- The Short Answer: What a GDAT Is
- Identity Check: Which "GDAT" This Article Covers
- Who Issues It and How the Program Works
- The Exam in Concrete Terms
- The Ten Published Exam Objectives
- The SEC599 Connection
- Fees, Access Window, and Testing Logistics
- Who Benefits From Holding This Credential
- Sequencing the Domains in Your Preparation
- Frequently Asked Questions
- GDAT is GIAC Defending Advanced Threats, a proctored credential built around defending against advanced adversaries.
- The exam has 75 questions, a 2-hour limit, and a 70% minimum passing score.
- GIAC publishes 10 exam-objective headings, from Active Directory/Domains to Reconnaissance, Threat Handling, and Incident Response.
- No formal prerequisites exist; the standalone attempt costs USD 999 and certification lasts four years.
The Short Answer: What a GDAT Is
A GDAT is a person who holds the GIAC Defending Advanced Threats certification, and "GDAT" is also the shorthand for the credential itself. It is issued by GIAC Certifications and aimed at practitioners who need to understand how sophisticated attackers operate and how to build defenses that interrupt them at multiple points. If you have seen job postings asking for "GDAT preferred" or heard a colleague say "I'm going for my GDAT," this is the credential they mean.
The certification sits in the defensive-with-an-offensive-mindset corner of the security field. Instead of treating attackers as an abstract threat, its objectives walk through the actual stages of an intrusion: how an adversary gets in, how they run code, how they move through a network, how they gain administrative control, and how they steal data. Candidates are expected to know how each stage works and how a defender can detect or block it.
If you are earlier in your research, our related explainers on what GDAT certification is and what GDAT stands for cover the same ground from slightly different angles.
Identity Check: Which "GDAT" This Article Covers
The acronym "GDAT" is shared by several unrelated credentials and terms across different industries. This article is only about GIAC Defending Advanced Threats, the security certification administered by GIAC. Details such as fees, exam format, renewal rules, and objectives discussed here apply to that credential and nothing else. If a search result describes a GDAT with a different issuing body, different pricing, or a non-security subject area, it is describing a different credential.
Who Issues It and How the Program Works
GIAC (Global Information Assurance Certification) is a certification body known for role- and skill-specific security credentials. GDAT is one of its exam-based certifications. Unlike some credentials that require a documented work history before you can sit the exam, GDAT has no formal certification prerequisites. Training is recommended but not mandatory, which means a self-directed candidate can register for an attempt directly. For a fuller breakdown of eligibility, see our guide to GDAT requirements and how to qualify.
Once earned, the certification is valid for four years. To keep it current you can either accumulate 36 CPE credits or take a renewal examination, and in both cases you pay the renewal fee. That maintenance model rewards people who stay active in the field, since CPE credits can accumulate naturally through ongoing professional learning.
The Exam in Concrete Terms
The GDAT exam is a single proctored, web-based test. The public specifications are straightforward:
| Attribute | GDAT Specification |
|---|---|
| Number of questions | 75 |
| Time allowed | 2 hours |
| Minimum passing score | 70% |
| Delivery | Proctored, web-based; Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules |
| Reference materials | Open book: hardcopy books, notes, and an index permitted |
| Prohibited materials | Electronic references and practice or exam question-and-answer materials |
| Standalone attempt access | 120 days from activation |
Two caveats are worth stating plainly. First, the 70% minimum applies to exam versions released on or after October 1, 2018. That date marks when this scoring specification took effect; it is not a syllabus revision date. Second, GIAC treats your candidate account as the authority for attempt-specific details such as your assigned exam version, question types, and passing score. The public pages describe the general specification, so confirm your own attempt details in your account before test day.
It is also important not to confuse the passing score with a pass rate. The 70% figure is the threshold you must reach; it says nothing about what fraction of candidates succeed. GIAC has not published a verified pass rate, so be skeptical of any site quoting one. Our article on the GDAT passing score and our look at what the pass-rate data does and does not show go deeper.
What "open book" really means here
Open book does not mean open internet. You may bring printed books, your own notes, and an index, but electronic references are off limits, as are practice or exam question-and-answer materials. For a technical exam with 75 questions in 2 hours, that works out to well under two minutes per question, so a well-built index is only useful if you can navigate it fast. Candidates who treat the open-book policy as a substitute for knowing the material tend to run short on time. We discuss that dynamic in our GDAT difficulty guide.
The Ten Published Exam Objectives
GIAC's public outline lists ten objective headings. The public outline does not publish percentage weights for these areas, so any article claiming exact domain percentages is not drawing from GIAC's public outline. The headings, in the order GIAC lists them, are:
- Active Directory/Domains
- Administrative Access
- Adversary Emulation
- Application Exploitation
- Data Exfiltration
- Installation
- Lateral Movement
- Payload Delivery
- Payload Execution
- Reconnaissance, Threat Handling, and Incident Response
Notice how the list reads like a map of an attack campaign rather than a list of products. That is the credential's defining feature: it asks you to reason about attacker behavior and match it with defensive controls. Here is how to think about several of the headings.
Active Directory/Domains and Administrative Access
Identity infrastructure is where many advanced intrusions are won or lost. These two areas push you to understand how domain environments are structured, how privileges are granted, and how attackers escalate to administrative control.
- Know how domain trust and authentication relationships create paths for attackers.
- Understand what administrative access looks like on both the attacker and defender side.
- Be able to reason about which controls limit privilege abuse.
Payload Delivery, Payload Execution, and Installation
This cluster covers the middle of the intrusion: how malicious content reaches a target, how it runs, and how an adversary makes their foothold stick.
- Trace the path from delivery mechanism to code execution.
- Recognize persistence and installation techniques and the defenses that disrupt them.
- Connect each stage to a point where a defender can prevent or detect activity.
Lateral Movement and Data Exfiltration
After the initial foothold, attackers expand access and eventually remove data. These objectives focus on how that expansion and theft look in a real environment, and what defenders can do about them.
- Understand common movement techniques inside a network.
- Recognize exfiltration channels and the monitoring that exposes them.
- Think in terms of segmentation, visibility, and egress control.
Adversary Emulation and Application Exploitation
Adversary Emulation reflects the purple-team angle: simulating attacker behavior so defenders can test whether their controls actually work. Application Exploitation addresses how software weaknesses become attacker footholds.
- Understand how emulation validates detection and prevention coverage.
- Be able to connect exploitation concepts to defensive hardening.
Reconnaissance, Threat Handling, and Incident Response
This is the exact GIAC heading, and it is broader than its name suggests: the outcome statement and the associated SANS course also discuss threat hunting. Treat it as the area where detection, hunting, and response come together.
- Know how attackers gather information before acting, and how defenders spot it.
- Understand how to handle and respond to a detected threat.
- Be ready for hunting-oriented thinking, not only reactive response.
For a section-by-section treatment of every area, see our complete guide to all 10 GDAT content areas.
The SEC599 Connection
The most commonly associated preparation course is SANS SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses. SANS is affiliated with GIAC, and the course is designed around the same theme as the certification: disrupting each stage of an attack chain with layered defenses informed by attacker tradecraft.
A few clarifications keep expectations realistic:
- SEC599's course sections, labs, and capstone are preparation material. They do not define the official exam domains, weights, or an exhaustive list of what can appear on the test.
- SANS has described course-emphasis percentages in its Purple Team Course FAQ. Those describe how the course allocates time, not how the GDAT exam is weighted.
- SANS has also publicized an updated version of the course, including AI-related content, through a public webinar agenda. That documents a change to preparation material, not a change to the GDAT exam version.
Fees, Access Window, and Testing Logistics
Here are the published price points. All figures exclude applicable sales tax and training tuition.
| Item | Price (USD) |
|---|---|
| Standalone exam attempt | 999 |
| SANS-associated exam attempt (course tuition additional) | 999 |
| Separately listed practice exam | 399 |
| Retake | 899 |
| Standard renewal | 499 |
A standalone attempt gives you 120 days of access from activation, so plan your preparation to fit inside that window rather than activating early. You can test onsite through Pearson VUE or remotely through ProctorU, depending on GIAC's modality rules for your attempt. For the complete cost picture, including what training adds, read our GDAT certification cost breakdown, and check scheduling and deadline guidance before you activate.
Who Benefits From Holding This Credential
The credential fits roles where the daily work involves anticipating and countering skilled attackers. Typical examples include:
- Security operations and detection engineering teams building and tuning detections against attacker techniques.
- Incident response and threat hunting staff who need to recognize intrusion stages in telemetry.
- Purple team and adversary emulation practitioners who bridge offensive testing and defensive improvement.
- Security architects and senior engineers responsible for layered controls across identity, endpoints, and network egress.
- Penetration testers who want to deepen their understanding of how defenses respond to their techniques.
Employers in these areas, including enterprises with mature security programs, managed security providers, and consultancies, tend to value the credential as evidence of applied defensive knowledge. We avoid quoting salary numbers here because no verified figures are drawn from GIAC's public materials, but our GDAT jobs overview and salary analysis discuss the market qualitatively, and our ROI analysis helps you weigh the USD 999 attempt against your career goals.
Sequencing the Domains in Your Preparation
Generic study habits matter less than the order in which you tackle the content. Because the ten objectives follow an attack chain, it helps to study them roughly in the order an intrusion unfolds, then finish with the defensive capstone. Here is one way to lay it out over a few weeks, adjusted to your own schedule and the 120-day access window.
Foundations: identity and access
- Active Directory/Domains
- Administrative Access
- Why first: nearly every later stage depends on these concepts.
Getting in and running code
- Payload Delivery
- Payload Execution
- Application Exploitation
Staying in and spreading
- Installation
- Lateral Movement
- Data Exfiltration
Validation and defense
- Adversary Emulation
- Reconnaissance, Threat Handling, and Incident Response
- Build and rehearse your open-book index.
Key Takeaway
Build your index as you study each domain, not in the final week. Since only hardcopy materials are allowed, an index organized by attack stage will let you jump to the right page quickly under a 2-hour limit. Our GDAT study guide and one-page cheat sheet can serve as a starting framework for your own notes.
When you are ready to test your recall under realistic conditions, the GDAT practice tests on the main site let you check your readiness domain by domain. Keep in mind that practice and exam question-and-answer materials cannot be brought into the exam itself, so use them for preparation only, and never as a reference during the test.
Frequently Asked Questions
GDAT refers to the GIAC Defending Advanced Threats certification, and by extension someone who holds it. It validates the ability to defend against sophisticated attackers by understanding each stage of an intrusion, from reconnaissance through data exfiltration, and the controls that counter them.
No formal certification prerequisites exist, and training is recommended rather than required. That said, the material assumes comfort with networking, Windows environments, and security fundamentals, so most candidates benefit from hands-on experience before attempting it.
The exam is one proctored, web-based test with 75 questions and a 2-hour limit. The minimum passing score is 70%. Confirm attempt-specific details, including your assigned exam version, in your GIAC candidate account.
Yes, it is open book, but only hardcopy books, your own notes, and an index are permitted. Electronic references and practice or exam question-and-answer materials are prohibited, so rehearse with printed materials only.
It is valid for four years. You renew by earning 36 CPE credits or by passing a renewal examination, and either route requires paying the renewal fee, which is listed at USD 499 for standard renewal.