Overview
GCIH shows that a practitioner can detect, respond to, and resolve computer security incidents, and understands the attack techniques, vectors, and tools involved. Its objectives cover the PICERL and DAIR incident handling processes, scanning and mapping, password attacks, web application and API attacks, SMB security, and post-exploitation activity. Newer objectives add LLM-related attacks and AI-assisted investigation. It's built for first responders. GIAC names incident handlers, team leads, system administrators, security practitioners, and security architects as its audience.
The exam is web-based and proctored, through ProctorU or at a Pearson VUE test centre, and uses GIAC's CyberLive format, with tasks in virtual machines using tools such as Nmap, Metasploit, and Netcat. SANS training is available, but GIAC doesn't require it. Compared with CompTIA CySA+, which gives more weight to vulnerability management and reporting, GCIH centres on how attacks work and how a handler responds to them. EC-Council's CEH also covers attacker tools, though from the tester's side. Renewal comes every 4 years.
What the exam covers
GIAC publishes 15 exam certification objectives and outcome statements for GCIH, without weights.
| Part |
|---|
| Attacking Passwords |
| Detecting Evasive and Post-Exploitation Techniques |
| Detecting Exploitation and Covert Communications Tools |
| Endpoint Attack and Pivoting |
| Exploiting Insecure Web Application References |
| Incident Response and Cyber Investigation |
| Integrating LLMs with Offensive Operations |
| Malware and AI Assisted Investigations |
| Network and Log Investigations |
| Scanning and Mapping |
| Securing Credentials and Data in the Cloud |
| SMB Security |
| Understanding Passwords |
| Web Application API Attacks |
| Web Application Injection Attacks |
Requirements
GIAC does not publish a required experience level for GCIH. It notes that practical work experience, SANS training, or college-level courses and self-study can help candidates reach the needed mastery.
- Format
- Web-based proctored exam that includes CyberLive hands-on questions using virtual machines and real security tools
- Questions
- 106
- Time
- 4 hours
- Passing score
- 69% (for exam versions released on or after May 10, 2025)
- Delivery
- Remote proctoring through ProctorU or onsite at Pearson VUE test centres
No training prerequisite. Candidates have 120 days from activation of the certification attempt to sit the exam, and practice tests are sold separately.
Cost
Exam fee: USD 999 (certification attempt). From GIAC's pricing page, checked 2026-10-12. Prices are in USD and exclude sales tax. A retake is USD 899, an attempt extension USD 479, and a practice exam USD 399. GIAC says it may change pricing at any time.
Keeping it current
- Cycle
- 4 years
- Continuing education
- 36 CPE credits per 4-year cycle, or renew by retaking the exam
- Fees
- USD 499 renewal fee per cycle (additional renewals within 2 years of a full-price renewal are USD 249)
How to verify that someone holds it
An employer searches the GIAC Certification Holder Directory by name or analyst ID, or checks the holder's Credly badge. Use the issuer’s verification page.
On InfoSecHub, a GCIH listed on a profile shows Verified by Credly only when a current Credly badge issued to that person confirms it.
Typical roles
- Incident handler
- Incident response team lead
- Security analyst
- System administrator
- Security architect
Related frameworks
Official resources
From GIAC. Links open the issuer’s site.
- GCIH official page, GIAC
- GIAC certification pricing and fees, GIAC
- How to renew a GIAC certification, GIAChandbook
- GIAC Certification Holder Directory, GIACverification
References
- GIAC Certified Incident Handler (GCIH), GIAC
- GIAC certification pricing and fees, GIAC
- How to renew, GIAC
- GIAC digital badges, GIAC
Reviewed 2026-10-12. Exam details, prices, and renewal rules change. Confirm them on the GIAC website before you register. InfoSecHub is not affiliated with GIAC.