- What "GDAT Training" Actually Covers
- SEC599: The Affiliated Course Pathway
- Why Course Content and Exam Content Are Not the Same Thing
- Mapping Training Topics to the Ten Exam Domains
- Training for an Open-Book, Index-Driven Exam
- Training Tuition, Exam Fees, and Attempt Windows
- A Domain-Sequenced Training Plan
- Who Benefits From This Training Path
- Frequently Asked Questions
- GDAT is GIAC Defending Advanced Threats: one proctored exam, 75 questions, 2 hours, 70% minimum passing score.
- No formal prerequisites exist, and GIAC recommends training rather than requiring it.
- SANS SEC599 is the affiliated preparation course, but course sections do not define official exam weights.
- The exam is open book with hardcopy materials only; electronic references and practice Q&A materials are prohibited.
What "GDAT Training" Actually Covers
When candidates search for GDAT training, they are usually looking for one of three things: a formal course, a self-directed study plan, or a way to build hands-on skills against realistic attack chains. GIAC Defending Advanced Threats sits in an unusual place among certifications because it tests defensive thinking through an adversary lens. Every one of its ten published exam domains maps to a stage of an attack, from reconnaissance through payload delivery, execution, lateral movement, and exfiltration, and the defender is expected to know how to detect, prevent, and respond at each stage.
That framing shapes what effective training looks like. Reading about attacks is not enough. You need to understand how an adversary would move through an Active Directory environment, how a payload gets delivered and executed, and which controls break that chain. If you are still orienting yourself, our explainer What Is GDAT Certification? covers the credential's purpose, and the GDAT requirements guide confirms the eligibility picture: there are no formal certification prerequisites, though training is recommended.
SEC599: The Affiliated Course Pathway
The preparation course formally affiliated with this certification is SANS Institute's SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses. The title tells you a great deal about the philosophy. "Purple team" means the course blends offensive technique with defensive engineering: you learn how an attack works so you can build the control that stops it. "Kill chain defenses" signals that the curriculum is organized around the stages of an intrusion rather than around product categories.
SANS publishes a public syllabus brochure for SEC599, and it is worth reading before you decide how to prepare. Be aware that no printed revision date was verified for the linked brochure, so treat it as a description of the course rather than a guarantee of what any particular exam version contains. SANS has also publicly discussed a refresh of the course in a webcast agenda titled "Purple Teaming Reloaded: AI, Adversaries & the New SEC599" (August 25, 2025). That agenda documents a preparation-course update, not a change to the exam. Only the public agenda was reviewed; the sign-in-gated recording was not.
Course emphasis is not exam weighting
SANS's Purple Team Course FAQ describes how much course time goes to different themes. Those course-emphasis figures are descriptions of teaching time, not GDAT exam weights. GIAC's public exam outline for GDAT lists ten domains in a fixed order but supplies no percentage weights, and this article does not infer any. Anyone telling you "Domain X is 20% of the exam" from a course brochure is guessing.
| Source | What it tells you | What it does not tell you |
|---|---|---|
| GIAC exam objectives page | The ten domain headings and outcome statements | Percentage weights per domain |
| SANS SEC599 brochure | Course structure, labs, and capstone concept | Exact exam coverage or exam-domain counts |
| SANS Purple Team Course FAQ | Course-emphasis percentages for teaching time | GDAT exam weights |
| Your GIAC account attempts page | Attempt-specific objectives, question types, format, passing score | Pass-rate statistics |
Why Course Content and Exam Content Are Not the Same Thing
This is the single most misunderstood point about GDAT training. A course exists to teach you a subject; an exam exists to verify specific outcomes. They overlap heavily, but they are not identical. GIAC identifies the candidate's own account attempts page as the authority for attempt-specific objectives, question types, format, and passing score. The public specifications are a reliable orientation, but your assigned exam version was not supplied to us, so confirm details in your account before finalizing your plan.
Practically, this means you should use the ten GIAC domain headings as your master checklist and use the course as the vehicle for learning them, not the other way around. If a lab teaches something interesting that does not map to any domain, enjoy it, but do not let it consume your preparation time.
Key Takeaway
Build your study checklist from the ten published GIAC domain headings, then use SEC599 materials, labs, and your own lab work to fill in each one. Treat the brochure as a curriculum description, never as an exam blueprint.
Mapping Training Topics to the Ten Exam Domains
The domains are published in source order, and that order loosely follows the attack lifecycle. Below is how to think about training for each. For a deeper breakdown, see our complete guide to all 10 GDAT content areas.
Domain 1: Active Directory/Domains
Active Directory is the terrain on which most enterprise intrusions play out, so this domain anchors a lot of what follows.
- How domain trust, authentication, and delegation can be abused
- Hardening and monitoring techniques that make abuse visible
- Why identity infrastructure is both a target and a detection source
Domain 2: Administrative Access
Once an adversary escalates privilege, defenders have fewer options. Training here centers on restricting, tiering, and auditing privileged access.
- Controls that limit credential exposure on workstations and servers
- Detecting abnormal use of administrative accounts
- Reducing the blast radius of a single compromised credential
Domain 3: Adversary Emulation
This is where the purple-team philosophy becomes explicit. You practice reproducing attacker behavior to test whether your defenses actually fire.
- Translating attacker techniques into repeatable test cases
- Validating detections instead of assuming they work
- Using emulation results to prioritize defensive gaps
Domains 4 through 6: Application Exploitation, Data Exfiltration, Installation
These three cover how adversaries gain a foothold, establish persistence, and move data out. Prepare to reason about both the technique and the compensating control.
- Recognizing how application weaknesses translate into code execution
- Identifying installation and persistence mechanisms on endpoints
- Understanding exfiltration channels and the monitoring that exposes them
Domains 7 through 9: Lateral Movement, Payload Delivery, Payload Execution
The middle of the attack chain is where many defensive controls earn their keep. Expect scenario-style reasoning about how payloads arrive, run, and spread.
- Network and host controls that constrain movement between systems
- Delivery vectors and the filtering that interrupts them
- Execution controls and the telemetry that reveals suspicious runs
Domain 10: Reconnaissance, Threat Handling, and Incident Response
The heading is retained exactly as GIAC publishes it. Its outcome statement and SEC599 both discuss threat hunting, so expect proactive detection and response workflows to matter here.
- Recognizing adversary reconnaissance and what it reveals about intent
- Handling a detected threat through containment and response
- Hunting for activity that automated detections missed
Training for an Open-Book, Index-Driven Exam
GDAT is open book, which changes how you should train. Permitted resources are hardcopy books, notes, and an index. Electronic references and practice or exam question-and-answer materials are prohibited. That last rule is easy to overlook: you cannot bring your own practice-question files into the exam, even in printed form if they constitute question-and-answer material. Review the GDAT cheat sheet for a compact reminder of must-know facts, but build your own index as part of training, because the act of indexing is itself a learning exercise.
Building an index that works
- Organize entries by concept and technique name, not just by page order.
- Note where a defensive control and its matching attack technique appear together.
- Add entries for tools, event sources, and configuration settings you encountered in labs.
- Test the index under time pressure; a 75-question exam in 2 hours leaves roughly 1.6 minutes per question on average, so a slow lookup is costly.
Training Tuition, Exam Fees, and Attempt Windows
Budgeting for GDAT training means separating several line items that are easy to conflate. The figures below come from GIAC's published pricing and exclude applicable sales tax and training tuition. For the complete picture, see our GDAT certification cost breakdown.
| Item | Published amount |
|---|---|
| Standalone exam attempt | USD 999 |
| SANS-associated exam attempt | USD 999 (course tuition additional) |
| Separately listed practice exam | USD 399 |
| Retake | USD 899 |
| Standard renewal | USD 499 |
Two mechanics matter for planning. First, a standalone attempt gives you access for 120 days from activation, so activating before you are ready burns your window. Second, the SANS-associated attempt carries the same USD 999 exam price, with course tuition on top; that tuition figure is not part of the public facts reviewed here, so check SANS directly for current course pricing.
Testing is delivered through Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules. Review the delivery policy and proctored exam reference guide before choosing, particularly if you plan to test remotely. Our GDAT exam dates guide covers scheduling and deadlines in more detail.
Passing score and what it means
The minimum passing score is 70%. GIAC applies this specification to exam versions released on or after October 1, 2018; that is a scoring applicability date, not a syllabus revision date. It is also not a pass rate. No issuer-published pass rate was verified, so be skeptical of any figure presented as one. Our pages on the GDAT passing score and pass rate data separate what is documented from what is speculation.
A Domain-Sequenced Training Plan
Rather than generic scheduling advice, sequence your preparation around how the domains depend on one another. Identity concepts underpin almost everything, so start there. The plan below assumes you are building an index as you go and leaving the final stretch for timed review. Adjust the length to your background; the point is the ordering logic, which is explained in more depth in our GDAT study guide.
Identity foundations
- Active Directory/Domains: authentication, trust, and delegation fundamentals
- Administrative Access: privilege tiering and credential exposure
- Start the index with identity-related attack and control pairs
Entry and execution
- Application Exploitation, Payload Delivery, and Payload Execution as one connected chain
- Installation and persistence mechanisms
- Pair each technique with its preventive and detective control
Movement and loss
- Lateral Movement across the identity foundations from Phase 1
- Data Exfiltration channels and the monitoring that exposes them
- Revisit weak spots from earlier phases
Validation and response
- Adversary Emulation: practice validating that detections fire
- Reconnaissance, Threat Handling, and Incident Response, including threat hunting
- Timed review with your finished index before you activate your attempt
Scheduling Adversary Emulation late is deliberate. It asks you to synthesize everything else, so it pays off most once the individual stages are familiar. If you want structured questions to gauge readiness, our GDAT practice tests are built to help you find weak domains before an attempt costs you USD 899 to retake.
Who Benefits From This Training Path
The skills in GDAT training serve defenders who need to think like attackers: security operations analysts moving toward detection engineering, incident responders, threat hunters, and purple-team practitioners. Employers hiring for these functions tend to value demonstrable knowledge of how intrusions unfold and how to interrupt them. We avoid quoting salary or hiring-volume figures because none are verified here; see our discussions of GDAT jobs, the salary guide, and whether the certification is worth it for qualitative context.
Once earned, the certification is valid for four years. Renewal requires 36 CPE credits or a renewal examination, plus the renewal fee. That ongoing requirement is worth factoring into your long-term plan, since the habit of continuous learning that good training builds is exactly what keeps CPE accumulation manageable. If you are still deciding whether the credential fits your goals, start with What Is GDAT? and then return to build your plan.
Key Takeaway
The strongest GDAT training combines three things: a course or equivalent labs for hands-on skill, the ten GIAC domain headings as your checklist, and a self-built index tested under time pressure. Verify attempt-specific details in your GIAC account before you commit to a plan.
Frequently Asked Questions
No. There are no formal certification prerequisites for GIAC Defending Advanced Threats, though training is recommended. You can purchase a standalone exam attempt without taking a course, but you should be confident in all ten domains before you do.
SANS SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses is the affiliated preparation course. Its sections, labs, and capstone are preparation-curriculum material and do not establish official exam-domain counts, weights, or exhaustive exam coverage.
The exam is open book with permitted hardcopy books, notes, and an index. Electronic references and practice or exam question-and-answer materials are prohibited. Confirm current rules in the GIAC proctored exam reference guide before test day.
Standalone attempt access is 120 days from activation. Because the clock starts at activation, finish most of your training and index-building first, then activate when you are ready to schedule.
No. SANS course-emphasis percentages describe teaching time, not GDAT exam weights. GIAC's public outline lists the ten domains without percentage weights, so prepare for all ten rather than betting on any one.