GIAC Cyber Threat Intelligence Certification (GCTI)

Threat Intelligence Certification Overview

Prove you can gather, analyze, and apply threat intelligence across strategic, operational, and tactical levels to counter targeted attacks.

Explore FOR578 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GCTI Certification?

The GIAC Cyber Threat Intelligence (GCTI) certification validates a practitioner's strategic, operational, and tactical cyber threat intelligence knowledge and skills. Certification holders can gather, analyze, and apply intelligence from varied sources, profile and analyze intrusions and malware, pivot and perform domain analysis, work with network indicators, log repositories, and forensics tools, and produce accurate, effective intelligence reports.

By the numbers

3 hrs

Exam duration

Questions

71%

Min. passing score

What GCTI Covers

The objectives group into 6 practical domains.

Intelligence Fundamentals

CTI definitions, threat models, and intelligence requirements.

Intrusion Analysis Models

The Kill Chain, Diamond Model, and Courses of Action Matrix.

Collection and Pivoting

Collecting and storing data sets, malware as a collection source, and pivoting.

Structured Analysis

Analysis of intelligence, cognitive bias mitigation, and clustering intrusions.

Attribution and Dissemination

Campaigns and attribution, and sharing intelligence.

Intelligence Application

Practical application, exercised in the capstone.

Prepare With This Course

FOR578: Cyber Threat Intelligence

Course Details

How FOR578 Prepares You for GCTI

FOR578: Cyber Threat Intelligence is built around the exam objectives that make up the GCTI certification:

Section 1, Cyber Threat Intelligence and Requirements builds the foundation tested under Intelligence Fundamentals, covering CTI definitions, threat models, and intelligence requirements.
Section 2, The Fundamental Skillset: Intrusion Analysis aligns with the Kill Chain, Diamond Model, and Courses of Action Matrix objective.
Section 3, Collection Sources aligns with Collecting and Storing Data Sets, Malware as a Collection Source, and Pivoting, through work with domains, TLS certificates, malware, and open-source data.
Section 4, Analysis Production of Intelligence builds skills tested under Analysis of Intelligence, including structured analytic techniques and cognitive bias mitigation.
Section 5, Dissemination and Attribution aligns with Sharing Intelligence and Campaigns and Attribution, covering tactical, operational, and strategic reporting and attribution models.
Section 6, Cyber Threat Intelligence Capstone draws on Intelligence Application, asking teams to turn a single intrusion into a broader campaign assessment.

Across all six sections, 20 hands-on labs and a capstone analysis exercise give you the chance to apply each skill against real intrusion data before you sit the exam.

Read the full GCTI certification overview.

FOR578 Authors

Rebekah Brown

Senior Researcher at Citizen Lab

Rebekah Brown has been instrumental in advancing cyber threat intelligence, serving as a network warfare analyst at the NSA, Operations Chief of a U.S. Marine Corps cyber unit, and training lead at U.S. Cyber Command.

Learn more

Robert M. Lee

CEO at Dragos, Inc

SANS Fellow and Dragos CEO Robert M. Lee, author of ICS515 and FOR578 and co-author of ICS310, teaches from landmark industrial cyber investigations, turning real adversary tradecraft into visibility, detection, and response skills in OT.

Learn more

Who It's For

Incident Response Team Members

Threat Hunters

SOC Personnel and Security Practitioners

Digital Forensic and Malware Analysts

Federal Agents and Law Enforcement Officials

Frequently Asked Questions

GCTI certification holders can gather, analyze, and apply threat intelligence from varied sources, profile and analyze intrusions and malware, pivot and perform domain analysis, work with network indicators, log repositories, and forensics tools, and produce accurate, effective intelligence reports across strategic, operational, and tactical levels.

The GCTI exam is 82 questions, taken over 3 hours, with a minimum passing score of 71%.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC's renewal page.

GCTI is designed for incident response team members, threat hunters, SOC personnel and security practitioners, digital forensic and malware analysts, and federal agents and law enforcement officials.

FOR578: Cyber Threat Intelligence is built around GCTI's exam objectives, with 20 hands-on labs and a team capstone exercise built on real intrusion data, culminating in a multi-campaign analysis presentation.

Ready to earn your GCTI certification?

Add the GCTI exam attempt when you register for FOR578.

Already trained? Register for the exam directly through GIAC here.

SEC536: Adversarial AI - Penetration Testing AI Systems