tends to build understanding cumulatively. The plan below is a suggestion, not an official syllabus.
Foundations: Active Directory/Domains and Administrative Access
- Identity infrastructure underpins almost every later stage, so learn it first
- Begin your index with identity and privilege terms
Entry and Execution: Payload Delivery, Payload Execution, Installation
- Trace one attack from delivery to persistence
- Note which controls and logs apply at each hop
Expansion: Application Exploitation, Lateral Movement, Data Exfiltration
- Focus on detection of east-west movement and egress
- Link each technique to a defensive countermeasure
Validation and Response: Adversary Emulation, Reconnaissance, Threat Handling, and Incident Response
- Tie emulation back to testing the defenses from earlier weeks
- Finalize your index and run timed practice
Adjust the pacing to your background; someone who lives in Active Directory daily may compress Week 1, while a newer analyst may need more time on payload mechanics. For a fuller plan, our GDAT study guide goes deeper, and the GDAT cheat sheet is useful as a final-week refresher. To gauge difficulty before you commit, read how hard the GDAT exam is.
Key Takeaway
Treat the domain list as a story, not a checklist. If you can narrate an intrusion from reconnaissance to exfiltration and name a defensive action at every step, you understand what GDAT means better than any definition could convey.
When you are ready to test that understanding under realistic conditions, you can try our GDAT practice tests to see where your gaps are, then return to the main practice site for additional question sets.
Frequently Asked Questions
GDAT stands for GIAC Defending Advanced Threats, a cybersecurity certification issued by GIAC Certifications. It focuses on detecting, disrupting, and responding to advanced adversary behavior across the stages of an intrusion.
The title says "Defending," and the goal is defensive. However, the ten domains are organized around attacker stages such as Payload Delivery and Lateral Movement, reflecting a purple-team approach where understanding attacks informs defensive controls and detections.
The exam has 75 questions in 2 hours, with a minimum passing score of 70%. GIAC's candidate account is the authority for attempt-specific details such as question types and format for your assigned exam version.
There are no formal certification prerequisites, and training is recommended rather than required. SANS SEC599 is the affiliated preparation course, but it is a study resource, not a requirement, and it does not define the official exam coverage.
GDAT is valid for four years. You can renew with 36 CPE credits or by passing a renewal examination, in addition to paying the renewal fee. See the GDAT certification overview for more context.