GIAC Certified Enterprise Defender Certification (GCED)

Cyber Defense Certification Overview

Validates knowledge of defensive network infrastructure, packet analysis, penetration testing, incident handling, and malware removal for enterprise defenders.

Explore SEC501 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GCED Certification?

The GIAC Certified Enterprise Defender (GCED) certification validates a practitioner's knowledge and abilities in the areas of defensive network infrastructure, packet analysis, penetration testing, incident handling, and malware removal. It builds on the security skills measured by the GIAC Security Essentials certification and covers the more advanced technical skills needed to defend the enterprise environment and protect an organization as a whole.

By the numbers

3 hrs

Exam duration

115

Questions

69%

Min. passing score

What GCED Covers

The 12 published exam objectives group into five practical domains.

Records and Visibility

Evidence Collection and Visibility, Identity and Infrastructure Records, and Engineered Telemetry through Defensive Controls cover the integrity of logs and baselines, identity and network records, and controls that improve detection.

Detection and Traffic Analysis

Enterprise Security Operations and Network Traffic Analysis and Investigation cover SOC detection workflows, log interpretation, packet and flow analysis, and tuning network intrusion detection and prevention systems.

Attack Surface and Hardening

Attack Surface Management, Configuration Management and Automation Workflows, and Identity and Infrastructure Hardening cover exposure assessment, configuration drift, and controls that limit attacker movement.

Incident Response

Incident Investigation and Analysis and Incident Containment and Recovery cover scoping an incident from host-based artifacts and threat intelligence, then working through containment, eradication, and recovery.

Malware Analysis and Triage

Malware Identification and Triage and Malware Analysis and Defensive Controls cover early triage, static and dynamic analysis, and applying findings to detection and defensive controls.

Prepare With This Course

SEC501: Applied Cyber Defense

Course Details

How SEC501 Prepares You for GCED

SEC501 is built around the exam objectives that make up the GCED certification:

Section 1, Seeing Like a Defender builds skills tested under Evidence Collection and Visibility, Identity and Infrastructure Records, and Engineered Telemetry through Defensive Controls.
Section 2, Detecting Like a Defender aligns with Enterprise Security Operations and Network Traffic Analysis and Investigation.
Section 3, Hardening Like a Defender aligns with Attack Surface Management, Configuration Management and Automation Workflows, and Identity and Infrastructure Hardening.
Section 4, Responding Like a Defender builds skills tested under Incident Investigation and Analysis and Incident Containment and Recovery.
Section 5, Understanding Malware Like a Defender aligns with Malware Identification and Triage and Malware Analysis and Defensive Controls.
Section 6, Operating Like a Defender is a Capture the Flag capstone that draws on all five technical sections.

Across the course, 26 hands-on labs and a Capture the Flag capstone challenge give you the chance to apply each skill in lab virtual machines before you sit the exam.

Read the full GCED certification overview

SEC501 Course Authors

Ross Bergman

SANS Principal Instructor Ross Bergman brings nearly four decades of hands-on and leadership experience. SANS Senior Instructor Dave Shackleford has advised hundreds of organizations on cloud, network, and security architecture.

Learn more

Dave Shackleford

Founder at Voodoo Security

Cybersecurity leader Dave Shackleford combines decades of enterprise defense, cloud security, and hands-on consulting experience to help students master real-world security operations and modern threat defense.

Learn more

Who Should Pursue GCED

SOC Engineers and Analysts

Incident Responders and CSIRT Members

Penetration Testers

Network Security Professionals and Administrators

Security Engineers

Technical Leads and Managers

Frequently Asked Questions

GCED validates a practitioner's knowledge and abilities in defensive network infrastructure, packet analysis, penetration testing, incident handling, and malware removal. It builds on the skills measured by the GIAC Security Essentials certification and covers the more advanced technical skills needed to defend an enterprise environment.

The GCED exam is one proctored exam with 115 questions and a three-hour time limit. The minimum passing score is 69%. GIAC offers remote proctoring through ProctorU and onsite proctoring through PearsonVUE.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.

GCED fits SOC engineers and analysts, incident responders, penetration testers, and network security professionals, along with anyone who wants in-depth technical knowledge of implementing comprehensive security solutions. SEC501 also draws security engineers, system administrators, DFIR practitioners, CSIRT members, and technical leads.

SANS SEC501: Applied Cyber Defense maps directly to the GCED certification objectives, with 26 hands-on labs in lab virtual machines and a Capture the Flag capstone across six sections. Training is not required for GCED, and GIAC also lists practical work experience and other study as ways to build the skills.

SANS Institute is a training organization. GIAC LLC is an independent certification body accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC 17024:2012. Completion of SANS training is not required for GIAC certification, nor does it guarantee a passing exam result.

Ready to earn your GCED certification?

Add the GCED exam attempt when you register for SEC501.

Already trained? Register for the exam directly through GIAC.

SEC536: Adversarial AI - Penetration Testing AI Systems