- What GDAT Actually Is
- Who Issues It and Who It Targets
- Exam Format at a Glance
- The Ten Published Exam Domains
- How SANS SEC599 Relates to the Exam
- Fees, Access Window, and Testing Options
- Open-Book Rules and What They Change
- Staying Certified: Four Years, CPEs, and Renewal
- Roles Where the Credential Fits
- Sequencing Your Preparation Around the Domains
- Frequently Asked Questions
- GDAT is GIAC Defending Advanced Threats, administered by GIAC Certifications and focused on defending against advanced adversaries.
- The exam is one proctored session: 75 questions, 2 hours, 70% minimum passing score.
- It is open book for hardcopy materials only; electronic references and practice Q&A materials are prohibited.
- A standalone attempt costs USD 999; the certification lasts four years and renews with 36 CPE credits or an exam.
What GDAT Actually Is
GDAT stands for GIAC Defending Advanced Threats. It is a credential from GIAC Certifications (the Global Information Assurance Certification program) that validates a practitioner's ability to defend an environment against capable, multi-stage adversaries. Several unrelated credentials share the same four letters, so it is worth being precise: everything on this page refers only to the GIAC credential, not to any similarly abbreviated certificate from another body.
If you are still orienting yourself on terminology, our short explainers on what GDAT stands for and what GDAT is cover the naming basics. This article goes further into how the certification is structured, what it tests, and how the logistics work.
The defining theme is the adversary's path through an environment. Rather than treating security as a list of isolated tools, the published objectives walk through the stages an attacker moves through: gaining a foothold, getting a payload delivered and executed, escalating, moving laterally, and finally stealing data. A defender who understands each stage can place detections and controls where they hurt the attacker most.
Who Issues It and Who It Targets
GIAC is the certification body; the exam is delivered under GIAC policies, including the GIAC Candidate Agreement. There are no formal certification prerequisites for sitting the exam, although training is recommended. That means you do not need to hold a lower-level GIAC credential first. For a deeper look at eligibility, see our guide to GDAT requirements.
In practice, the credential is oriented toward people who defend networks and who need to think like the opposition: security operations analysts, detection engineers, incident responders, threat hunters, and purple team practitioners. The domain list leans heavily on technical attacker tradecraft, so candidates who already understand Windows environments and how attacks unfold will find the material most natural.
Exam Format at a Glance
The exam is a single proctored, web-based session. The published specifications are compact:
| Element | Published Specification |
|---|---|
| Number of questions | 75 |
| Time allowed | 2 hours |
| Minimum passing score | 70% |
| Delivery | Proctored, web-based; Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules |
| Reference policy | Open book: hardcopy books, notes, and an index permitted |
Two hours for 75 questions works out to well under two minutes per question on average, which matters in an open-book setting. Looking things up is allowed, but you cannot look everything up. Candidates who lean on their index for every question tend to run short on time, so the index should rescue you on specific recall items rather than substitute for understanding.
GIAC states that your candidate account (the attempts page) is the authority for attempt-specific objectives, question types, format, and passing score. The figures above come from the public specifications; check your own account for the details attached to your assigned exam version. The 70% minimum passing score applies to exam versions released on or after October 1, 2018, and it is a scoring specification, not a pass-rate statistic. We discuss this distinction in GDAT passing score, and for what is and is not known about outcomes, see GDAT pass rate.
The Ten Published Exam Domains
GIAC publishes the exam objectives under the heading "Exam Certification Objectives & Outcome Statements." The public outline lists ten domains and does not supply percentage weights, so no domain should be assumed to carry more or less of the exam than another. Plan for breadth. The full walkthrough lives in our complete guide to all 10 GDAT content areas; here is the orientation.
Active Directory/Domains
Directory services are the backbone of most enterprise environments and a primary target for attackers.
- How domain structure and trust shape an attacker's options
- Where defenders can harden and monitor directory infrastructure
Administrative Access
Privilege is what turns a foothold into a breach.
- How attackers obtain and abuse elevated rights
- Controls that limit the blast radius of compromised credentials
Adversary Emulation
Defenses are only proven when tested against realistic attacker behavior.
- Using emulation to validate detections and controls
- Connecting emulated techniques to defensive gaps
Application Exploitation
Software weaknesses give attackers entry and execution paths.
- How exploitation fits into a broader attack chain
- Defensive measures that blunt or detect exploitation
Data Exfiltration
The end goal of many intrusions is getting data out.
- Common exfiltration paths and channels
- Detection and prevention approaches at egress points
Installation
Once code runs, attackers establish a durable presence.
- How persistence and implants take hold
- Defensive visibility into what gets installed and where
Lateral Movement
Attackers rarely stay on the first compromised host.
- How adversaries pivot between systems
- Segmentation, credential hygiene, and monitoring that constrain movement
Payload Delivery
The route by which malicious content reaches a target.
- Delivery vectors defenders must anticipate
- Controls that interrupt delivery before execution
Payload Execution
The moment malicious content actually runs.
- Execution techniques and the telemetry they leave behind
- Preventive controls that stop or constrain execution
Reconnaissance, Threat Handling, and Incident Response
The exact GIAC heading combines attacker discovery activity with the defender's response. The associated outcome statement discusses threat hunting.
- How adversaries gather information about a target
- Proactive hunting and structured incident handling
How SANS SEC599 Relates to the Exam
GIAC certifications are commonly associated with SANS Institute courses, and the affiliated preparation course for GDAT is SANS SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses. The course emphasizes purple team approaches: pairing offensive technique with defensive engineering so that each attack stage maps to a concrete control or detection.
Two cautions keep this relationship in perspective. First, the course is a preparation resource, not the definition of the exam. Course sections, labs, and capstones do not establish official exam-domain counts, weights, or exhaustive coverage; the published GIAC objectives are the scope reference. Second, SANS describes course-emphasis percentages in its Purple Team Course FAQ, but those describe the course, not GDAT exam weights. Do not translate them into study-time ratios for the exam.
SANS has also publicized an update to the preparation course through a public agenda titled "Purple Teaming Reloaded: AI, Adversaries & the New SEC599." That documents a course update, not an exam-version change, so do not assume the exam changed because the course did. Always confirm your assigned exam version in your GIAC account. For a broader view of training routes, see our overview of GDAT training.
Fees, Access Window, and Testing Options
The published GIAC pricing figures are straightforward, though they exclude applicable sales tax and training tuition:
| Item | Published Amount |
|---|---|
| Standalone certification attempt | USD 999 |
| Separately listed practice exam | USD 399 |
| Retake | USD 899 |
| Standard renewal | USD 499 |
| SANS-associated exam attempt | USD 999, with course tuition additional |
A standalone attempt gives you access for 120 days from activation, so the activation date effectively starts your clock. Plan your activation around your readiness, not the other way around. If you purchase an attempt too early, you may burn days that would have been better spent preparing.
Testing happens through Pearson VUE (onsite) or ProctorU (remote), subject to GIAC modality rules. The GIAC Proctored Exam Reference Guide and the GIAC Certification Attempt Delivery Policy govern the specifics, so read both before scheduling. For a full cost walkthrough, see our GDAT certification cost breakdown, and for scheduling logistics, GDAT exam dates.
Open-Book Rules and What They Change
GDAT is open book, but narrowly so. Permitted materials are hardcopy books, notes, and an index. Electronic references are prohibited, as are practice or exam question-and-answer materials. The practical implications:
- Your index is a study artifact. Building it forces you to process the material, which is often more valuable than the finished document.
- Hardcopy only. Anything you plan to reference on exam day must be printed or written. Digital notes are not a fallback.
- No question banks in the room. Practice Q&A material is explicitly excluded, so prepare with it beforehand, not during.
Key Takeaway
Organize your index by attacker stage and by technique, not only by topic keyword. With under two minutes per question on average, you want to find the right page in seconds. Cross-reference related entries so that a question touching both lateral movement and administrative access leads you to both sets of notes quickly.
Staying Certified: Four Years, CPEs, and Renewal
The certification is valid for four years. To renew, you can earn 36 CPE credits or pass a renewal examination, and in either case you pay the renewal fee (the standard renewal fee is USD 499). GIAC publishes renewal guidance, including a 2026 how-to guide, so check the current process on its renewal pages when your window approaches.
Because the four-year cycle is long, plan CPE activity as you go rather than scrambling near the deadline. Activities connected to defending against advanced threats, such as detection engineering work, purple team exercises, and relevant training, naturally accumulate toward your credit goal.
Roles Where the Credential Fits
GDAT aligns with positions where defending against sophisticated intrusions is the daily work. Typical fits include:
- Security operations and incident response: analysts and responders who triage and contain intrusions.
- Detection engineering: practitioners who translate attacker behavior into alerts and analytics.
- Threat hunting: specialists who proactively search for adversary activity.
- Purple team and adversary emulation: people who test controls by simulating real attacker tradecraft.
Employers value it as evidence of structured, kill-chain-oriented defensive thinking. We do not cite salary numbers here because none are verified; for what is and is not established, see our GDAT salary guide, the GDAT jobs overview, and the analysis of whether GDAT is worth it.
Sequencing Your Preparation Around the Domains
Generic study routines matter less than ordering the material sensibly. Because the domains map onto an intrusion lifecycle, a stage-by-stage sequence works well. Here is one example arrangement tied directly to the GDAT domains:
Foundations: Active Directory/Domains and Administrative Access
- Review how domains, trusts, and privilege work, since later topics build on them
- Start your hardcopy index with these two domains
Entry path: Payload Delivery, Payload Execution, Application Exploitation
- Trace how an attacker gets code running and what telemetry results
- Index detection and prevention controls for each step
Persistence and spread: Installation and Lateral Movement
- Connect persistence mechanisms to the privilege concepts from Week 1
- Note segmentation and monitoring controls that limit movement
Objectives and response: Data Exfiltration, Adversary Emulation, Reconnaissance, Threat Handling, and Incident Response
- Study egress detection and emulation-driven validation
- Finish with hunting and incident handling, then take a timed practice session
Adjust the pace to your background; someone with deep Windows and detection experience may compress the early weeks. For a fuller plan, see our GDAT study guide, and keep our GDAT cheat sheet handy for last-minute review of core facts. When you are ready to test yourself under timed conditions, try the GDAT practice test to check your recall across all ten domains.
Frequently Asked Questions
Here it stands for GIAC Defending Advanced Threats, a certification from GIAC Certifications. Other credentials share the acronym, so confirm the issuer when you see it elsewhere.
The exam has 75 questions and a 2-hour time limit, with a minimum passing score of 70%. Check your GIAC account for attempt-specific details tied to your assigned exam version.
No formal certification prerequisites exist, and training is recommended rather than required. SANS SEC599 is the affiliated preparation course, and the SANS-associated exam attempt is also USD 999 with course tuition additional.
Yes, limited to hardcopy books, notes, and an index. Electronic references and practice or exam question-and-answer materials are prohibited.
It is valid for four years. Renew with 36 CPE credits or by passing a renewal examination, plus the renewal fee (USD 499 standard). See the GDAT certification overview for related details.