GIAC Continuous Monitoring Certification (GMON)

Cyber Defense Certification Overview

Prove you can deter intrusions and detect anomalous activity through defensible security architecture and continuous monitoring.

Explore SEC511 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GMON Certification?

The GIAC Continuous Monitoring (GMON) certification validates a practitioner's ability to deter intrusions and quickly detect anomalous activity. GMON holders understand defensible security architecture and are qualified to implement network security monitoring, continuous monitoring, and continuous diagnostics and mitigation.

By the numbers

3 hrs

Exam duration

Questions

74%

Min. passing score

What GMON Covers

Noting the 17 published objectives can be grouped into 5 practical domains.

Threat-Informed Defense & Attack Techniques

Threat Informed Defense, Attack Techniques, Cyber Defense Principles.

Security Architecture & Perimeter Protection

Security Architecture Overview, Perimeter Protection Devices, NIDS/NIPS/NGFW, Network Data Encryption.

Network Security Monitoring & SIEM

Network Security Monitoring Tools, Proxies & SIEM, Exploit Methodology and Analysis, Discovery and Vulnerability Scanning.

Endpoint & Identity Monitoring

Device Monitoring, HIDS/HIPS/Endpoint Firewalls, Account & Privilege Monitoring & Authentication.

Configuration & Baseline Management

Configuration Monitoring, Patching & Secure Baseline Configurations, Software Inventories and Application Control.

Prepare With This Course

SEC511: Cybersecurity Engineering: Advanced Threat Detection and Monitoring

Course Details

How SEC511 Prepares You for GMON

SEC511 is built around the exam objectives that make up the GMON certification:

Section 1, Threat Informed Defense: Frameworks, Hunting, and Current State Assessment builds skills tested under Threat Informed Defense, Attack Techniques, and Cyber Defense Principles.
Section 2, Cloud, Edge, and Network: Visibility and Protection aligns with Security Architecture Overview, Perimeter Protection Devices, NIDS/NIPS/NGFW, and Network Data Encryption.
Section 3, Threat Hunting with Network Detection and Response (NDR) aligns with Network Security Monitoring Tools, Proxies & SIEM, Exploit Methodology and Analysis, and Discovery and Vulnerability Scanning.
Section 4, Hybrid Enterprise Security: User and Endpoint Protection and Detection builds skills tested under Device Monitoring, HIDS/HIPS/Endpoint Firewalls, Account & Privilege Monitoring & Authentication, Configuration Monitoring, Patching & Secure Baseline Configurations, and Software Inventories and Application Control.
Section 5, GenAI Application Defense, Automation, Supply Chain Protection, and SOC extends the Cyber Defense Principles and Threat Informed Defense objectives into AI/LLM defense, software supply chain security, and SOC automation.

Across all six sections, 18+ hands-on labs and a full-day, team-based NetWars capstone give you the chance to apply each skill in live cloud, network, and endpoint environments before you sit the exam.

Read the full GMON certification overview

SEC511 Course Authors

Eric Conrad

President at Backshore Communications

Eric Conrad, a SANS Faculty Fellow and course author, has 28 years of information security experience. Eric is the CTO of Backshore Communications and his specialties include Intrusion Detection, Threat Hunting, and Penetration Testing.

Learn more

Seth Misenar

Founder at Context Security Consulting

Seth, SANS Faculty Fellow and author of SEC411, LDR414, and SEC511, combines cutting-edge consulting and education to equip defenders worldwide. Founder of Context Security and GSE #28, he brings clarity, humor, and purpose to cybersecurity training.

Learn more

Who Should Pursue GMON

Security Architects

Senior Security Engineers

Technical Security Managers

SOC Analysts, Engineers, and Managers

CND Analysts and practitioners implementing continuous security monitoring, CDM, or NSM

Frequently Asked Questions

It proves you can deter intrusions and quickly detect anomalous activity. GMON holders have demonstrated knowledge of defensible security architecture, network security monitoring, continuous diagnostics and mitigation, and continuous security monitoring.

One proctored exam, 82 questions, a 3-hour time limit, and a minimum passing score of 74%. GIAC periodically reviews and may update these specifications, so confirm the current format in the Certification Information section of your GIAC account before you sit the exam.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.

Security architects, senior security engineers, technical security managers, SOC analysts, engineers, and managers, CND analysts, and anyone working to implement continuous diagnostics and mitigation, continuous security monitoring, or network security monitoring.

SEC511: Cybersecurity Engineering: Advanced Threat Detection and Monitoring. The course pairs 18+ hands-on labs with a full-day NetWars capstone across cloud, network, and endpoint environments, mapped directly to GMON's exam objectives. View the SEC511 course page.

Ready to earn your GMON certification?

Add the GMON exam attempt when you register for SEC511.

Already trained? Register for the exam directly through GIAC here.

SEC536: Adversarial AI - Penetration Testing AI Systems