GCIH
GIAC Certified Incident Handler · GIAC
The GCIH proves you understand attackers’ techniques (reconnaissance, password attacks, web and cloud attacks, post-exploitation) and know how to detect, contain and investigate them. It is one of the most sought-after GIAC certifications for SOC, CERT and incident response teams, and it is ANAB-accredited and recognised by the US DoD. Its strength is that dual attacker and defender view; its limit is the high cost of the associated SANS course.
- Exam
- 106 questions in 4 h, pass mark 69%. Open book (paper only), with hands-on CyberLive questions in a virtual machine. Taken remotely (ProctorU) or in a Pearson VUE centre.
- Exam price
- $999Same price with or without SANS training. The associated SANS course (SEC504) costs about US$8,780.
- Required experience
- No formal prerequisite. In practice, candidates have a solid IT or security background and often take the SEC504 course.
- Validity and maintenance
- Valid 4 years. Renew with 36 CPE credits over the period and a US$499 fee (US$249 for each further renewal registered within two years of the first), or by passing the current exam again.
- Format
- Multiple choice and hands-on
- Recognition
- ISO/IEC 17024 accredited · DoD 8140 approved
Who is it for?
SOC analysts, incident responders, CERT and CSIRT members and system administrators who are on the front line when an incident occurs.
Domains covered
- Incident response and cyber investigation
- Network and log investigations
- Scanning, mapping and SMB security
- Password attacks and endpoint attacks
- Post-exploitation, pivoting and evasion detection
- Web application and API attacks, injection
- Cloud credentials and data
- Use of LLMs by attackers and AI-assisted investigation
Belinda’s take
Information checked on 2 October 2026 against the official site. Prices exclude tax and training, and may change.
The certification names mentioned are trademarks of their respective owners. KrakenShield is not affiliated with any certification body and does not reproduce any exam question.
