The GIAC Cyber Threat Intelligence (GCTI) certification tests whether you can turn raw intrusion data into intelligence that someone can act on, and candidates who treat it as a list of frameworks to memorise miss the analysis it actually rewards. GCTI covers intelligence fundamentals, collection and storage, pivoting, malware as a collection source, the Kill Chain, Diamond Model and courses of action matrix, campaigns and attribution, analytic bias, and sharing and reporting. This guide sets out what GIAC publishes about the exam, objectives, prices, attempt rules and renewal, then adds a preparation plan and where GCTI sits on a threat intelligence career path. It is for threat intelligence analysts, incident responders, threat hunters and SOC staff, and for managers building an intelligence function. Exam facts are taken from giac.org, checked November 2026; GIAC says the format and passing score for your own attempt are shown in your GIAC account, so confirm there before you register. For the discipline itself, see the Threat Intelligence Guide.
This is an independent guide from NHI Mgmt Group, based on GIAC's public certification pages as of November 2026. It is not sponsored or reviewed by GIAC. Exam details change, so confirm them against GIAC's current pages and your GIAC account.
Key takeaways
- It is an analysis certification, not a feeds certification. GIAC's nine objectives weight analysis, pivoting, campaigns, attribution and reporting as heavily as collection.
- The exam is 82 questions in 3 hours. One proctored exam, minimum passing score 71% for exam versions released on or after 26 December 2017.
- Open book rewards a good index. GIAC exams allow printed books and notes but no digital materials, at a test centre or remotely.
- Budget $999 an attempt. GIAC's standard attempt price; practice tests are $399 and a retake is $899, and prices can change without notice.
- Renew every four years. Earn 36 CPEs over four years and pay the renewal fee ($499 standard), or renew by retaking the exam.
Who the certification is for
GIAC lists the GCTI audience as incident response team members, threat hunters, Security Operations Center personnel, information security practitioners, experienced digital forensic analysts, and federal agents and law enforcement officials. SANS adds technical managers who build or use intelligence teams to the audience for the affiliated course.
| Role | Why GCTI fits | What to add |
|---|---|---|
| Threat intelligence analyst | Validates the core analytic and reporting skills of the role | Sector and geopolitical context for your organisation |
| Incident responder | Turns each incident into intelligence that improves the next response | Host and network forensics (see the GIAC GCFA Guide) |
| Threat hunter | Campaign analysis and pivoting drive hunt hypotheses | Hunting methods (see the Threat Hunting Guide) |
| SOC analyst or lead | Helps prioritise alerts by adversary relevance | Detection engineering |
| Security manager building a CTI function | Shared language for requirements, analysis and reporting | Programme design (see the Threat Intelligence Maturity Model) |
Exam format and domains
| Item | GIAC's published value |
|---|---|
| Number of exams | 1 proctored exam |
| Questions | 82 |
| Time limit | 3 hours |
| Minimum passing score | 71% (exam versions released on or after 26 December 2017) |
| Delivery | Web based, proctored remotely (ProctorU) or onsite (Pearson VUE) |
| Attempt window | 120 days from activation |
| Materials allowed | Printed books, notes and study guides; no digital materials |
GIAC's certification objectives for GCTI, with what each one means for study:
| GIAC objective | What GIAC says it covers | Study focus |
|---|---|---|
| Intelligence Fundamentals | Core CTI definitions and concepts, plus working knowledge of network indicators, log repositories and forensics tools | Intelligence versus information, requirements, the intelligence cycle |
| Collecting and Storing Data Sets | Collecting and storing data from threat feeds, domains, TLS certificates and internal sources | Source evaluation, structured storage, internal telemetry as the best source |
| Malware as a Collection Source | Malware analysis tools and techniques for deriving intelligence | Extracting configuration, infrastructure and behaviour indicators |
| Pivoting | Expanding intelligence through pivot analysis, link analysis tools and domain analysis | Moving from one indicator to related infrastructure, and knowing when to stop |
| Kill Chain, Diamond Model, and Courses of Action Matrix | Using these models together to analyse intrusions | Mapping an intrusion phase by phase and choosing defensive actions per phase |
| Campaigns and Attribution | Profiling intrusion characteristics, fitting external intelligence into campaigns, factors in attribution | Clustering intrusions; confidence levels; why attribution is often unnecessary |
| Analysis of Intelligence | Analysis techniques and obstacles to accurate analysis such as fallacies and bias | Structured analytic techniques, competing hypotheses, cognitive bias |
| Intelligence Application | Practical gathering, analysis and use of intelligence, and lessons from well-known attacks | Turning findings into detections, hunts and decisions |
| Sharing Intelligence | Storing and sharing intelligence, sharing processes and tools, and writing reports for executives, including assessments | Report structure, estimative language, sharing standards and handling rules |
The site's discipline guides cover the same ground: the Cyber Kill Chain and Diamond Model Guide, the STIX and TAXII Guide for sharing formats, and the Threat Intelligence Report Template for written output.
Prerequisites and experience
The GIAC GCTI page lists no formal prerequisite. GIAC links the exam to SANS cyber threat intelligence training available live and OnDemand. The affiliated course is SANS FOR578: Cyber Threat Intelligence, which SANS lists as 6 days instructor-led or 36 hours self-paced, 36 CPEs, with no strict prerequisites; SANS says familiarity with security terminology is expected and Linux command-line comfort helps in a few labs. Training is optional: you can buy a GIAC attempt without it.
- Helpful before you start: incident response or SOC experience, so the intrusion data in the exam is familiar; basic knowledge of DNS, TLS certificates and network indicators.
- Helpful but not essential: some malware triage experience, and practice writing short assessments for a non-technical reader.
- Framework fluency: MITRE ATT&CK is widely used to describe adversary behaviour in reports; knowing how to map observed behaviour to techniques helps in practice even where the exam objectives name other models.
Preparation plan
GIAC advises planning about four months of study, starting right after training, and reports that certification holders studied an average of 55+ hours. A 12 week plan within that window:
- Weeks 1 to 2, fundamentals and requirements: write three intelligence requirements for your own organisation and keep them in front of you while studying.
- Weeks 3 to 4, collection and storage: set up a small lab platform to store indicators and reports; the MISP Threat Sharing Guide and OpenCTI Guide cover open source options.
- Weeks 5 to 6, models: take a published public intrusion report and map it through the Kill Chain and Diamond Model, then fill a courses of action matrix.
- Week 7, pivoting and malware as a source: practise pivoting from a known indicator using public, passive data only; note confidence at every step.
- Week 8, campaigns, attribution and bias: cluster several intrusions, then argue against your own conclusion with competing hypotheses.
- Week 9, first practice test: GIAC advises a practice test after the first full pass, then using the score report to target weak objectives.
- Weeks 10 to 11, index and reporting: finish the colour-coded index and write one executive-level assessment. GIAC's tip is not to take two practice tests in one day.
- Week 12, second practice test and booking.
GIAC notes that the practice question bank is limited, so questions can repeat between practice tests, and practice exams never include real exam questions.
Readiness signals: you can take an unfamiliar intrusion summary and, within an hour, map it to the Kill Chain and Diamond Model, propose courses of action per phase, and state your confidence and the main alternative explanation; your index finds any model, technique or bias in under a minute; and your practice score is comfortably above 71% with no objective badly behind. Analysis and sharing objectives reward clear reasoning more than recall, so practise writing short judgements in plain language: what happened, how confident you are, what it means for the reader and what they should do next. An assessment that a busy executive can act on in two minutes is the output GIAC describes in its sharing objective, and it is the skill that most separates intelligence work from indicator collection.
Cost, renewal and continuing education
| Fee (GIAC standard pricing, USD, excluding tax) | Amount |
|---|---|
| Certification attempt | $999 |
| Practice exam | $399 |
| Exam retake | $899 |
| Attempt extension (45 days) | $479 |
| Certification renewal | $499 |
| Additional renewals within 2 years of a full price renewal | $249 each |
| Reseating fee for a missed proctored appointment | $175 |
GCTI is not listed among the exceptions on GIAC's pricing page, so standard prices apply. GIAC states it can change pricing at any time without notice.
- Attempt rules: 120 days per attempt; extensions and retakes cannot take the total beyond 570 days; 30 day wait after a failure, with a retake adding 60 days to the deadline; up to 10 extensions of 45 days; after 3 failed attempts, a one year wait before a new attempt.
- Renewal: collect 36 CPEs over four years and pay the renewal fee, or retake the exam; a successful renewal keeps the certification active for four more years. See the Certification Renewal and CPE Requirements Guide.
Where it fits on the career path
GCTI suits analysts who already work in incident response, hunting or the SOC and want to specialise in intelligence, and it gives managers a common framework for an intelligence team. The Threat Intelligence Analyst Career Guide covers the wider route, from entry roles to leading a CTI function.
- From SOC or IR into CTI: GCTI is a common first specialist step, often after an incident handling credential such as GCIH (see the GIAC GCIH Guide).
- Technical depth: analysts who lean towards malware as a source often add GREM (see the GIAC GREM Guide).
- Leadership: CTI leads combine GCTI-level analysis with requirements management and stakeholder reporting.
- Identity angle: many current campaigns centre on stolen credentials, tokens and machine identities. Intelligence on which identities adversaries target feeds directly into identity controls; see the Threat Actors Targeting SaaS and Cloud Identity Guide.
Salary claims are not included: GIAC publishes no official salary data for GCTI, and figures quoted elsewhere vary by market and source.
Practitioner checklist
- Confirm the exam version, question count and passing score in your GIAC account before booking.
- Map your skills to the nine GIAC objectives and mark the weakest three.
- Write your organisation's intelligence requirements and study against them.
- Work at least two public intrusion reports end to end through the Kill Chain, Diamond Model and courses of action matrix.
- Practise pivoting with passive data only and record confidence at each step.
- Write one executive assessment with estimative language before the exam.
- Build your colour-coded index as you study, and take the second practice test only when it is complete.
- Diary the four-year renewal and track CPEs from the day you pass.
Standards and references
- GIAC: Cyber Threat Intelligence (GCTI)
- GIAC: Pricing
- GIAC: Retakes and Extensions
- GIAC: Best Practices for Practitioner Exam Preparation
- GIAC: How to Renew
- SANS: FOR578 Cyber Threat Intelligence
Related NHI Mgmt Group resources: Threat Intelligence Guide · Threat Intelligence Analyst Career Guide · Cyber Kill Chain and Diamond Model Guide · Threat Hunting Guide · STIX and TAXII Guide