- GDAT Defined: What the Credential Actually Is
- Why the Acronym Needs Care
- Who Issues It and What It Signals
- The Ten Published Exam Domains
- Exam Format, Delivery, and Open-Book Rules
- Fees, Access Window, and Renewal Mechanics
- Preparation Paths: SEC599 and Beyond
- Where GDAT Fits in Hiring and Careers
- Sequencing Your Study Around the Domains
- Frequently Asked Questions
- GDAT is GIAC Defending Advanced Threats, a GIAC certification focused on defending against advanced adversaries across the attack chain.
- The exam is one proctored, web-based test: 75 questions, 2 hours, and a 70% minimum passing score.
- GIAC publishes ten exam domains, from Active Directory/Domains through Reconnaissance, Threat Handling, and Incident Response, with no public weights.
- A standalone attempt costs USD 999; the certification is valid four years and renews with 36 CPE credits or an exam.
GDAT Defined: What the Credential Actually Is
GDAT stands for GIAC Defending Advanced Threats. It is a professional certification administered by GIAC Certifications that validates a candidate's ability to understand how advanced adversaries operate and to build, test, and tune defenses against them. The emphasis is practical and adversary-aware: instead of treating security as a list of controls, the credential asks whether you can reason about how an attacker moves from reconnaissance to payload delivery, execution, lateral movement, and data theft, and where a defender can interrupt that chain.
If you are arriving from a search for a short definition, the companion pieces on what GDAT stands for and GDAT meaning cover the naming question directly. This article goes further and explains the structure of the credential, what the exam measures, and what it takes to earn and keep it.
Why the Acronym Needs Care
"GDAT" is a short acronym, and short acronyms collide. On this site, GDAT always and only refers to GIAC Defending Advanced Threats. Fees, exam length, passing score, renewal rules, and domain names discussed here belong to that GIAC credential and nothing else. If you have seen different numbers attached to the letters GDAT elsewhere, verify which credential and which issuing body the source is describing before comparing anything. The most reliable check is the certifying organization: for this credential, it is GIAC, and the official reference is the GIAC certification page for Defending Advanced Threats.
For a broader orientation to the credential name and how people refer to it, see What Is GDAT Certification? and What Does GDAT Mean?.
Who Issues It and What It Signals
GIAC, the Global Information Assurance Certification program, administers the exam and issues the credential. GIAC certifications are widely recognized in defensive security, incident response, and security engineering hiring, and they are commonly paired with SANS Institute training, although the two are distinct: GIAC certifies, SANS trains. GDAT has no formal certification prerequisites. Training is recommended rather than required, and the details are laid out in GDAT requirements and eligibility.
What the credential signals to an employer is a particular kind of competence. A GDAT holder should be able to talk about an intrusion in terms of attacker objectives and then translate those objectives into detection logic, hardening, and response actions. That is different from a purely compliance-oriented certification, and different again from a pure penetration-testing credential. It sits in the space between: defenders who understand offense well enough to test their own controls.
The Ten Published Exam Domains
GIAC publishes ten objective headings for GDAT. The public outline does not attach percentage weights to them, so you should not assume the domains are equally weighted or that any one is dominant. Treat all ten as testable, and use your attempt-specific objectives (see the format section below) as the authority. A deeper walkthrough lives in the complete guide to all 10 GDAT content areas. Here is a practical summary of what each heading asks of you.
Domain 1: Active Directory/Domains
Active Directory is the connective tissue of most enterprise networks and the favorite target of advanced adversaries. Expect to reason about how domain structure, trust, authentication, and delegation can be abused and hardened.
- How attackers enumerate and abuse domain relationships
- Defensive hardening and monitoring of domain infrastructure
Domain 2: Administrative Access
Privileged access is what turns a foothold into a breach. This area covers how elevated rights are obtained, misused, and constrained.
- Privilege escalation paths and how to close them
- Controls that limit and monitor administrative use
Domain 3: Adversary Emulation
This is the purple-team heart of the credential: simulating attacker behavior to validate whether defenses actually detect and block it.
- Mapping adversary behavior to testable scenarios
- Using emulation results to improve detection and prevention
Domain 4: Application Exploitation
Attackers frequently enter through vulnerable applications. Candidates need to understand exploitation at a level that informs defensive decisions.
- How application weaknesses enable initial access or escalation
- Mitigations that reduce exploitability
Domain 5: Data Exfiltration
The end goal of many intrusions is getting data out. Know the channels attackers use and the controls and telemetry that expose them.
- Common exfiltration channels and staging behavior
- Detection and egress-control strategies
Domain 6: Installation
Persistence and foothold establishment: how adversaries install tooling and maintain access, and how defenders spot and prevent it.
- Persistence mechanisms and their artifacts
- Application control and integrity-oriented defenses
Domain 7: Lateral Movement
Once inside, attackers pivot. Defenders must understand the techniques and the segmentation, credential hygiene, and monitoring that frustrate them.
- Movement techniques inside Windows-centric environments
- Controls and detections that constrain movement
Domain 8: Payload Delivery
How malicious content reaches a target, and where email, web, and endpoint controls can stop it.
- Delivery vectors and their defensive counters
- Filtering, sandboxing, and user-facing mitigations
Domain 9: Payload Execution
What happens when malicious code runs, and how to prevent or detect execution through endpoint hardening and telemetry.
- Execution techniques and evasion considerations
- Preventive controls and behavioral detection
Domain 10: Reconnaissance, Threat Handling, and Incident Response
The closing domain ties the chain together: understanding adversary reconnaissance, hunting for threats, and responding when something is found. GIAC's heading is retained exactly as published; its outcome statement discusses threat hunting.
- Recognizing and reducing reconnaissance exposure
- Threat hunting and structured incident response
Exam Format, Delivery, and Open-Book Rules
The GDAT exam is a single proctored, web-based test with 75 questions and a 2-hour time limit. The minimum passing score is 70%. GIAC applies this passing-score specification to exam versions released on or after October 1, 2018; that date describes when the scoring rule applies, not when the syllabus was last revised. The exact question types, format, and passing score for your attempt are governed by your GIAC account, so check your attempt page before you finalize any study plan. For a fuller breakdown of the threshold, see GDAT passing score.
| Exam Element | Specification |
|---|---|
| Certifying body | GIAC Certifications |
| Format | One proctored, web-based exam |
| Questions | 75 |
| Time limit | 2 hours |
| Minimum passing score | 70% |
| Testing options | Pearson VUE onsite or ProctorU remote, subject to GIAC modality rules |
| Prerequisites | None formal; training recommended |
What open book really means
GDAT is an open-book exam, but the permission is narrower than the phrase suggests. Permitted materials are hardcopy books, notes, and an index. Electronic references are prohibited, as are practice or exam question-and-answer materials. In practice this means your preparation should include building a well-organized printed index, because with 75 questions in 2 hours you have well under two minutes per question and cannot afford to search aimlessly through a stack of paper.
Be careful with pass-rate claims
The 70% figure is a minimum passing score, not a statistic about how many candidates pass. No issuer-published pass rate was verified for this credential, so treat any specific pass-rate number you encounter with skepticism. Our write-up on the GDAT pass rate explains what can and cannot be said responsibly, and how hard the GDAT exam is discusses difficulty in qualitative terms.
Fees, Access Window, and Renewal Mechanics
The published GIAC prices relevant to GDAT are straightforward, though they exclude applicable sales tax and training tuition.
| Item | Amount |
|---|---|
| Standalone exam attempt | USD 999 |
| SANS-associated exam attempt (course tuition additional) | USD 999 |
| Separately listed practice exam | USD 399 |
| Retake | USD 899 |
| Standard renewal | USD 499 |
A standalone attempt gives you access for 120 days from activation, so schedule your activation around your actual readiness rather than activating early and burning the window. The full financial picture, including how training tuition changes the total, is covered in the GDAT certification cost breakdown, and scheduling considerations are in the guide to GDAT exam dates and scheduling.
Keeping the credential current
GDAT remains valid for four years. To renew, you either earn 36 CPE credits or pass a renewal examination, and in either case you pay the renewal fee. Because the standard renewal fee is USD 499, many holders plan CPE activity across the four-year cycle rather than retaking an exam at the end.
Key Takeaway
Budget for the whole lifecycle, not just the first attempt: exam fee, any optional practice exam, a possible retake, and the renewal fee four years later. Fees exclude sales tax and training tuition, so confirm the current figures on GIAC's pricing page before purchase.
Preparation Paths: SEC599 and Beyond
The affiliated preparation course is SANS SEC599, Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses. Its title lines up closely with the exam's themes: purple-team tactics, kill-chain defenses, and defeating advanced adversaries. The course is a recommended route, not a requirement, and it is important to keep its role straight: course sections, labs, and capstones are preparation curriculum and do not establish official exam-domain counts, weights, or exhaustive exam coverage. Your authority for what is tested is the GIAC objective list and your attempt-specific information.
SANS has also publicly discussed a preparation-course update through a webcast agenda titled "Purple Teaming Reloaded: AI, Adversaries & the New SEC599." That agenda documents a change to the training course, not a change to the exam version, so do not read it as a signal that exam content has shifted. If you take training, you may also see course-emphasis percentages in SANS materials; those describe the course, not exam weighting.
Self-study candidates can absolutely pursue GDAT without the course, provided they build equivalent hands-on skill. Whichever route you choose, hands-on practice matters, because the questions reward understanding of how techniques behave rather than rote recall. A structured walkthrough appears in the GDAT study guide, and the GDAT training overview compares ways to prepare. When you are ready to test yourself, our GDAT practice tests let you rehearse question styles under timed conditions.
Where GDAT Fits in Hiring and Careers
Because the exam spans adversary technique and defensive response, GDAT maps to roles where those perspectives meet. Typical fits include:
- Purple team and adversary emulation practitioners, who validate controls by simulating realistic attacks.
- Detection engineers and security engineers, who translate attacker behavior into alerts, hardening, and architecture changes.
- Security operations and incident response analysts, who benefit from a kill-chain view when triaging and scoping intrusions.
- Threat hunters, whose work aligns with the threat-handling emphasis in the final domain.
- Enterprise defenders responsible for Windows and Active Directory environments, given the weight the exam places on domain security, administrative access, and lateral movement.
Employers that run mature security programs, including large enterprises, consultancies, managed security providers, and government-adjacent organizations, tend to value GIAC credentials as evidence of hands-on capability. For realistic role titles, see GDAT jobs. Compensation varies by region, seniority, and employer, and we deliberately avoid quoting unverified figures; our GDAT salary guide discusses the factors qualitatively, and the ROI analysis helps you weigh the USD 999 attempt cost against your own career goals.
Sequencing Your Study Around the Domains
You do not need a generic study system for GDAT, but you do benefit from ordering topics so that earlier material supports later material. The domains build on each other: foundations first, then the attack chain, then synthesis. Here is one reasonable ordering, tied directly to the published headings.
Environment foundations
- Active Directory/Domains: structure, authentication, trust, and common abuse paths
- Administrative Access: privilege models and escalation routes
- Start your printed index now, adding entries as you study
The front half of the attack chain
- Payload Delivery, Payload Execution, and Application Exploitation
- Installation: persistence mechanisms and detection artifacts
The back half and validation
- Lateral Movement and Data Exfiltration
- Adversary Emulation: connect each technique you studied to a testable scenario
Synthesis and exam conditions
- Reconnaissance, Threat Handling, and Incident Response as the capstone domain
- Timed practice sets sized to 75 questions in 2 hours, using your index as you would on exam day
This sequence is a template, not a prescription. If you work daily with Active Directory, compress the early weeks; if you come from a network-defense background without much offensive exposure, give extra time to the execution and exploitation domains. For a compact last-pass review, the GDAT cheat sheet condenses the must-know facts.
Frequently Asked Questions
GDAT stands for GIAC Defending Advanced Threats, a certification administered by GIAC Certifications. More background is available in our article on what GDAT certification is.
The exam has 75 questions in a 2-hour window, with a minimum passing score of 70%. Your attempt-specific details, including question types and format, are shown in your GIAC account, so confirm them there.
There are no formal certification prerequisites. Training such as SANS SEC599 is recommended but not required. See GDAT requirements for details.
Yes, within limits. The exam is open book with permitted hardcopy books, notes, and an index. Electronic references and practice or exam question-and-answer materials are prohibited.
The certification is valid for four years. You renew by earning 36 CPE credits or by passing a renewal examination, and you pay the renewal fee in either case. Current fee figures are on GIAC's pricing page.