There will be a maintenance outage on November 21st from 7AM - 8AM EST.

Security Certification: GCED

Security Certification:

GIAC Certified Enterprise Defender (GCED)

If you are registered for the GCED in conjunction with Secure DevOps, Community SANS Seattle SEC501, or PenTest Hackfest your certification and practice examination access will be begin 26-DEC-2017. You will still have 4-months to take your GCED examination from the activation date. Your access to online resources will begin directly after your training event ends. Your practice test and exam access will begin on 26-DEC-2017.

Following the most recent GCED job task analysis survey conducted in 2017, the exam development team is finalizing data for the corresponding exam updates. GIAC exams are regularly updated to ensure alignment with industry trends and input from subject matter experts.


The GCED builds on the security skills measured by the GSEC (no overlap). It assesses more advanced, technical skills that are needed to defend the enterprise environment and protect an organization as a whole. Knowledge, skills and abilities assessed are taken from the areas of Defensive Network Infrastructure, Packet Analysis, Penetration Testing, Incident Handling, and Malware Removal.

*No Specific training is required for any GIAC certification. There are many sources of information available regarding the certification objectives' knowledge areas. Practical experience is an option; there are also numerous books on the market covering Computer Information Security. Another option is any relevant courses from training providers, including SANS.*


  • 1 proctored exam
  • 115 questions
  • Time limit of 3 hours
  • Minimum Passing Score of 70%


GIAC reserves the right to change the specifications for each certification without notice. Based on a scientific passing point study, the passing point for the GCED exam has been determined to be 70% for all candidates receiving access to their certification attempts on or after January 11, 2016. To verify the format of your current certification attempt, please read the Certification Information found in your portal account at


Certifications must be renewed every 4 years. Click here for details.


NOTE: All GIAC exams are delivered through proctored test centers and must be scheduled in advance.
GIAC certification attempts will be activated in your GIAC account after your application has been approved and according to the terms of your purchase. Details on delivery will be provided along with your registration confirmation upon payment. You will receive an email notification when your certification attempt has been activated in your account. You will have 120 days from the date of activation to complete your certification attempt. GIAC exams must be proctored through Pearson VUE. Please click the following link for instructions on How to Schedule Your GIAC Proctored Exam GIAC exams are delivered online through a standard web browser.


Bulletin (Part 2 of Candidate Handbook)

Exam Certification Objectives & Outcome Statements

The topic areas for each exam part follow:

Analyzing Malware with Windows and Online Tools
The candidate will demonstrate an understanding of techniques used by malware to hide and persist, as well as third party and online security software for analyzing and removing malware artifacts.
Data Loss Prevention for Enterprise Defenders
The candidate will demonstrate an understanding of the risks of data breaches and information leakage and best practice controls used to detect and prevent data loss from both insider and external threats.
First Responder Tools and Techniques
The candidate will demonstrate an understanding of incident handling and forensic tools and techniques used by first responders.
Incident Handling and Forensics Fundamentals for Enterprise Defenders
The candidate will demonstrate an understanding of the six steps of incident handling, forensics methodology, and the role of a first responder.
Intrusion Detection and Prevention for Enterprise Defenders
The candidate will demonstrate understanding of network and web application intrusion detection and prevention systems (IDS/IPS) technologies and open source tools, as well as how to test IDS/IPS effectiveness and performance.
Network Device Hardening and Auditing
The candidate will demonstrate an understanding of secure configuration management and auditing of network devices such as routers and switches based on industry standard best practices.
Network Infrastructure Security and Defense
The candidate will demonstrate an understanding of the challenges associated with securing network infrastructure, including common network device attack tools and techniques.
Packet Analysis for Enterprise Defenders
The candidate demonstrate an ability to utilize packet inspection technologies and an understanding of packet analysis and network traffic techniques using common tools.
Pen Testing Methodology and Information Gathering
The candidate will demonstrate an understanding of penetration testing methodology and techniques used to gather information, scan targets, and enumerate system information.
Penetration Testing Exploitation and Reporting
The candidate will demonstrate an understanding of penetration test exploitation, common open source tools, and reporting pen test findings.
Risk Management for Enterprise Defenders
The candidate will demonstrate an understanding of how to classify data assets and manage risks, threats, and vulnerabilities.
Windows Tools for Identifying Malware
The candidate will demonstrate an understanding of windows OS and command line tools used to identify suspicious files, processes, applications, and browser artifacts.

Where to Get Help

Training is available from a variety of resources including on line, course attendance at a live conference, and self study.

Practical experience is another way to ensure that you have mastered the skills necessary for certification. Many professionals have the experience to meet the certification objectives identified.

Finally, college level courses or study through another program may meet the needs for mastery.

The procedure to contest exam results can be found at