The GCTI test is one proctored GIAC exam of 82 questions in 3 hours, and you need 71% to pass. Most of it checks reasoning, not recall: can you take scattered threat data, judge it without bias, and turn it into intelligence someone can act on?
That is why candidates who know every term still find GCTI awkward. The nine objectives GIAC lists read like a job description for an intelligence analyst, not a list of tools. This entry goes through what each objective asks you to do, how the nine fit the intelligence cycle, which ones cost the most points, one worked scenario, a five-week plan and the habits that make the test harder than it needs to be. Every exam figure here was read on GIAC's and SANS's own pages on 3 November 2026.
What is the GCTI test, in plain numbers?
GCTI stands for GIAC Cyber Threat Intelligence, a practitioner certification. The GIAC Cyber Threat Intelligence certification page gives the format:
- Questions: 82.
- Time: 3 hours.
- Passing score: 71%, for the exam version released on or after December 26, 2017.
- Delivery: web-based and always proctored, remotely through ProctorU or onsite at a Pearson VUE center.
- Window: 120 days from the day GIAC activates your attempt.
- Objectives: 9, with no published weight for any of them.
By my own arithmetic, 180 minutes over 82 questions is about 2.2 minutes each. And 71% of 82 is 58.2, so you need about 59 correct answers and can miss about 23. That assumes every question counts the same, which GIAC does not promise, so treat it as a sense of scale. GIAC also asks you to confirm the exact format and passing score for your own attempt in the Certification Information section of your GIAC account.
Two rules shape how you work through those 82 questions. You cannot go back to change an answer once you submit it, and you can skip only 10 to 15 questions, depending on the exam. Skipped questions come back at the end if time allows, and anything left unanswered is marked wrong.
The GCTI page also carries a section on CyberLive, GIAC's hands-on format with real virtual machines and tools. GIAC's page does not say how many GCTI items use it, so read the GIAC CyberLive overview and expect the possibility of working in a lab, not only picking options.
How do the 9 GCTI objectives fit the intelligence cycle?
GIAC lists the objectives alphabetically, which hides how they connect. They make more sense in the order an analyst works: set requirements, collect, analyze, then share. The grouping below is my own, built on how SANS maps its FOR578 course sections to the objectives.
- Foundations: Intelligence Fundamentals and Intelligence Application.
- Collection: Collecting and Storing Data Sets, Malware as a Collection Source, and Pivoting.
- Analysis: Kill Chain, Diamond Model, and Courses of Action Matrix, plus Analysis of Intelligence.
- Output: Campaigns and Attribution, and Sharing Intelligence.
The official course for the exam is SANS FOR578, a six-day course worth 36 CPEs. The SANS FOR578 Cyber Threat Intelligence course page states which of its five sections build which objectives. Section 2 on intrusion analysis lines up with the Kill Chain objective, Section 3 on collection sources covers three collection objectives, and Section 4 covers analysis, including structured analytic techniques and cognitive bias.
What does each GCTI objective ask you to do?
Here is each objective in GIAC's words, cut down to the task it describes. The verbs matter more than the nouns.
- Intelligence Fundamentals: know the core definitions and concepts, and have a working knowledge of the data sources analysts use, such as network indicators, log repositories and forensics tools.
- Intelligence Application: apply gathering, analysis and use of intelligence in practice, and explain how well-known cyber attacks still inform intelligence work today.
- Collecting and Storing Data Sets: collect and store data from threat feeds, domains, TLS certificates and internal sources.
- Malware as a Collection Source: use malware analysis tools and techniques to pull intelligence out of a sample.
- Pivoting: expand what you know from one indicator, using pivot analysis, link analysis tools and domain analysis.
- Kill Chain, Diamond Model, and Courses of Action Matrix: use the three models together to analyze an intrusion.
- Analysis of Intelligence: apply analysis techniques, and recognize and avoid fallacies and bias.
- Campaigns and Attribution: group intrusion characteristics and outside intelligence into campaigns, and weigh the factors behind an attribution.
- Sharing Intelligence: store and share intelligence, and report tactical findings to executives through accurate reports and assessments.
Notice how few of these say "know". Most say use, apply, expand, group or report. A question built on those verbs gives you a situation and asks for the next sound step.
Which GCTI objectives cost candidates the most points?
GIAC publishes no weights and no score data, so this is my reading of the objectives, not a statistic. Three areas tend to be underprepared, for different reasons.
Analysis of Intelligence feels soft until a question puts two reasonable conclusions side by side and asks which one an unbiased analyst would reach. Candidates from technical roles often skip the material on bias and structured techniques because it looks like theory. On the test, it is the theory that tells you which answer is defensible.
Campaigns and Attribution asks for restraint. The trap is treating one overlapping indicator, such as a shared IP address, as proof that two intrusions belong to the same actor. Attribution in the course rests on several factors at once, and the right answer is often the more cautious one.
Pivoting is practical and easy to underrate. Knowing that you can pivot from a domain to its registration data or from a TLS certificate to other hosts is not the same as knowing which pivot is worth taking and when the trail has gone cold.
The Kill Chain, Diamond Model and Courses of Action Matrix objective is usually better prepared, because the models are well known. The catch is the word "together": expect to move from one model to another within a single scenario.
What does a GCTI-style reasoning problem look like?
Here is a scenario written in my own words to show the kind of thinking the objectives describe. It is not taken from any exam.
A phishing e-mail delivered a document that dropped a small loader. The loader called out to a domain registered six weeks ago. Searching your stored certificate data, you find the same TLS certificate on two other domains, and one of them appeared in a public report about a known group. A colleague wants to name that group in the executive summary.
A careful analyst would work like this:
- Collection and pivoting: the shared certificate is a good pivot, so record all three domains and their hosting data as linked indicators.
- Analysis: one shared certificate links infrastructure, not people. Certificates can be reused, sold or copied, so it is not enough on its own.
- Models: place what you know on the Diamond Model. You have infrastructure and a capability (the loader), but little on the adversary, so that vertex stays weak.
- Attribution: state the overlap with the public report as a lead with low confidence, and list what further evidence would raise it.
- Sharing: the executive summary says what happened, what was blocked, and that the possible link to a known group is unconfirmed.
The reasoning that wins points here is the same throughout: separate what the data shows from what it suggests, and say how sure you are.
Is there a GCTI demo exam?
No. On the GIAC certification pricing page, the GCTI row lists demo questions as N/A. What GIAC does sell for GCTI is a practice exam at $399. GIAC describes its practice exams as a simulation of the real test engine and style, says the bank is limited so questions can repeat, and states that they never include real exam questions.
The same page gives the other GCTI costs: $999 for the certification attempt, $899 for a retake, $479 for an attempt extension and $499 for renewal. A missed proctored appointment costs a $175 reseating fee and comes with a 7-day extension. Prices are in US dollars, so check the page again on the day you buy.
How should you spend five weeks before the GCTI test?
GIAC's practitioner exam preparation guidance says certification holders report studying 55 or more hours on average and taking at least one practice exam, and it suggests four months from training to exam. The plan below is a five-week finishing block for someone who has already done the course or similar work, at roughly 11 to 12 hours a week.
- Week 1, foundations: reread the material on definitions, requirements and the data sources named in Intelligence Fundamentals. Start your index with one color per objective.
- Week 2, collection and pivoting: work through threat feeds, domain and TLS certificate data, and malware as a source. Write down each pivot type with an example of when it pays off.
- Week 3, intrusion models: take two public incident write-ups and map each onto the Kill Chain, the Diamond Model and a Courses of Action Matrix. Doing it by hand fixes the models better than reading.
- Week 4, analysis and attribution: study structured analytic techniques and the common biases. For each, write one line on how it would show up in an intrusion report. Then take your first practice exam and note the weak objectives in its report.
- Week 5, sharing and repair: cover reporting to executives, then return to the two weakest objectives from your practice report. Finish the index, and take a second practice exam only if you have one.
The index matters on an open-book test with about 2.2 minutes per question. GIAC allows printed books and notes, but no files on any computer, so anything you cannot find in your paper index in under a minute is, in practice, not there.
What mistakes make the GCTI test harder than it is?
- Studying tools instead of judgment. Tools appear, but the objectives are mostly about deciding what the data supports.
- Skipping the bias material. It is short, it looks optional, and it decides close questions.
- Burning skips early. With only 10 to 15 skips and no going back, save them for questions that genuinely need a later look.
- Over-attributing. If an answer names an actor on thin evidence, it is often the trap.
- An index sorted only by page. Add entries by concept and by model, so a scenario question leads you to the right page.
- Ignoring the CyberLive note. GIAC lists CyberLive on the GCTI page, so be ready to work in a lab environment, not only to choose options.
GCTI is mainly a reasoning exam. If you are weighing it against a GIAC exam that is mostly about reading code, my earlier entry on what makes the GREM malware exam hard sets out that other kind of difficulty.
Is there a short video on threat intelligence certification?
EduSum's YouTube channel has no GCTI video yet. This one-minute short covers a related threat intelligence certification, CREST's Practitioner Threat Intelligence Analyst, and is a quick look at how such exams frame the analyst's job.
Frequently asked questions
1. How many questions are on the GCTI test?
The GCTI test has 82 questions in one proctored exam of 3 hours, according to GIAC's certification page.
2. What is the GCTI passing score?
The minimum passing score is 71%, set by GIAC for the exam version released on or after December 26, 2017. Check your own attempt in the Certification Information section of your GIAC account.
3. Is the GCTI test open book?
Yes. GIAC allows printed books and notes, including your own index, but no electronic files, phones or other devices during the exam.
4. Does GIAC offer demo questions for GCTI?
No. GIAC's pricing page lists demo questions as N/A for GCTI. A GCTI practice exam is available for $399, and its questions never come from the real exam.
5. Which course prepares you for the GCTI test?
SANS FOR578: Cyber Threat Intelligence is the course aligned with GCTI. SANS lists it as six days and 36 CPEs and maps its five sections to the GCTI objectives.