GIAC GREM Guide: Exam, Requirements and Preparation

GIAC Reverse Engineering Malware (GREM) is one of the most demanding GIAC practitioner exams, because it tests whether you can actually analyse malicious code in a lab, not whether you can recognise terms. This guide sets out what GIAC publishes about GREM: the exam format, the 15 certification objectives, delivery and open book rules, prices and the four-year renewal cycle. It adds a preparation plan, decision guidance on whether GREM is the right credential for your role, and where it fits on a detection, response and forensics career path. It is written for incident responders, forensic analysts, threat intelligence and detection engineers, and managers deciding whether to fund it. It describes the certification only, not analysis techniques. Facts are as published on giac.org, checked October 2026; GIAC states that prices can change without notice, so confirm on the linked pages before you register.

Key takeaways

• One exam, 66 questions, 3 hours. GREM is a single proctored exam with a minimum passing score of 73% for exam versions released on or after 27 August 2022.
• It is a CyberLive exam. GIAC describes GREM's format as performance-based challenges in lab environments using virtual machines, real security tools and authentic malicious code.
• The syllabus is deep, not broad. The 15 objectives cover malicious documents, assembly-level reverse engineering, packed and obfuscated code, .NET malware and anti-analysis techniques.
• The price is high. GIAC lists a certification attempt at $999, a retake at $899 and a practice exam at $399 (USD, excluding tax), usually on top of training.
• Renewal is every four years. Holders collect 36 CPE credits and pay a $499 renewal fee, or renew by exam.

Who the certification is for

GIAC classes GREM as a practitioner certification. Its stated audience is system and network administrators, auditors, security consultants and managers, technologists formalising or expanding their expertise, forensic investigators and security practitioners broadening their skills, and people who have dealt with malware incidents.

• Good fit: incident responders and forensic analysts who already triage suspicious files and need to go further than sandbox reports; threat intelligence and detection engineers who write signatures and need to understand what a sample does; staff whose employer funds SANS training (GIAC's justification letter for GREM is named for SANS FOR610).
• Good fit for employers: GIAC states it is accredited under ISO/IEC 17024 through ANAB, and the GREM page carries a DoD 8140 badge. Confirm any specific work role mapping with the hiring organisation.
• Weaker fit: generalists early in a security career, for whom a broad credential gives more return first; and SOC analysts who only need to triage alerts, for whom the Blue Team Certifications Guide lists more proportionate options.

For a wider comparison across vendors and levels, see the Cybersecurity Certifications Guide. For the threat itself, see the Malware Guide.

Exam format and domains

Format

With 66 questions in 180 minutes you have under three minutes per question on average. Hands-on analysis items consume much more than that, so speed in the lab matters as much as knowledge. GIAC states that the malicious code used is inside its exam lab environments.

The 15 certification objectives, grouped

GIAC lists 15 objectives without weightings. The grouping below is ours; objective names are GIAC's.

Nine of the 15 objectives require reading code at assembly level or working in a debugger. Candidates whose experience is mostly behavioural sandbox analysis should expect most of their study time to go there.

Why it matters to defenders: modern malware often targets credentials, browser sessions, tokens and API keys rather than files alone. Analysts who can establish exactly what a sample collected give incident responders a precise list of secrets and identities to revoke. See the Incident Response Guide and the YARA Rules Guide.

Prerequisites and experience

The GREM page lists no formal prerequisite and no minimum experience. The objectives assume you can already work comfortably at this level:

• Windows internals: processes, threads, memory, the registry and how executables are loaded.
• Programming: reading C-like code and scripting languages, and a willingness to learn x86 assembly if you have not already.
• Incident context: some exposure to malware incidents, so you know which questions about a sample matter to responders.
• Lab discipline: one objective covers the needs of a malware analysis lab. If you build your own practice lab, keep it isolated from production networks and follow your organisation's rules for handling samples.
• Training: not mandatory. GIAC links SANS reverse engineering malware training, and most candidates who buy it base their open book index on the course books.

Preparation plan

Preparation for an open book CyberLive exam has three outputs: knowledge, practised lab speed, and a personal index into your printed materials.

1. Plan the window (before activation): the attempt must be completed within 120 days of activation. GIAC suggests booking the proctored appointment at least a month ahead; late cancellation, a no-show or an ID name mismatch at Pearson VUE costs a $175 seating fee.
2. Baseline (week 1): score yourself red, amber or green against all 15 objectives. Assembly, unpacking and anti-analysis are the common reds.
3. Prepare an isolated lab (weeks 1 to 2): agree with your security team how samples are obtained, stored and analysed, and keep the lab off production networks.
4. Study by group (weeks 2 to 9): work through course books or equivalent texts, foundations first, then documents, then code-level work, then evasion. Repeat every exercise until it is routine.
5. Build the index (alongside study): record API names, file structures, tool features, assembly instructions and concepts with book and page number. Write it yourself.
6. First practice exam (week 10): GIAC's practice exams simulate the real engine, never contain real exam questions and draw on a limited bank. Sit it under real conditions and log every slow item.
7. Close the gaps (weeks 11 to 12): repeat the slowest lab tasks against the clock and tighten the index.
8. Second practice exam and sit (weeks 13 to 14): sit the second practice exam about a week before the real one. For remote delivery, check ProctorU's technical requirements early; for Pearson VUE, bring two original, current IDs and arrive 15 minutes early.

If you fail: GIAC lists a retake at $899. The pages checked did not state a waiting period, so confirm the retake rules in your GIAC account.

Small vs large organisations: a small team may need one person who can triage samples safely more than a full reverse engineer, so weigh GREM against broader incident response credentials. Larger organisations with a dedicated threat intelligence or DFIR function get most value, as GREM skills feed signatures, hunting and incident scoping directly.

Measuring readiness

• Practice scores: both practice exams comfortably above 73%.
• Pace: the practice exam finished with at least 20 minutes to spare.
• Lab fluency: each exercise type repeatable from your notes within a time limit you set.
• Coverage: all 15 objectives amber or green, including the four evasion objectives.
• After certification: CPEs logged towards the 36 required, reviewed annually.

Common failure patterns

• Studying only from books: a CyberLive exam rewards practised hands, and reading alone leaves you slow.
• Avoiding assembly: most objectives depend on it; candidates who hope to pass on document and behavioural analysis fall short.
• Weak lab hygiene: practising on a connected or shared machine creates real risk for your organisation.
• Burning skips early: answered questions cannot be revisited and skips are limited.
• Letting the window lapse: 120 days passes quickly for a deep syllabus; an extension costs $479.
• Proctoring problems: late arrival, a name mismatch or late cancellation each trigger the $175 fee.

Cost, renewal and continuing education

CPE categories and caps

All CPEs must be earned within the four years in which the certification is active. If it has already expired, GIAC asks holders to contact it about options. Training is priced separately by SANS and is usually the larger cost.

Where it fits on the career path

GREM is a specialist credential, usually taken after several years in incident response, forensics or threat intelligence.

• Before it: a broad credential such as the GIAC GSEC Guide, then incident handling (see the GIAC GCIH Guide).
• Alongside it: forensics (see the GIAC GCFA Guide); many DFIR teams pair the two.
• Roles: see the DFIR Analyst Career Guide, the Threat Intelligence Analyst Career Guide and the Detection Engineering Guide.

GIAC does not publish pass rates or salary figures on the pages checked, and we do not quote third-party estimates.

Practitioner checklist

• Confirm the current price, passing score and exam version in your GIAC account before activating.
• Book the proctored appointment at least a month ahead and inside the 120-day window.
• Map yourself against all 15 objectives and plan extra time for assembly and unpacking.
• Agree sample handling rules with your security team and keep any practice lab isolated.
• Write your own index with book and page references while you study.
• Sit both practice exams under real conditions and time every hands-on item.
• Check ID names, arrival time and cancellation rules for your delivery option.
• After passing, diarise the four-year expiry and log 36 CPEs within the category caps.

Standards and references

• GIAC: GIAC Reverse Engineering Malware (GREM)
• GIAC: Certification Pricing
• GIAC: Proctored Exams
• GIAC: Renewal Knowledge Base
• GIAC: Certification Renewal

Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Malware Guide · GIAC GCFA Guide · DFIR Analyst Career Guide · Blue Team Certifications Guide