GIAC Defending Advanced Threats Certification (GDAT)

Offensive Operations Certification Overview

Prove you can prevent, detect, and respond to advanced threats, from payload delivery and lateral movement to adversary emulation.

Explore SEC599 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GDAT Certification?

The GDAT certification validates a practitioner's command of both offensive and defensive security, in depth. Certification holders can show they understand how advanced adversaries plan and carry out an attack, and that they can put the right controls in place to prevent, detect, and respond to it, not just one side of that job.

By the numbers

2 hrs

Exam duration

Questions

70%

Min. passing score

What GDAT Covers

GDAT's published objectives group into 5 practical domains that map directly to SEC599's five content sections.

Adversary Emulation Fundamentals

Common adversary emulation tooling and the key technical controls to consider when running it.

Payload Delivery and Execution

Comparing payload delivery and execution strategies against the controls built to stop them.

Exploitation, Persistence, and Exfiltration

Application exploitation, persistence strategies, and the exfiltration and command-and-control detection that catches them.

Identity and Lateral Movement

Active Directory and domain attacks, administrative access, and lateral movement detection and prevention.

Threat Hunting and Incident Response

Fundamental reconnaissance, threat hunting strategy, and the incident response process.

Prepare With This Course

SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses

Course Details

How SEC599 Prepares You for GDAT

SEC599 is built around the exam objectives that make up the GDAT certification:

Section 1, Introduction and Attack Surface Management builds skills tested under adversary emulation, including atomic TTP testing with Caldera and attack surface mapping with BBOT.
Section 2, Payload Delivery and Execution aligns with the payload delivery and payload execution objectives, covering phishing defenses and script execution controls.
Section 3, Exploitation, Persistence, and Command and Control builds skills tested under application exploitation, installation, and data exfiltration, including exploit mitigation and command-and-control detection.
Section 4, Lateral Movement aligns with the Active Directory and domains, administrative access, and lateral movement objectives, including credential protection and attack path mapping with BloodHound.
Section 5, Action on Objectives, Threat Hunting, and Incident Response builds skills tested under reconnaissance, threat handling, and the incident response process.

Across all six sections, 25 hands-on labs and a capstone Capture-The-Flag challenge give you the chance to apply each skill in the live SYNCTECHLABS environment before you sit the exam.

Read the full GDAT certification overview.

SEC599 Course Authors

Erik Van Buggenhout

Co-Founder and Partner at NVISO

Train with Erik Van Buggenhout, SANS instructor and NVISO co-founder, and develop hands-on skills in purple teaming, adversary emulation, and detection engineering to continuously improve detection, response, and real-world cyber defense.

Learn more

Stephen Sims

Research Fellow

Stephen Sims, an esteemed vulnerability researcher and exploit developer, has significantly advanced cybersecurity by authoring SANS's most advanced courses and co-authoring the "Gray Hat Hacking" series.

Learn more

Who Should Pursue GDAT

Blue Team Analysts and SOC Engineers

Red Teamers and Penetration Testers

Purple Team Practitioners

Security Architects and Engineers

Technical Security Managers

IT Administrators

Frequently Asked Questions

It proves you can operate across both sides of a security engagement. GIAC's own objectives cover ten domains, from Active Directory attacks and administrative access abuse to payload delivery, lateral movement, and incident response, so a passing score signals that you understand how advanced adversaries plan and carry out an attack and that you can put working prevention, detection, and response controls in place against it, not just one side of that job.

It is a single proctored attempt: 75 questions in 2 hours, with a minimum passing score of 70%. GIAC periodically reviews and may update exam specifications, so confirm the current format in the Certification Information section of your GIAC account before you schedule your attempt.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.

GDAT fits blue, red, and purple team practitioners alike, along with security architects and IT administrators who need to understand both sides of an attack. SANS sees the same pattern in SEC599 classrooms: security architects and engineers, red teamers and penetration testers, technical security managers, and SOC analysts and engineers all show up, plus anyone who wants a clearer picture of how persistent adversaries operate and how the IT environment can be hardened against them.

SEC599: Defeating Advanced Adversaries, Purple Team Tactics & Kill Chain Defenses is built to prepare you for it. The course pairs 25 hands-on labs with a capstone Capture-The-Flag challenge across six sections, working through the same territory the exam covers: payload delivery and execution, exploitation and persistence, lateral movement, and threat hunting and incident response. Register for SEC599 to work through that material with an instructor, or add the GDAT exam attempt at checkout if you're ready to test.

Ready to earn your GDAT certification?

Add the GDAT exam attempt when you register for SEC599.

Already trained? Register for the exam directly through GIAC here.

SEC536: Adversarial AI - Penetration Testing AI Systems