GREM — GIAC Reverse Engineering Malware
GIAC's malware reverse-engineering credential, covering static and dynamic analysis of malicious code, paired with the six-day SANS FOR610 course.
Type: CertificationWorking practitioners
Offered by GIAC (Global Information Assurance Certification)
The facts
- Cost
- $999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR610 course is listed separately at $8,780.Figure read 2026-09-12 from www.giac.org/pricing
- Prerequisites
- None published, but the material assumes comfort with assembly, debuggers and Windows internals — this is not an entry-level certification in practice.
- Format
- One proctored exam. 66 questions, 3 hours, 73% to pass. GIAC classifies it as a practitioner certification using CyberLive, which its page describes as replacing traditional multiple-choice testing with performance-based challenges.
- Length
- Exam only. The paired FOR610 course is six days instructor-led or about 36 hours self-paced.
- Renewal
- Four-year cycle. 36 CPE credits plus a $499 renewal fee; additional renewals within two years of a full-price renewal are $249.
- Accreditation
- GIAC states it is an active accredited ISO/IEC 17024 personnel certification body through ANAB.
- Who it suits
- A malware analyst or senior incident responder who already reads disassembly and wants the credential to match the work.
- Audience
- Working practitioners
Strengths
- One of very few accredited credentials that tests malware analysis as a practical skill rather than as background knowledge.
- The 73% pass mark is the highest of the GIAC forensics family, and the CyberLive format means it is genuinely hard to pass by cramming.
- Directly relevant to ransomware and business-email-compromise work, which is where a large share of current incident-response spend goes.
Limitations
- The steepest prerequisite knowledge of the GIAC forensics set despite no formal prerequisite — attempting it without assembly-level fluency wastes the fee.
- About $9,800 at list price with the course.
- Reverse engineering is a specialism most forensic examiners never need; for a generalist caseload the same money buys far more useful coverage elsewhere.
- Recurring $499 renewal every four years.
Sources
Costs, prerequisites and exam formats in this field change often, and several providers price by region, cohort or employer agreement. Every figure on this page carries the date it was read and a link to the page it was read from. Confirm current terms with the provider before you spend anything.