Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing

GIAC Python Coder Certification (GPYC)

AI-Focused Certification Overview

Prove you can write, debug, and automate Python for security work, from packet and log analysis to AI-assisted tools and agents.

Explore SEC573 CourseRegister for the Exam
GPYC Badge
Jump to:

What Is the GPYC Certification?

The GIAC Python Coder (GPYC) certification confirms you can write and troubleshoot real Python code and apply core programming concepts on the job. Certification holders show they can put common Python libraries to work, build their own tools, pull information from a system or network, work with websites and databases, and set up automated testing.

By the numbers

2 hrs

Exam duration

75

Questions

67%

Min. passing score

What GPYC Covers

The objectives group into five practical domains that map to SEC573's sections.

Python Fundamentals

Covers Python Basics, Control Structures and Iteration, and Functions, Classes and Objects, the syntax and building blocks tested throughout the exam.

Data Structures

Covers the Data Structures objective, including lists, dictionaries, tuples, and the JSON-like structures used to exchange data with APIs and AI tools.

Data and Packet Analysis

Covers Regular Expressions, Data Analysis with Python, and Packet Analysis with Python, the skills tested for parsing logs, files, and captured network traffic.

Database and Web Interaction

Covers Database Interaction and Website Interaction, including querying databases with SQL libraries and working with URLs, requests, and APIs.

Networking and Program Resilience

Covers Network Interfaces, Exception Handling, and Creation of Executables, the skills tested for socket programming, error handling, and building standalone Python executables.

Prepare With This Course

SEC573: AI-Powered Security Automation: Building Tools with Python, LLMs, and MCP

Course Details

How SEC573 Prepares You for GPYC

SEC573 is built around the exam objectives that make up the GPYC certification: 

  • Section 1, Essential Skills Workshop builds skills tested under Python Basics, Control Structures and Iteration, and Functions, Classes and Objects.
  • Section 2, Essentials Knowledge Workshop aligns with Data Structures.
  • Section 3, Automated Defense with AI builds skills tested under Regular Expressions, Data Analysis with Python, and Packet Analysis with Python.
  • Section 4, Automated Forensics with AI aligns with Database Interaction and Website Interaction.
  • Section 5, Automated Offense with AI builds skills tested under Network Interfaces, Exception Handling, and Creation of Executables.

Across all six sections, 128 hands-on labs and a team capstone workshop give you the chance to apply each skill in live Python, network, and forensic environments before you sit the exam. 

Read the full GPYC certification overview here. 

SEC573 Course Author

Mark Baggett
Mark Baggett

Mark Baggett

Chief Technology Officer at The Internet Storm Center

SANS Faculty Fellow Mark Baggett authored SEC573 and SEC673, leads as CTO of the SANS Internet Storm Center, and empowers defenders to automate security through practical, real-world application.

Read more about Mark Baggett

Who Should Pursue GPYC

Information Security Professionals

Python Developers

Forensic Analysts

Network Defenders

Penetration Testers

Frequently Asked Questions

It proves you can write and analyze working Python code and apply core programming concepts, including data structures, exception handling, regular expressions, database and website interaction, network sockets, and AI-assisted workflows like calling LLM APIs and building agent tools. 

The exam is a single proctored, 2-hour test with 75 questions and a minimum passing score of 67%. 

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page. 

Information security professionals, Python developers, forensic analysts, network defenders, and penetration testers, per GIAC's own audience language. 

SEC573: AI-Powered Security Automation: Building Tools with Python, LLMs, and MCP, a 6-day course (or 36 hours self-paced) authored by Mark Baggett, with 128 hands-on labs covering Python fundamentals through AI-driven automation, forensics, and offensive security. 

Ready to earn your GPYC certification?

Add the GPYC exam attempt when you register for SEC573.

Register for SEC573

Already trained? Register for the exam directly through GIAC here.