- The Short Answer: What GDAT Stands For
- Why the Acronym Causes Confusion
- What "Defending Advanced Threats" Actually Means
- The Ten Exam Domains, Read as an Attack Chain
- Exam Format and Mechanics
- What It Costs and How Long It Lasts
- Who Benefits From the Credential
- Preparing With the Meaning in Mind
- Frequently Asked Questions
- GDAT stands for GIAC Defending Advanced Threats, a certification administered by GIAC Certifications.
- The exam has 75 questions, runs 2 hours, and requires a minimum passing score of 70%.
- Its 10 published domains span the attack chain, from reconnaissance through exfiltration, plus adversary emulation.
- The standalone attempt costs USD 999, and the credential stays valid for four years.
The Short Answer: What GDAT Stands For
GDAT stands for GIAC Defending Advanced Threats. It is a cybersecurity certification issued and administered by GIAC Certifications (GIAC, LLC), the certification body associated with the SANS Institute's training ecosystem. When a job posting, a LinkedIn profile, or a training catalog says "GDAT," this is the credential it refers to on this site. If you want the bare definition in several flavors, we also cover it at What Is GDAT? and What Does GDAT Stand For?, but the rest of this article goes deeper into what the name implies about the exam and the skills behind it.
Each word in the name carries weight:
- GIAC is the issuer, short for Global Information Assurance Certification.
- Defending signals that the credential is oriented toward the blue-team and purple-team side of security work.
- Advanced Threats points at capable, persistent adversaries rather than commodity malware or opportunistic scanning.
Why the Acronym Causes Confusion
Short acronyms get reused. A quick web search for "GDAT" can surface unrelated credentials, programs, and products that happen to share the same four letters. That is a real source of confusion for candidates trying to figure out whether a posting, a salary table, or an exam fee applies to them.
The practical advice: whenever you see a pass rate, a price, or a syllabus attributed to "GDAT," check that it matches the GIAC facts in this article. For the authoritative, attempt-specific details of your own exam, GIAC points candidates to their account at the GIAC exam portal rather than to third-party summaries. Our What Does GDAT Mean? companion page and the GDAT Meaning overview cover the same ground from a quick-reference angle.
What "Defending Advanced Threats" Actually Means
The phrase is more specific than it sounds. In security work, an "advanced threat" is an adversary who plans, adapts, and chains multiple techniques together: gaining a foothold, escalating privileges, moving laterally, and eventually reaching data or systems of value. Defending against that kind of adversary is not about a single tool. It is about understanding each stage of an intrusion well enough to detect it, disrupt it, and respond to it.
That philosophy shapes the whole credential. Instead of organizing around products or vendors, GDAT's published objectives follow the logic of an attack. Candidates are expected to think like the adversary in order to defend against the adversary, which is why the affiliated SANS course is framed around purple-team tactics and kill chain defenses.
The purple-team connection
"Purple team" describes the collaboration between offensive and defensive practitioners: red-team style techniques are used to test and improve blue-team detections. The SANS course most closely tied to this exam is SEC599, "Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses." Knowing that lineage helps explain why the exam domains read like a hybrid of attacker and defender vocabulary.
The Ten Exam Domains, Read as an Attack Chain
GIAC publishes ten objective headings for GDAT. The public outline lists them without percentage weights, so no one outside GIAC can honestly tell you which domain carries more questions. What you can do is read them as a story. For a topic-by-topic breakdown, see our complete guide to all 10 GDAT content areas.
| Domain | What the Name Signals |
|---|---|
| Active Directory/Domains | Identity infrastructure as both a target and a control point |
| Administrative Access | How privileged access is obtained, abused, and constrained |
| Adversary Emulation | Reproducing real attacker behavior to test defenses |
| Application Exploitation | Attacks against software and the controls that blunt them |
| Data Exfiltration | How stolen data leaves a network and how to catch it |
| Installation | Persistence and foothold-establishing techniques |
| Lateral Movement | Pivoting between systems after initial compromise |
| Payload Delivery | How malicious content reaches a target environment |
| Payload Execution | How delivered code runs and what stops it from running |
| Reconnaissance, Threat Handling, and Incident Response | Discovery-stage activity plus detection, hunting, and response |
Notice that the published list is alphabetical-style, not chronological. Reorder it mentally and a coherent intrusion appears: reconnaissance, payload delivery, payload execution, installation, administrative access, lateral movement, Active Directory abuse, application exploitation, and finally data exfiltration, with adversary emulation as the method used to validate defenses across all of it.
Active Directory/Domains and Administrative Access
These two domains cover the identity layer, which is where many advanced intrusions are won or lost.
- Know how domain environments concentrate trust, and why attackers prize privileged accounts.
- Understand defensive controls that limit administrative reach, not only the attacks that exploit it.
- Be ready to connect an observed behavior to the control that would have prevented or exposed it.
Payload Delivery, Payload Execution, and Installation
This cluster follows malicious code from arrival to persistence.
- Trace how content reaches a user or system and which layers can intercept it.
- Understand what prevents delivered code from executing, and what lets it through.
- Recognize persistence mechanisms well enough to detect or remove them.
Reconnaissance, Threat Handling, and Incident Response
GIAC's exact heading combines discovery-stage activity with defensive handling of threats. The domain's outcome statement and the SEC599 curriculum both discuss threat hunting, so expect questions that blend attacker discovery behavior with how defenders find and respond to it.
Exam Format and Mechanics
Understanding what the name means is half the picture; the other half is knowing what sitting the exam looks like. The public specifications describe a single proctored, web-based exam with 75 total questions and a 2-hour time limit. The minimum passing score is 70%. That figure is a score requirement, not a pass rate: no issuer-published pass rate was verified, and you should be skeptical of any site that quotes one. Our GDAT passing score breakdown and pass-rate analysis explain the distinction in more detail.
GIAC applies the 70% passing-score specification to exam versions released on or after October 1, 2018. That date marks when the scoring rule applies, not when the syllabus was last revised. Which exam version a given candidate receives is shown in their GIAC account, and that account is also the authority for attempt-specific objectives, question types, format, and passing score.
Open book, with limits
GIAC exams are open book, but the rules are specific. Permitted materials are hardcopy books, notes, and an index. Electronic references are prohibited, as are practice or exam question-and-answer materials. That policy is why indexing is a recognized skill in the GIAC world, and why our GDAT cheat sheet is meant for review rather than for use in the testing room.
Where you test
Delivery is through Pearson VUE onsite or ProctorU remotely, subject to GIAC's modality rules. Standalone attempts give you 120 days of access from activation, so scheduling is something to plan rather than improvise. See GDAT exam dates and scheduling for the practical details.
What It Costs and How Long It Lasts
GIAC's published figures, excluding applicable sales tax and training tuition, are:
| Item | Amount |
|---|---|
| Standalone exam attempt | USD 999 |
| SANS-associated exam attempt (course tuition additional) | USD 999 |
| Separately listed practice exam | USD 399 |
| Retake | USD 899 |
| Standard renewal | USD 499 |
The certification is valid for four years. To renew, you either earn 36 CPE credits or pass a renewal examination, and in both cases the renewal fee applies. A full walkthrough lives in our GDAT certification cost breakdown.
On eligibility, there are no formal certification prerequisites. Training is recommended rather than required, which is explored further in GDAT requirements.
Who Benefits From the Credential
Because the name says "defending," and the domains span the whole intrusion lifecycle, the credential speaks most directly to people whose daily work involves detecting and responding to capable adversaries. Typical fits include:
- Security operations and detection engineers who write and tune detections against real attacker techniques.
- Incident responders and threat hunters who need to reason from an observed artifact back to the technique behind it.
- Purple team and adversary emulation practitioners who bridge offensive testing and defensive improvement.
- Security architects and engineers responsible for hardening identity, endpoints, and network paths against chained attacks.
Employers who run mature security programs, including managed security providers, consultancies, and large enterprise security teams, are the most natural audience for a credential built around kill chain defense. We do not publish salary numbers here because none can be verified for this specific credential; our GDAT jobs overview and salary guide discuss the market qualitatively, and the ROI analysis helps you weigh cost against career goals.
Preparing With the Meaning in Mind
Because GDAT's domains map to attack stages, your preparation should too. The most reliable framing is to study each stage twice: once as the attacker performing it, and once as the defender who would detect or prevent it. If you can only describe a technique but not the log source, control, or hunting hypothesis that exposes it, you are only halfway prepared.
SANS SEC599 is the affiliated preparation course, and the linked public syllabus brochure is a reasonable way to see what that curriculum emphasizes. Treat it as preparation material, not as an official statement of exam weighting: course sections, labs, and capstones do not establish exam-domain counts or exhaustive exam coverage. The same caution applies to the course-emphasis percentages mentioned in SANS's purple team FAQ, which describe the course, not the exam. SANS has also documented an update to SEC599 in a public agenda, but that describes a preparation-course update, not an exam-version change.
A sequencing idea tied to the domains
Identity foundations
- Active Directory/Domains and Administrative Access first, since later lateral movement and exfiltration scenarios assume you understand how trust and privilege work.
Code arrival and persistence
- Payload Delivery, Payload Execution, and Installation as one continuous chain.
Movement and impact
- Lateral Movement, Application Exploitation, and Data Exfiltration, tying each to the detection that would catch it.
Synthesis and indexing
- Adversary Emulation and Reconnaissance, Threat Handling, and Incident Response, then build and test your open-book index against timed practice.
That ordering is a suggestion, not an official sequence. For a fuller plan, see the GDAT study guide, and for a candid look at difficulty, read how hard the GDAT exam is. If you are new to the topic entirely, our introductions to the GDAT certification and what GDAT certification is are good starting points, and GDAT training covers course options.
Key Takeaway
Think of the name as a study instruction. "Defending Advanced Threats" means every technique you learn should come paired with the detection, control, or response that answers it. Practice that pairing with timed questions on our GDAT practice test site before you commit to an exam attempt.
Frequently Asked Questions
GDAT stands for GIAC Defending Advanced Threats. It is a certification administered by GIAC Certifications, and it focuses on defending against multi-stage adversary activity across the attack lifecycle.
No. Several unrelated programs share the letters, so always confirm that a source names GIAC as the issuer and describes a 75-question, 2-hour proctored exam before applying its fees, dates, or syllabus to this credential.
The public specification lists 75 questions in 2 hours, with a minimum passing score of 70%. GIAC identifies the candidate's own account as the authority for attempt-specific format and passing score.
There are no formal certification prerequisites, and training is recommended rather than required. SANS SEC599 is the affiliated preparation course, but it is a preparation resource, not an eligibility requirement.
It is valid for four years. You renew by earning 36 CPE credits or by passing a renewal examination, and the renewal fee (listed at USD 499 for standard renewal) applies either way.