SEC536: Adversarial AI - Penetration Testing AI Systems
SEC536Offensive Operations, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Pierre Lidome
Cyber Investigations Practice Manager at SchlumbergerPierre is a SANS course author and cyber threat hunter with 25+ years in DFIR, security, and network engineering. He volunteers for NCCDC, teaches at University of Houston, and serves on the GIAC advisory board and SANS Technology Institute faculty.
Megan Roddie-Fonseca
Senior Security Engineer at DatadogMegan is a Senior Security Engineer at Datadog, SANS DFIR faculty, and co-author of FOR509. She holds two master’s degrees, serves as CFO of Mental Health Hackers, and is a strong advocate for hands-on cloud forensics training and mental wellness.
The GCFR certification proves you can track and respond to security incidents across all three major cloud providers: AWS, Google Cloud, and Microsoft Azure. Certification holders are equipped to collect, interpret, and extract forensic evidence from log sources across cloud environments, including the ability to identify malicious and anomalous activity affecting cloud resources.
The GCFR exam uses GIAC's CyberLive format, with 82 questions delivered over 3 hours and a minimum passing score of 64%. GIAC periodically reviews exam specifications, so candidates should confirm current details in the Certification Information section of their GIAC account before their attempt.
GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.
GCFR is built for incident response team members, SOC analysts, and threat hunters working across cloud environments. It also fits federal agents and law enforcement professionals, and experienced digital forensic analysts who want to round out on-premise skills with cloud-specific investigation techniques.
FOR509: Enterprise Cloud Forensics and Incident Response is the SANS course built to prepare you for the GCFR exam. Across 6 sections and 23 hands-on labs, FOR509 covers log analysis and incident response for Microsoft 365, Azure, AWS, Google Workspace, Google Cloud, and Kubernetes, closing with a Multi-Cloud Intrusion Challenge capstone.