Skip to content
CertGPS

GIAC Certified Incident Handler

Proves you can detect, contain and investigate attacks by understanding the tools behind them, with hands-on CyberLive tasks in live virtual machines

IntermediateGIAC

The exam

Exam cost
$999
Study time
4-6 months
Passing score
69%
Valid for
4 years

Before you book

  • None required by GIAC
  • Recommended by SANS for SEC504: networking (TCP/IP, DNS), Windows and Linux command line, basic security concepts

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. GIAC Certified Incident Handler

    You are here

  2. GIAC Certified Forensic Analyst

    Advanced

    Next step. Follows an incident into memory forensics, timeline analysis and threat hunting

Study guide

Last updated

GCIH Study Guide: Attack Techniques, Incident Response and CyberLive

GCIH, the GIAC Certified Incident Handler, proves you can detect, respond to and resolve security incidents because you understand the attacks behind them. Its outline is worth reading before you buy anything, because only three of its 15 objectives cover the response process itself. The other twelve are built around specific attacks: how attackers scan, crack passwords, abuse web apps and pivot, plus one objective on attacking large language model (LLM) applications. The current version, released May 10, 2025, needs 69% to pass.

Who should take GCIH

GIAC writes it for incident handlers and their team leads, system administrators, security architects and "any security personnel who are first responders". That describes most security operations center (SOC) analysts past their first year, and the administrator who gets the call when a server starts behaving oddly.

If you're new to security, GSEC or Security+ comes first; SANS itself points newcomers to SEC401 before SEC504. If your incidents end in disk and memory analysis, GCFA goes further into forensics. If your day is spent in packet captures and IDS alerts, GCIA fits better. And if you'd rather attack systems for a living, GPEN covers the same password and exploitation ground from the tester's side, with Active Directory and Entra ID added.

The GCIH exam in one table

GCIH
VersionReleased May 10, 2025; your GIAC account confirms the version for your attempt
Questions and time106 questions in 4 hours, with CyberLive hands-on tasks at the end
Passing score69%
Price$999 attempt; $899 retake after a 30-day wait; $399 per extra practice test
DeliveryProctored online through ProctorU or at a Pearson VUE center
MaterialsOpen book: printed course books, notes and an index; no electronic files
PrerequisitesNone listed by GIAC
Time to sit it120 days from activation, extendable by 45 days for $479
Validity4 years; 36 CPEs and a $499 fee, or retake the current exam

The 15 objectives, grouped as SANS teaches them

GIAC lists the objectives alphabetically and doesn't weight them. SANS's course page groups them by SEC504 section, which is a more useful way to study:

  • Response: incident response and cyber investigation (the PICERL and DAIR processes), network and log investigations, and malware and AI-assisted investigations.
  • Discovery: scanning and mapping, SMB security, and detecting exploitation and covert channel tools such as Metasploit and netcat.
  • Passwords: understanding passwords, attacking them, and securing credentials and data in the cloud.
  • Web applications: insecure object references, injection, and API attacks.
  • Post-exploitation and AI: endpoint attacks and pivoting, detecting evasive and post-exploitation techniques, and integrating LLMs with offensive operations.

Two process models appear by name. PICERL is the SANS six-step lifecycle of preparation, identification, containment, eradication, recovery and lessons learned. DAIR, the Dynamic Approach to Incident Response, is the method SEC504 teaches, built around verifying, scoping, containing, assessing and remediating. The objective names both, so learn both sets of steps and where they differ.

Most of the outline says "demonstrate an understanding" of an attack and how to defend against it, and CyberLive turns that into practical work. You'll use real virtual machines at the end of the exam, and GIAC warns that a candidate who misses most of the CyberLive items shouldn't expect to pass. If you've never run Nmap, cracked a hash or caught a netcat listener in a process list yourself, that section is where you're most likely to lose marks.

A study plan for SEC504 students and self-learners

SEC504 is the matching SANS course: six days live or 38 hours self-paced, 44 labs, and a final day of capture-the-flag against Windows, Linux, Internet of Things and cloud targets. OnDemand and most US live runs cost $8,780. Bundling the GIAC attempt costs $999, no saving over GIAC's own price, though SANS adds two practice tests.

Self-study candidates have one exam-specific book, Nick Mitropoulos's GCIH All-in-One Exam Guide, published by McGraw Hill in July 2020. It predates the LLM, cloud credential and DAIR material, so treat it as a source of depth on scanning, passwords and exploitation, and work from GIAC's objective list.

For hands-on time, build a small lab with a Windows host, a Linux host and an attacker virtual machine. Then work through the objectives from both sides. Scan the lab with Nmap and find the scan in the logs. Use Metasploit to get a session, then find its process and network connection on the victim. Crack a few NTLM and Linux hashes with a password list, then check what password policy would have stopped you. Find exposed SMB shares and lock them down. Run a SQL injection against a deliberately vulnerable web app, and try prompt injection against a test LLM application. The habit you're building is switching between the attacker's and the defender's view of the same event.

Then build your index. GIAC's practitioner guidance calls the index "a systematic, color-coded guide that you create", and its exam rules allow it alongside printed books and notes. Organise it by tool and by attack name, with entries for command-line flags, log formats and hash formats, so you can look up whatever a question shows you. Take one practice test after your first pass through the books and use its objective report to plan the rest. You can't revisit answered questions, though you can skip 10 to 15 of them.

Renewal, retakes and next steps

If you fail, GIAC makes you wait 30 days, and a $899 retake extends your deadline by 60 days. After three failed attempts you wait a year. Once certified, you renew every four years with 36 CPEs and a $499 fee, or by passing the current exam.

Where to go next:

  • GCFA for memory forensics, timeline analysis and threat hunting.
  • GCIA for traffic analysis with Snort and Zeek.
  • GNFA if network evidence is where your investigations usually end up.

There's also the GIAC Experienced Incident Handler (GX-IH), an Applied Knowledge exam delivered entirely as CyberLive, at $499 with an active GCIH.

Our view

GCIH is respected because it asks you to use the tools, and the CyberLive section gives a pass more weight than a multiple-choice score. You could fairly call it an attack course with an incident response label, and we think that's the reason to take it: an analyst who has run the attacks reads alerts better. The weak point is price. Without employer funding, $999 for the attempt, or about $9,779 with SEC504, is hard to justify, and we'd look at CySA+ or the BTL1 practical first.

Sources