GIAC Certified Web Application Defender Certification (GWEB)

Cloud Security Certification Overview

The GIAC Web Application Defender (GWEB) certification validates expertise handling the common web application errors that lead to most security problems.

Explore SEC522 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GWEB Certification?

The GIAC Web Application Defender (GWEB) certification validates a practitioner's expertise handling the common web application errors that lead to most security problems. GWEB certification holders have hands-on experience using current tools to detect and prevent input validation flaws, cross-site scripting (XSS), and SQL injection, along with an in-depth understanding of the weaknesses and best defenses for authentication, access control, and session management.

By the numbers

3 hrs

Exam duration

Questions

68%

Min. passing score

What GWEB Covers

GIAC publishes 18 exam objectives for GWEB, which group into five practical domains.

Web Foundations and Configuration

Covers the HTTP Protocol Introduction, Web Architecture and Configuration, and Cloud Security and SSRF objectives.

Input Attacks and Defenses

Covers the Injection Foundations; Cross-Site Scripting and Cross-Site Request Forgery; Unicode and Internationalization Security; and Deserialization, Business Logic, and Concurrency objectives.

Identity, Access, and Cryptography

Covers the Authentication; Access Control; OAuth, OIDC, JWT, and SAML; and Transport Security and Cryptography objectives.

APIs and Client-Side Security

Covers the Web Services Security; REST and GraphQL API Security; Same Origin Policy, CORS, and Cross-Origin Attacks; XSS Defense and Client-Side Supply Chain; and Browser Security Features and Clickjacking objectives.

AI, MLSecOps, and Microservices

Covers the AI/LLM and Microservices Security and MLSecOps and Threat Modeling objectives.

Prepare With This Course

SEC522: Application Security: Securing Web Applications, APIs, and Microservices

Course Details

How SEC522 Prepares You for GWEB

SEC522 is built around the exam objectives that make up the GWEB certification:

Section 1, Web Foundations and Secure Configurations builds skills tested under HTTP Protocol Introduction, Web Architecture and Configuration, and Cloud Security and SSRF.
Section 2, Input Attacks and Defenses aligns with Injection Foundations; Cross-Site Scripting and Cross-Site Request Forgery; Unicode and Internationalization Security; and Deserialization, Business Logic, and Concurrency.
Section 3, Authentication, Authorization, and Cryptography aligns with Authentication; Access Control; OAuth, OIDC, JWT, and SAML; and Transport Security and Cryptography.
Section 4, APIs, Web Services, and Client-Side Security aligns with Web Services Security; REST and GraphQL API Security; Same Origin Policy, CORS, and Cross-Origin Attacks; XSS Defense and Client-Side Supply Chain; and Browser Security Features and Clickjacking.
Section 5, AI Security, MLSecOps, and Microservices builds skills tested under AI/LLM and Microservices Security and MLSecOps and Threat Modeling.

Across all five sections, 17 hands-on labs and a Defend the Flag capstone challenge give you the chance to apply each skill in a realistic application lab environment before you sit the exam.

Read the full GWEB certification overview

SEC522 Course Author

Jason Lam

Consulting Practice Director at World Wide Technology

Jason Lam, SANS Senior Instructor and author of LDR520 and co-author of SEC522, guides cloud and application-security leaders with hands-on, strategic training.

Who Should Pursue GWEB

Application Developers and Architects

Application Security Analysts and Managers

Penetration Testers Interested in Defensive Strategies

Security Professionals Learning Web Application Security

Auditors Who Need to Understand Defensive Mechanisms in Web Applications

Employees of PCI-Compliant Organizations Who Need Training to Meet PCI Requirements

Frequently Asked Questions

The GWEB certification validates a practitioner's expertise handling the common web application errors that lead to most security problems. Holders have hands-on experience using current tools to detect and prevent input validation flaws, cross-site scripting (XSS), and SQL injection.

The GWEB exam is one proctored exam with 75 questions and a 3-hour time limit, and the minimum passing score is 68%. GIAC also sells a GWEB practice test that simulates the real exam format.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.

GWEB suits application developers and architects, application security analysts and managers, penetration testers interested in defensive strategies, security professionals learning about web application security, auditors who need to understand defensive mechanisms in web applications, and employees of PCI-compliant organizations who need training to meet PCI requirements.

SEC522: Application Security: Securing Web Applications, APIs, and Microservices provides great training if you're thinking of pursuing GWEB. The course includes 17 hands-on labs and a Defend the Flag capstone in a realistic application lab environment, and its five sections align with the GWEB exam objectives.

SANS Institute is a training organization. GIAC LLC is an independent certification body accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC 17024:2012. Completion of SANS training is not required for GIAC certification, nor does it guarantee a passing exam result.

Ready to earn your GWEB certification?

Add the GWEB exam attempt when you register for SEC522.

Already trained? Register for the exam directly through GIAC.

SEC536: Adversarial AI - Penetration Testing AI Systems