GREM certification: exam, cost, passing score and training

What is the GREM certification?

GREM — GIAC Reverse Engineering Malware — certifies that you can analyse malicious software: take a sample apart, understand what it does, and get past the tricks malware uses to resist analysis. GIAC links the certification to SANS training, but lists no prerequisites.

GIAC names four areas: malware analysis using code and behavioural analysis fundamentals, Windows assembly concepts for reverse engineering, in-depth analysis of malicious executables and self-defending malware, and analysis of malicious document files, .NET programs and protected executables.

The audience GIAC lists includes forensic investigators and security practitioners, people who have dealt with malware incidents, security consultants and managers, system and network administrators, auditors, and technologists who want to formalise or expand their expertise.

Source: GIAC — GREM certification. Checked 10 October 2026.

How much does the GREM certification cost?

GIAC lists a GREM certification attempt at US$999. A retake costs US$899, an attempt extension US$479 and an official practice exam US$399. Renewal is US$499.

Two smaller costs are worth knowing in advance. If you miss a proctored exam appointment, GIAC charges a US$175 reseating fee, which comes with a seven-day extension of your deadline. And a stand-alone attempt has to be used within 120 days of activation, so do not activate it until you are ready to schedule.

Training is a separate purchase. The SANS course that GIAC links from the GREM page is listed separately with its own price (see the training section below).

Source: GIAC — Pricing. Checked 10 October 2026.

GREM exam format

The GREM exam is one proctored exam with 66 questions and a three-hour limit, so you have close to three minutes per question. All GIAC certification exams are web-based and must be proctored.

GIAC offers two proctoring options: remotely through ProctorU, or on site at a Pearson VUE testing center. Test-center appointments are booked through your SANS/GIAC account on a first-come, first-served basis, and GIAC suggests booking at least a month ahead.

The GREM page carries GIAC’s CyberLive label, the hands-on format that uses virtual machines, real tools and actual code in place of traditional multiple-choice items. GIAC does not say on the page how many GREM questions are hands-on, so prepare for both styles.

Source: GIAC — GREM certification. Checked 10 October 2026.

Is the GREM exam open book?

Yes. GIAC exams are open book: you may bring an armful of hardcopy books and notes into the testing area, including course books and your own printed or handwritten notes with an index. Workspace is limited, so a well-built index is worth more than a stack of paper.

They are not open internet or open computer. You cannot open PDFs or other electronic files, use extra devices, or bring printed material that looks like practice-test or exam questions and answers.

Source: GIAC — Proctor Program Overview. Checked 10 October 2026.

GREM passing score

The GREM passing score is 73% for all candidates who receive an exam version released on or after 27 August 2022. On 66 questions that is roughly 49 correct answers, though GIAC states the threshold as a percentage, not a count.

GIAC notes that it periodically reviews and may update certification specifications, so check the GREM page again shortly before your exam.

Source: GIAC — GREM certification. Checked 10 October 2026.

What is on the GREM exam?

GIAC publishes 15 exam certification objectives for GREM. They range from fundamentals — static and behavioural analysis — to the hard parts of the job: unpacking packed malware, bypassing anti-analysis techniques and reading functions in assembly. Malicious documents (Office macros, PDFs, RTF files) and .NET malware each get their own objective.

• Analyzing Malicious Office Macros
• Analyzing Malicious PDFs
• Analyzing Malicious RTF Files
• Analyzing Obfuscated Malware
• Behavioral Analysis Fundamentals
• Common Malware Patterns
• Core Reverse Engineering Concepts
• Examining .NET Malware
• Identifying and Bypassing Anti-Analysis Techniques
• Malware Analysis Fundamentals
• Malware Flow Control and Structures
• Overcoming Misdirection Techniques
• Reversing Functions in Assembly
• Static Analysis Fundamentals
• Unpacking and Debugging Packed Malware

Source: GIAC — GREM certification. Checked 10 October 2026.

GREM training course

GIAC lists no prerequisites for GREM, but it links the certification to SANS training available live and OnDemand. The SANS course for GREM is FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques. SANS lists it as six days instructor-led or 36 hours self-paced, worth 36 CPEs.

SANS lists the OnDemand version at US$8,780, excluding local taxes; live and in-person dates are priced in local currency. GIAC’s open-book rules allow course materials and training books in printed form, so course books can come with you into the exam.

Source: SANS — FOR610 course. Checked 10 October 2026.

GREM practice exams and dumps

GIAC sells official practice exams for US$399 each. They simulate the real exam, but GIAC states that practice exams never include actual exam questions, and because the practice question bank is limited, questions can repeat between attempts.

Stay away from “GREM dumps”. GIAC’s Exam Integrity Policy treats any use of exam dump sites containing actual or possible GIAC questions as a violation, with sanctions up to revocation of previously issued GIAC certifications, bans from future GIAC certifications and legal action.

Source: GIAC — Exam Integrity Policy. Checked 10 October 2026.

How long is the GREM certification valid?

GIAC certifications run on a four-year cycle: you collect 36 credits over four years to keep the certification active. The renewal fee listed for GREM is US$499.

Source: GIAC — Renewal. Checked 10 October 2026.

GREM practice questions

Certsqill’s GREM practice questions are expert-developed, with an explanation for every answer option, and your readiness score is shown per area, so you can see whether assembly, unpacking or document analysis is holding you back.

GREM questions people ask

How many questions are on the GREM exam?

66 questions in one proctored exam. Source: GIAC GREM page, checked 10 October 2026.

How long is the GREM exam?

3 hours. Source: GIAC GREM page, checked 10 October 2026.

What is the GREM passing score?

73% for exam versions released on or after 27 August 2022. Source: GIAC GREM page, checked 10 October 2026.

How much does the GREM cert cost?

A certification attempt is US$999; a retake US$899; a practice exam US$399. Source: GIAC Pricing, checked 10 October 2026.

Can I take the GREM exam online?

Yes. GIAC offers remote proctoring through ProctorU as well as Pearson VUE test centers. Source: GIAC Proctor Program Overview, checked 10 October 2026.

Is the GREM exam open book?

Yes, for printed books and notes. It is not open internet or open computer. Source: GIAC Proctor Program Overview, checked 10 October 2026.

Which SANS course prepares for GREM?

FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques. GIAC lists no prerequisites, so it is not mandatory. Source: SANS FOR610 page, checked 10 October 2026.

How do I renew the GREM certification?

Collect 36 credits over four years and pay the renewal fee, listed at US$499. Source: GIAC Renewal and Pricing, checked 10 October 2026.