Three changes define GIAC testing in 2026. Many practitioner exams end with CyberLive tasks in real virtual machines, a separate family of Applied Knowledge exams is hands-on from start to finish, and the GSE was rebuilt around both in 2023. The open-book, multiple-choice practitioner exam is still the core, and there was no wholesale switch to scenario-based exams in 2024.
Three kinds of GIAC exam
| Practitioner certifications | Applied Knowledge certifications | |
|---|---|---|
| Examples | GSEC, GCIH, GPEN | GX-CS, GX-IA, GX-IH, GX-PT, GX-FA, GX-FE |
| Length | 2 to 5 hours, depending on the exam | 4 hours |
| Question style | Multiple choice, with CyberLive tasks at the end on many exams | 100% CyberLive |
| Pass mark published | Yes, per exam version | No |
| Attempt price | $999 for most | $1,299, or $499 with the matching practitioner certification |
The third kind is smaller. GIAC's micro-credentials, such as the AWS Secure Builder, are "shorter and more targeted than certifications" and each covers one focused area, from secure cloud configuration to using AI for defense.
Practitioner exams are web-based and proctored. You can bring an armful of printed books, notes and your own index, but nothing electronic. You can't go back to an answered question; instead you get 10 to 15 skips and a 15-minute break.
What a CyberLive task is
CyberLive puts you in front of a real virtual machine, not a simulation, with real tools and help utilities such as man pages. GIAC describes the systems as ones you can "install, attack, defend, and run services" on, and the tasks ask you to do the work there. On practitioner exams the tasks come at the end, and GIAC says it has set the exam timing to allow for them. How much they count "varies by GIAC examination", but the FAQ is blunt: candidates who can't answer a majority of the CyberLive items correctly shouldn't expect to pass. Practice tests include CyberLive content whenever the exam does.
That changes how you study for exams like GCIA or GCFA. A good index gets you through the multiple-choice section. The lab section rewards hours spent running the tools, because looking up every command in a printed index is slow once the clock is running.
Applied Knowledge exams and the new GSE
The Applied Knowledge, or GX, exams are the format change most worth knowing about. Each is four hours of CyberLive with no multiple-choice section, and GIAC says preparation "is not directly linked to a specific affiliate training course". It names a primary-fit SANS course for each but warns that the course isn't enough on its own and that work experience matters. If you hold the matching practitioner certification, the attempt drops from $1,299 to $499: GX-CS with GSEC, GX-FA with GCFA, GX-FE with GCFE.
These exams now make up GIAC's top tier. In a post dated May 31, 2023, GIAC described the old GSE: a four-part, 15-hour in-person lab, limited to 30 people twice a year, behind an entrance exam. The new GSE replaced that with Applied Knowledge exams taken remotely and dropped the entrance exam. Today it needs any six practitioner certifications and any four Applied Knowledge certifications. A new middle step, the GIAC Security Professional (GSP), needs three and two.
What's new in 2026
The format is spreading to new subjects. GIAC says its AI-focused certifications, GOAA, GAIPS and GASAE, are built with CyberLive, and another is due later in 2026. GASAE, for example, is 82 questions in three hours with a 70% pass mark.
Pass marks belong to exam versions. GIAC's pages say it sets each one through a "psychometric standard-setting study", and two version notes appeared this spring: GSEC at 72% from April 6, 2026, down from 73%, and GASAE at 70% from April 10. The GSEC version change covers the first. GIAC's proctoring page treats the Certification Attempts section of your account as the only reliable source for your version, question types and pass mark. Check it when your attempt activates, not just the public page.
On delivery, you can test remotely through ProctorU or at a Pearson VUE center, though GIAC warns both may not be available for every attempt. If you live within 60 miles of a Pearson VUE center, GIAC expects you to use it. Missing an appointment, or arriving more than 15 minutes late and being refused admission, incurs a $175 seating fee to rebook.
Sources
- GIAC CyberLive: real virtual machines, man pages, end-of-exam delivery, timing, scoring varies by exam, majority warning, practice tests, checked October 2026
- GIAC Applied Knowledge Certifications: 100% CyberLive, six GX exams, primary-fit course guidance, AI certifications built in CyberLive, checked October 2026
- GIAC Portfolio Certifications: GSP and GSE requirements, checked October 2026
- Meet the New GSE (GIAC, May 31, 2023): old 15-hour lab, 30 candidates twice a year, entrance exam dropped, remote Applied Knowledge exams, checked October 2026
- GIAC proctor program overview: web-based exams, 2 to 5 hour and 4 hour lengths, open-book rules, skips and break, account as source of version, ProctorU and Pearson VUE, 60-mile rule, $175 seating fee, checked October 2026
- GIAC pricing and fees: $999 practitioner attempts, $1,299 and $499 Applied Knowledge attempts, checked October 2026
- GIAC Micro-Credentials: description and AWS Secure Builder example, checked October 2026
- GIAC AI Security Automation Engineer (GASAE): 82 questions, 3 hours, 70% from April 10, 2026, CyberLive, checked October 2026
- GIAC Security Essentials (GSEC): 72% pass mark from April 6, 2026, checked October 2026