SEC536: Adversarial AI - Penetration Testing AI Systems
SEC536Offensive Operations, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Mike Pilkington
Full-Time Researcher at SANS Research Operations Center (SROC)Current DFIR consultant, and former incident response lead at Shell and Halliburton, Mike’s work has helped shape enterprise-scale incident response and directly advanced the global community’s ability to combat cyber adversaries.
Tarot (Taz) Wake
Managing Director (Information Security) at Halkyn Consulting LtdWith FOR577, Taz has authored the first course to systematize threat hunting on Linux systems. His operational leadership—from military intelligence to heading a FTSE100 CSIRT—has fortified global cyber defense capabilities across sectors.
The GEIR certification proves you can lead and execute incident response at enterprise scale, using consistent analysis methods to trace attacker movement across Windows, Linux, macOS, container, and cloud environments. It covers incident response team management, large-scale event correlation and timeline analysis, and multi-platform artifact analysis, the skills at the core of enterprise-class response work.
The GEIR exam is a single proctored exam with 82 questions in a 3-hour window, delivered through GIAC's CyberLive format. The current minimum passing score is 72%, set for exam versions released on or after April 20, 2024. GIAC reviews exam specifications periodically, so confirm the current format in the Certification Information section of your GIAC account before you sit the exam.
GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.
GEIR is built for incident response team leads and advanced practitioners, threat hunting professionals, experienced digital forensic analysts, and enterprise detection engineers. Federal agents, law enforcement professionals, and SANS DFIR alumni looking to apply their forensic skills at enterprise scale are also a strong fit. FOR608, the course that prepares you for it, is aimed at DFIR, incident response, and threat hunting professionals at medium to large organizations who are already comfortable with core forensic and incident response fundamentals.
FOR608: Enterprise-Class Incident Response & Threat Hunting prepares you for the GEIR exam. The course moves through six sections and 20 hands-on labs covering enterprise-scale detection, Windows and Linux DFIR, macOS and container analysis, and cloud incident response in Microsoft 365 and AWS, closing with a multi-platform capstone exercise. FOR608 assumes prior DFIR experience or completion of FOR500 or FOR508, since it skips introductory forensic material to focus on scale.