GCTI — GIAC Cyber Threat Intelligence
GIAC's threat-intelligence credential, covering analytic tradecraft, attribution reasoning and intelligence reporting, paired with the six-day SANS FOR578 course.
Type: CertificationWorking practitioners
Offered by GIAC (Global Information Assurance Certification)
The facts
- Cost
- $999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR578 course is listed separately at $8,780.Figure read 2026-09-12 from www.giac.org/pricing
- Prerequisites
- None published.
- Format
- One proctored exam. 82 questions, 3 hours, 71% to pass, in GIAC's CyberLive performance-based format.
- Length
- Exam only. The paired FOR578 course is six days instructor-led or about 36 hours self-paced.
- Renewal
- Four-year cycle. 36 CPE credits plus a $499 renewal fee; additional renewals within two years of a full-price renewal are $249.
- Accreditation
- GIAC states it is an active accredited ISO/IEC 17024 personnel certification body through ANAB. The GCTI page also displays DoD 8140 alignment.
- Who it suits
- An analyst moving from investigation into intelligence, or a DFIR practitioner who wants the attribution and reporting side done rigorously.
- Audience
- Working practitioners
Strengths
- Teaches analytic discipline — hypothesis testing, confidence language, source evaluation — which transfers directly to writing a defensible forensic opinion.
- Unusually strong on the reasoning side of the work rather than the tooling, so it ages more slowly than tool-specific training.
- Same ANAB/ISO 17024 accreditation as the rest of the GIAC family.
Limitations
- It is not a digital forensics certification. Listing it as one, as some directories do, misleads readers: it certifies intelligence analysis, which is adjacent work.
- About $9,800 at list price with the course.
- Threat-intelligence roles are concentrated in a small number of large organisations, so the hiring market for it is much narrower than for GCFA or GCFE.
- Recurring $499 renewal every four years.
Sources
Costs, prerequisites and exam formats in this field change often, and several providers price by region, cohort or employer agreement. Every figure on this page carries the date it was read and a link to the page it was read from. Confirm current terms with the provider before you spend anything.