GIAC Offensive AI Analyst Certification (GOAA)

Offensive AI Certification Overview

Prove you can apply the same AI-driven reconnaissance, phishing, and malware techniques attackers use, validated through GIAC's hands-on exam.

Explore SEC535 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GOAA Certification?

The GIAC Offensive AI Analyst (GOAA) certification validates the ability to apply practical, real-world offensive artificial intelligence techniques to modern cybersecurity challenges, including deepfake-enabled phishing, automated vulnerability discovery, and AI-driven attack simulation.

By the numbers

2 hrs

Exam duration

Questions

67%

Min. passing score

What GOAA Covers

The certification's 10 published objectives group into three practical domains, matching SEC535's three course sections.

AI-Driven Reconnaissance and Exploitation

Covers AI Fundamentals, Using AI for OSINT, Network Scanning and Vulnerability Detection, and Using AI for Web Exploitation.

Social Engineering and Deepfake Attacks

Covers Social Engineering Fundamentals, Creating Phishing Emails with AI, and Audio, Image, and Video Deepfakes.

Malware Development and Control Evasion

Covers Malware Fundamentals, Creating Malicious Software with AI, and Bypassing Defensive Controls.

Prepare With This Course

SEC535: Offensive AI - Attack Tools and Techniques

Course Details

How SEC535 Prepares You for GOAA

SEC535 is built around the exam objectives that make up the GOAA certification:

Section 1, Introduction to Offensive AI and Vulnerability Exploitation builds skills tested under AI Fundamentals, Using AI for OSINT, Network Scanning and Vulnerability Detection, and Using AI for Web Exploitation.
Section 2, Social Engineering Attacks builds skills tested under Social Engineering Fundamentals, Creating Phishing Emails with AI, and Audio, Image, and Video Deepfakes.
Section 3, Malware Development and Security Control Evasion builds skills tested under Malware Fundamentals, Creating Malicious Software with AI, and Bypassing Defensive Controls.

Across all three sections, 14 hands-on labs and a capstone capture-the-flag exercise give you the chance to apply each skill in a live lab environment before you sit the exam.

Read the full GOAA certification overview here.

SEC535 Author

Foster Nethercott

Founder at Fortisec

A Marine Corps veteran and founder of Fortisec, Foster Nethercott is a SANS course author and cybersecurity professional specializing in offensive operations and AI TTPs, bringing real-world experience into SEC535.

Who Should Pursue GOAA

Red Team & Penetration Testers

SOC & Incident Response Analysts

Security Engineers and Architects

Security Consultants and Risk Managers

Security Managers, Directors, and CISOs

Frequently Asked Questions

The GOAA exam consists of 56 questions over 2 hours, with a minimum passing score of 67%.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.

GOAA is built for Red Team and Penetration Testers, SOC and Incident Response Analysts, Security Engineers and Architects, Security Consultants and Risk Managers, and Security Managers, Directors, and CISOs.

SEC535: Offensive AI - Attack Tools and Techniques prepares you for it through 14 hands-on labs and a capstone capture-the-flag exercise built around a notional company environment.

Ready to earn your GOAA certification?

Add the GOAA exam attempt when you register for SEC535.

Already trained? Register for the exam directly through GIAC here.

SEC536: Adversarial AI - Penetration Testing AI Systems