GCTI certification: exam format, cost and passing score

What is the GCTI certification?

The GIAC Cyber Threat Intelligence (GCTI) certification validates a practitioner’s strategic, operational and tactical cyber threat intelligence knowledge and skills. It is issued by GIAC.

GIAC lists the people it is meant for: incident response team members, threat hunters, Security Operations Center personnel, information security practitioners, experienced digital forensic analysts, and federal agents and law enforcement officials.

In short, GCTI is for people who turn raw intrusion data, malware and open-source information into intelligence that others can act on — and who need to show they can do that with structured analysis models rather than intuition.

Source: GIAC — GCTI certification. Checked 10 October 2026.

How much does the GCTI certification cost?

GIAC’s price list gives US$999 for a GCTI certification attempt bought on its own. A retake costs US$899, and extending an attempt costs US$479. A GIAC practice exam costs US$399; GIAC lists no demo questions for GCTI.

Two smaller fees are worth knowing. A missed proctored exam appointment incurs a US$175 reseating fee and comes with a seven-day extension from the current deadline. Renewal costs US$499, and additional renewals within two years of paying a full-price renewal cost US$249.

GIAC’s delivery policy also covers attempts bundled with training; those run for 120 days from the end of the event or match the OnDemand course deadline. GIAC does not publish a bundle price on its pricing page.

Source: GIAC — Pricing. Checked 10 October 2026.

GCTI exam format: questions, time and delivery

GCTI is one proctored exam with 82 questions and a time limit of three hours. That is a little over two minutes per question — enough time to look things up, but not to read your way through the books for every item.

You can take it remotely through ProctorU or at a Pearson VUE testing center. A stand-alone certification attempt is active for 120 days from activation, and GIAC caps the total access period for any attempt, including extensions and retakes, at 570 days.

GIAC exams are open book: you may bring printed books, handwritten or printed notes and an index. They are not open internet or open computer, so nothing stored electronically can be used, and printed material that looks like practice test or exam questions is not allowed.

Source: GIAC — GCTI certification. Checked 10 October 2026.

GCTI passing score

GIAC publishes the passing score: 71%. It set that figure through a psychometric standard-setting study, and it applies to all candidates who receive an exam version released on or after 26 December 2017.

GIAC also notes that it periodically reviews and may update certification specifications, so check the GCTI page before your attempt to confirm the current figure.

Source: GIAC — GCTI certification. Checked 10 October 2026.

What is on the GCTI exam?

GIAC lists nine exam certification objectives. It does not publish a weighting for them, so treat them as equally important when you plan your study.

The list follows the intelligence cycle from fundamentals through collection, analysis and sharing, with the analytic models — kill chain, diamond model and courses of action matrix — as a named objective of their own. Expect questions that ask you to apply these models to a scenario rather than just define them.

• Intelligence Fundamentals
• Collecting and Storing Data Sets
• Malware as a Collection Source
• Pivoting
• Analysis of Intelligence
• Kill Chain, Diamond Model, and Courses of Action Matrix
• Campaigns and Attribution
• Intelligence Application
• Sharing Intelligence

Source: GIAC — GCTI certification. Checked 10 October 2026.

GCTI prerequisites

GIAC lists no prerequisites for GCTI. You do not need another GIAC certification or a SANS course to buy an attempt.

The audience list, though, makes clear what the exam assumes: familiarity with incident response, threat hunting or forensics. If you are coming to threat intelligence without that background, build it first — the objectives on malware as a collection source and pivoting assume you have seen real intrusion data.

Source: GIAC — GCTI certification. Checked 10 October 2026.

GCTI training course: SANS FOR578

GIAC says training is available in a variety of formats, including live training and OnDemand. The SANS course that maps to GCTI is FOR578: Cyber Threat Intelligence.

SANS lists FOR578 as six days instructor-led or 36 hours self-paced, worth 36 CPEs, with an OnDemand price of US$8,780. It has no formal prerequisites; SANS says it suits anyone with security training or prior experience in the field.

The course is optional for the exam. Whichever way you prepare, an open-book exam rewards well-organised printed notes and an index you built yourself.

Source: SANS Institute — FOR578: Cyber Threat Intelligence. Checked 10 October 2026.

GCTI practice test

GIAC sells official practice tests (US$399 each when bought separately). GIAC describes them as a simulation of the real exam that lets you get used to the test engine and gauge whether your preparation is sufficient.

Two caveats from GIAC itself: the bank of practice questions is limited, so you may see the same question on more than one practice test, and practice exams never include actual exam questions.

Exam dumps are not an alternative. GIAC’s Exam Integrity Policy names any use of or reference to exam dump sites containing actual or possible GIAC questions or answers as a violation, alongside copying or sharing exam content. Sanctions include revocation of previously issued GIAC certifications and bans from future GIAC certifications.

Source: GIAC — Exam Integrity Policy. Checked 10 October 2026.

How do you renew the GCTI certification?

GIAC certifications are kept active by collecting 36 credits over four years. The renewal fee for GCTI is US$499, or US$249 for additional renewals made within two years of paying a full-price renewal.

Four years sounds long, but 36 credits is a real commitment. Plan for them across the cycle rather than at the end, and check the GIAC renewal page for which activities count.

Source: GIAC — Renewal. Checked 10 October 2026.

GCTI practice questions

Certsqill’s GCTI practice questions come with an explanation for every option, and your readiness is shown per objective, so you can see which of the nine areas still need work before you spend US$999 on an attempt.

GCTI questions people ask

What is the GCTI certification?

GIAC Cyber Threat Intelligence, a GIAC certification that validates strategic, operational and tactical cyber threat intelligence knowledge and skills. Source: GIAC, checked 10 October 2026.

How much does the GCTI exam cost?

US$999 for a certification attempt, US$899 for a retake. Source: GIAC Pricing, checked 10 October 2026.

How many questions are on the GCTI exam?

82 questions in 3 hours. Source: GIAC GCTI page, checked 10 October 2026.

What is the GCTI passing score?

71%, for exam versions released on or after 26 December 2017. Source: GIAC GCTI page, checked 10 October 2026.

Is the GCTI exam open book?

Yes, with printed books, notes and an index. It is not open internet or open computer. Source: GIAC Proctor Program Overview, checked 10 October 2026.

Are there prerequisites for GCTI?

GIAC lists none. Source: GIAC GCTI page, checked 10 October 2026.

Which SANS course prepares for GCTI?

FOR578: Cyber Threat Intelligence — six days instructor-led or 36 hours self-paced. Source: SANS Institute, checked 10 October 2026.

Does GIAC offer a GCTI practice test?

Yes. GIAC sells practice exams for US$399 each; they simulate the real exam engine but never include actual exam questions. Source: GIAC, checked 10 October 2026.

How do I renew GCTI?

Collect 36 credits over four years and pay the renewal fee of US$499. Source: GIAC, checked 10 October 2026.