The GREM exam is one of the harder GIAC practitioner exams, and the difficulty is less about the numbers than about one skill: reading assembly. You get 66 questions in 3 hours and need 73% to pass, which is a fair pace. What decides the result is whether you can follow malware code in a disassembler and a debugger without stopping to look up every instruction.
This post breaks the difficulty into parts you can plan around: the format, the 13 objectives GIAC lists today, which of them take the longest to learn, a sample question written in the exam's style, a six-week plan and the mistakes that make GREM feel harder than it is. Every exam figure below was read on GIAC's and SANS's own pages on 31 October 2026.
How hard is the GREM exam, in plain numbers?
On paper, GREM looks like most GIAC practitioner exams. The GIAC Reverse Engineering Malware certification page lists the format:
- Questions: 66.
- Time: 3 hours.
- Passing score: 73%, for the exam version released on or after August 27, 2022.
- Delivery: web-based and always proctored, remotely through ProctorU or at a Pearson VUE test center.
- Window: 120 days from the day GIAC activates your attempt.
- Objectives: 13, with no published weight per objective.
By my own arithmetic, 180 minutes over 66 questions is about 2.7 minutes per question. And 73% of 66 is 48.2, so you need about 49 correct answers and can miss about 17. That assumes every question counts the same, which GIAC does not promise, so read it as a sense of scale only.
A 73% cut leaves little room for guessing on topics you skipped. GIAC also says to check the exact format and passing score for your own attempt in the Certification Information section of your GIAC account.
What makes GREM harder than most GIAC exams?
Three things, and none of them is the clock.
First, the core skill is slow to build. Most security exams test whether you know a concept. GREM tests whether you can read what a sample does at the instruction level: how a function takes its parameters, where a loop ends, which API call injects code into another process. You can understand those ideas in an afternoon and still need weeks of practice before you read them quickly.
Second, the open book helps less than people expect. GIAC exams are open book, with printed material only. A good index finds you the page on process hollowing in seconds. It does not read a block of disassembly for you. Candidates who plan to "look it up" on the code questions run short of time.
Third, part of the exam is hands-on. The GREM page carries GIAC's CyberLive hands-on testing format, where questions run in virtual machines with real tools and real code instead of asking you to pick an answer from a list. The page does not say how many CyberLive questions a GREM attempt has, so treat it as a reason to practise in a lab, not only on paper.
There is also a fourth, newer factor: the objective list itself changed. On 16 October 2026 GIAC's page listed 15 GREM objectives. Today it lists 13, with new names. Office macros and RTF files no longer have their own lines, and "Analyzing Script-Based Malware" (JavaScript and PowerShell) is new. If you are working from an older study guide, map it to the current list before you plan.
Which of the 13 GREM objectives are the hardest?
The hardest are the ones that need fluent assembly reading. That grouping is my own study judgement, not GIAC's. GIAC publishes no weights or difficulty ratings.
Group 1: lab and triage skills (start here). Malware Analysis Basics, Initial Static Analysis and Interactive Behavioral Analysis. These are about setting up a safe lab, reading a sample's static properties and watching what it does to files, the registry and the network. Most people with incident-response experience find these the easiest.
Group 2: files that are not plain executables. Analyzing Malicious Documents (PDFs and embedded scripts), Analyzing Script-Based Malware (JavaScript and PowerShell) and Analyzing .NET Malware. The work here is mostly deobfuscation and decompiling. It is detailed, but you can usually see readable code once you peel the layers off.
Group 3: heavy assembly reading (the hard core). Core Reversing Concepts, Function Essentials, Malware Flow Control, API Patterns in Malware, Debugging and Unpacking Malware, Bypassing Anti-Analysis Techniques and Handling Misdirection Techniques. Seven of the 13 objectives sit here. They all assume you can follow code in a disassembler, step through it in a debugger, and notice when the sample is trying to stop you from doing either.
So more than half the objective list depends on one skill. That is the real answer to how hard GREM is: it is as hard as your assembly reading is slow.
Do you need programming or assembly experience before GREM?
You need comfort with basic programming ideas, not a programming job. The SANS FOR610 reverse-engineering malware course is the training GIAC pairs with GREM. Its listed prerequisites are familiarity with Windows and Linux and an understanding of variables, loops and functions, "though prior programming experience is not required."
FOR610 has recently been reworked. Its page now carries the title "Reverse-Engineering Malware: Malware Analysis in the Age of AI" and runs 6 days live or 36 hours self-paced, with 36 CPEs. AI agents are part of the labs, and the course stresses checking their findings against your own analysis. It still teaches the same base skills the exam rests on: x64dbg for debugging, Ghidra for disassembly, and both 32-bit and 64-bit code.
If you skip the course, plan extra weeks for assembly. Learn the common instructions, how the stack works, how a function call passes arguments, and how a conditional jump changes the flow. That is the floor the Group 3 objectives stand on.
What does a GREM-style question look like?
Here is an example I wrote in the exam's style. It is not a real or recalled exam question.
*In a disassembler you see a loop. A register starts at 0 and is used as an index into a buffer. On each pass, the byte at that index is XORed with the constant 0x5A and written back to the same place. The index then goes up by one, and a compare-and-jump sends execution back to the top of the loop while the index is below 0x40. What is this code most likely doing?*
- Copying 64 bytes from one buffer to another.
- Decoding a 64-byte block in place with a single-byte XOR key.
- Computing a checksum over the first 0x5A bytes.
- Clearing a buffer to zero.
The answer is 2. Writing back to the same place means the data is changed in place, not copied. The XOR with one fixed byte is a common way to hide strings or configuration, and 0x40 is 64 in decimal, so the loop runs 64 times. Option 4 would need XOR with the byte itself, not a constant.
The skill being tested is spotting the pattern in the time it takes to read the loop once. If you have to translate each instruction, 2.7 minutes goes fast.
How many hours should you plan, and in what order?
Plan for more than the GIAC average. GIAC's practitioner exam preparation advice reports 55+ average hours studied and at least one practice exam among certification holders. For GREM, budget closer to 60 to 90 hours over six weeks if assembly is not part of your daily work.
- Week 1, lab and basics. Build a safe lab with Windows and Linux virtual machines. Cover Malware Analysis Basics and Initial Static Analysis. Start your index with one color per objective group.
- Week 2, behavior. Interactive Behavioral Analysis: watch file, registry, process and network activity, and write down what each tool shows you.
- Week 3, assembly foundations. Core Reversing Concepts, Function Essentials and Malware Flow Control. Read short functions every day until loops and calls look familiar.
- Week 4, malware patterns. API Patterns in Malware: the API calls behind code injection and process hollowing. Then take your first practice test under real timing.
- Week 5, protected code. Debugging and Unpacking Malware, Bypassing Anti-Analysis Techniques and Handling Misdirection Techniques. Fix the weak objectives the practice report showed.
- Week 6, documents, scripts and .NET, then review. Analyzing Malicious Documents, Analyzing Script-Based Malware and Analyzing .NET Malware. Finish the index, then take a second practice test only when you feel ready.
The order puts assembly in weeks 3 to 5 on purpose. It is the slowest skill to build, so it gets the middle of the plan, not the last week.
Which mistakes make GREM feel harder than it is?
Many of these are planning mistakes rather than gaps in knowledge.
- Leaving assembly until the end. It needs repetition over weeks. Cramming it in the last week does not work.
- Indexing tool names instead of patterns. An index entry for "process hollowing: the API sequence and what each call does" is worth more than a list of tool menus.
- Studying an old objective list. GREM's list changed in October 2026. Check your plan against the current 13 objectives.
- Only reading, never running. CyberLive questions put you in a lab. Practise in a lab too.
- Burning both practice tests early. GIAC's practice question bank is limited and questions can repeat, so a second test taken too soon tells you less.
What does the GREM exam cost if you need a second try?
The GIAC certification pricing table lists GREM at $999 for a certification attempt and $899 for a retake. An attempt extension is $479, renewal is $499 and a practice exam is $399. Prices are in US dollars and exclude sales tax.
That retake price is the best argument for a slower plan. One extra week of assembly practice costs far less than a second attempt.
Is there a video to go with this?
The EduSum YouTube channel has no GREM video yet. The closest is its video on another GIAC exam, GCCC. It is not about malware analysis, but GIAC exams share the same registration, open-book rules, proctoring and practice-test process, which the video covers.
Frequently asked questions
1. Is the GREM exam harder than other GIAC exams?
For many candidates, yes. It has 66 questions in 3 hours and a 73% passing score, and seven of its 13 objectives depend on reading assembly code in a disassembler or debugger, which takes weeks of practice to do quickly.
2. How many questions are on the GREM exam and what score do you need?
GIAC lists 66 questions, 3 hours and a minimum passing score of 73% for the exam version released on or after August 27, 2022. Confirm the format for your own attempt in your GIAC account.
3. Do I need to know assembly language for GREM?
Yes, at a reading level. You do not write assembly, but you must follow functions, loops, conditional jumps and API calls in malware code. SANS lists basic programming concepts as a prerequisite for FOR610 and says prior programming experience is not required.
4. How long should I study for the GREM exam?
GIAC reports 55+ average study hours across its practitioner exams. For GREM, plan 60 to 90 hours over about six weeks if assembly is new to you, with a practice test in week four.
5. Did the GREM exam objectives change in 2026?
Yes. In October 2026 GIAC's GREM page went from 15 objectives to 13 with new names, adding Analyzing Script-Based Malware and folding document types into Analyzing Malicious Documents. The 66 questions, 3 hours and 73% passing score did not change.
The short version: GREM is hard in one specific way. Put your study hours where the difficulty is, and the rest of the exam becomes manageable.