- No issuer-published GDAT pass rate was verified; any percentage you see quoted online should be treated as unsourced.
- The exam is 75 questions in 2 hours with a 70% minimum passing score, which is a cut score, not a pass rate.
- A standalone attempt costs USD 999 and a retake USD 899, so a failed attempt is expensive.
- The exam is open book with hardcopy books, notes, and an index; electronic references are prohibited.
Why There Is No Official GDAT Pass Rate
Search for "GDAT pass rate" and you will find confident-sounding numbers on forums, social posts, and thin affiliate pages. None of them trace back to GIAC. GIAC Certifications, the body that administers GIAC Defending Advanced Threats, did not publish a pass-rate statistic in any of the public specifications reviewed for this article, and no issuer-published figure was verified.
That matters because pass rate is one of the most abused statistics in certification marketing. A figure with no named source, no sample size, and no time window cannot tell you anything about your own odds. If a site quotes a precise percentage for GDAT without citing GIAC, treat it as fabricated or borrowed from a different credential that happens to share the acronym.
What GIAC Does Publish: The Hard Numbers
Although a pass rate is absent, GIAC does publish the structural facts of the exam. These are the verified numbers you can actually plan around.
| Item | Verified GDAT Fact |
|---|---|
| Exam format | One proctored, web-based exam |
| Question count | 75 questions |
| Time limit | 2 hours |
| Minimum passing score | 70% |
| Reference policy | Open book: permitted hardcopy books, notes, and an index |
| Prohibited materials | Electronic references and practice or exam question-and-answer materials |
| Delivery | Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules |
| Standalone attempt fee | USD 999 (SANS-associated attempt also USD 999, with course tuition additional) |
| Practice exam | USD 399, listed separately |
| Retake | USD 899 |
| Standalone attempt access | 120 days from activation |
| Certification validity | Four years |
| Renewal | 36 CPE credits or a renewal exam, plus USD 499 standard renewal fee |
Prices exclude applicable sales tax and training tuition. For a full breakdown of what each path costs, see the GDAT certification cost guide.
Reading the 70% Minimum Correctly
The single most common misreading is treating the 70% minimum passing score as if it were a pass rate. They are different things. The passing score is the threshold your own result must reach; a pass rate would describe what fraction of all candidates cleared it. GIAC states the former and, as far as verified, not the latter.
On a 75-question exam, 70% means you need roughly 53 correct answers to clear the line. GIAC applies this passing-score specification to exam versions released on or after October 1, 2018. That date is a scoring applicability date, not a syllabus revision, so do not read it as "the exam was last updated in 2018." Your assigned exam version was not something public sources could confirm; GIAC points candidates to their own account at the attempts page for attempt-specific objectives, question types, format, and passing score. Check that page before you finalize your preparation. For more on the cut score itself, read the GDAT passing score explainer.
Where Candidates Actually Lose Points
Without a published pass rate, the more useful question is not "how many people pass" but "what makes people fail." GDAT is a defender-and-purple-team credential, and its outcomes rest on understanding attacker behavior well enough to detect and disrupt it. The recurring trouble spots follow from that design.
Breadth Across the Kill Chain
The ten domains walk across the full intrusion lifecycle, from Reconnaissance, Threat Handling, and Incident Response at one end to Data Exfiltration at the other. A candidate who has deep Active Directory knowledge but has never reasoned about Payload Delivery or Installation will find the exam uneven. The exam rewards people who can connect an attacker technique to a defensive control at every stage.
Index Quality Instead of Memorization
Because the exam is open book, raw recall matters less than your ability to locate a fact fast. A weak or incomplete index turns an open-book advantage into a time sink. Candidates who rely on their materials without a working index tend to run out of clock rather than run out of knowledge.
Scenario Reasoning
Defending advanced threats is applied work. Expect to reason about what a control actually blocks, what an attacker does next, and where telemetry would reveal it. Memorizing tool names without understanding the technique behind them leaves you stranded when a question describes behavior rather than naming a tool. Our GDAT difficulty guide goes deeper on this.
Domain-by-Domain Pressure Points
The public outline lists ten domains in source order and supplies no percentage weights, so none are assumed here. Treat all ten as fair game and distribute effort accordingly. The notes below describe what each area demands, with a full treatment in the GDAT exam domains guide.
Active Directory/Domains and Administrative Access
These two areas cluster around identity, which is where many advanced intrusions are won or lost.
- How domain trust and privilege structures can be abused and hardened
- What separates routine administration from suspicious privileged activity
- Controls that limit the blast radius of a compromised credential
Adversary Emulation
Central to the purple-team approach: simulating attacker behavior to validate whether defenses actually work.
- Mapping emulated techniques to detections and gaps
- Understanding what a realistic emulation plan exercises
- Using results to drive concrete defensive improvements
Application Exploitation, Payload Delivery, Payload Execution, and Installation
The middle of the kill chain, where an attacker gains a foothold and establishes persistence.
- Common delivery vectors and the controls that interrupt them
- How execution is attempted and how application control or hardening resists it
- Persistence and installation mechanisms, and where they leave evidence
Lateral Movement and Data Exfiltration
The post-compromise phase, where detection opportunities multiply if you know where to look.
- How attackers pivot between systems and the network and host signals that expose it
- Segmentation and monitoring that constrain movement
- Exfiltration channels and the egress controls that catch them
Reconnaissance, Threat Handling, and Incident Response
GIAC's exact heading covers the front and back ends of the lifecycle. Its outcome statement and the affiliated SEC599 course both discuss threat hunting.
- Recognizing reconnaissance activity before it becomes intrusion
- Structured handling of a detected threat
- Response actions that contain and eradicate effectively
What a Miss Costs You
Since no pass rate exists to reassure or alarm you, the more honest framing is financial and logistical. A standalone attempt is USD 999 and a retake is USD 899, before tax. If you take the exam through the SANS-associated route, the attempt is also USD 999 and course tuition is additional. Standalone attempt access runs 120 days from activation, so your preparation window is bounded.
The USD 399 practice exam, listed separately, is therefore a comparatively cheap hedge against an USD 899 retake. Whether it makes sense depends on how confident you are in your readiness, but weighing it against the retake price is rational. Eligibility itself is simple: there are no formal prerequisites, though training is recommended. See GDAT requirements for the details and whether the certification is worth it for the broader return on that spend.
Key Takeaway
The best predictor of passing is not a rumored pass rate but your own measured performance on timed, scenario-style practice. Schedule your attempt only after you consistently clear 70% under realistic time pressure. You can pressure-test yourself with the GDAT practice tests.
The Open-Book Effect on Outcomes
GIAC permits hardcopy books, notes, and an index, and prohibits electronic references and practice or exam question-and-answer materials. This policy shapes results in a way that headline statistics would never capture. An open-book format does not make the exam easy; it changes what is being tested. You are tested on whether you can find, interpret, and apply information quickly.
That is why your index is arguably the most important artifact you produce. A good one maps attacker techniques to defensive controls and to the domains above, so that a question describing a behavior sends you to the right page in seconds. If you train with SANS course material such as SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses, building your index while you study is far more effective than assembling it the night before.
A GDAT-Specific Readiness Sequence
Generic study scheduling is overrated; what helps is ordering the domains so that each builds on the last. The sequence below follows the attacker's path, which also happens to be how the course and exam logic flow. Adjust the pacing to your 120-day access window. A fuller plan lives in the GDAT study guide.
Identity foundations
- Active Directory/Domains and Administrative Access first, since later domains assume this knowledge
- Begin your index with identity and privilege entries
Initial access and foothold
- Application Exploitation, Payload Delivery, Payload Execution, and Installation
- For each technique, record the matching defensive control in your notes
Movement and loss
- Lateral Movement and Data Exfiltration
- Focus on detection signals and containment points
Emulation and response
- Adversary Emulation and Reconnaissance, Threat Handling, and Incident Response
- Tie every earlier domain back to how you would emulate and respond to it
Timed rehearsal
- Full 75-question, 2-hour simulations using only permitted-style materials
- Trim and reorganize the index based on what slowed you down
For a compact review aid as exam day approaches, the GDAT cheat sheet condenses the must-know facts, and the exam dates and scheduling guide covers booking mechanics.
Why Outcomes Matter to Employers
Candidates often ask about pass rates because they want to know how much the credential signals. The honest answer does not depend on a statistic. GDAT targets defenders who can reason across the attack lifecycle and validate controls through purple-team methods, which maps to roles in detection engineering, threat hunting, red and purple teaming, and incident response. See GDAT jobs and the salary guide for how the credential is positioned in the market, and note that this site does not cite invented earnings figures.
If you are still orienting yourself, the broader explainers on GDAT certification and GDAT training cover the credential and preparation options, and the main practice test site lets you start measuring readiness today.
Frequently Asked Questions
No issuer-published pass rate for GIAC Defending Advanced Threats was verified. GIAC publishes a 70% minimum passing score, which is a cut score rather than the share of candidates who pass. Be skeptical of any specific percentage that does not cite GIAC.
No. The 70% figure is the minimum score your own attempt must reach. A pass rate would describe what proportion of all candidates succeed, and that figure has not been published by GIAC.
The proctored web-based exam has 75 questions and a 2-hour time limit. GIAC identifies your candidate account as the authority for attempt-specific details such as question types and format, so confirm there before test day.
A retake is USD 899, compared with USD 999 for a standalone attempt, before applicable sales tax. A separately listed practice exam is USD 399. Training tuition is additional to all of these.
Yes, within limits. The exam is open book with permitted hardcopy books, notes, and an index. Electronic references and practice or exam question-and-answer materials are prohibited, and delivery is through Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules.