Skip to content
CertGPS

GIAC Certified Web Application Defender

Proves you can prevent and detect common web application flaws, from injection to OAuth and API abuse, the defender's counterpart to GWAPT

IntermediateGIAC

The exam

Exam cost
$999
Study time
3-5 months
Passing score
68%
Valid for
4 years

Before you book

  • None required by GIAC
  • Optional training: SANS SEC522 (formerly DEV522)
  • Recommended: basic HTML, JavaScript, SQL and scripting knowledge, as SEC522 expects

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where it leads

  1. GIAC Certified Web Application Defender

    You are here

  2. Certified Secure Software Lifecycle Professional

    Advanced

    Next step. Widens application security from web defenses to the whole software lifecycle; needs four years' experience

Study guide

Last updated

GWEB Study Guide: GIAC Certified Web Application Defender and SEC522

The GIAC Certified Web Application Defender (GWEB) shows that you can find the flaws behind most web application breaches and, more to the point, stop them: input validation, cross-site scripting (XSS), SQL injection, broken authentication and access control. It's written for the people who build and defend applications. The course behind it is now SEC522, formerly DEV522, and the current objectives add REST and GraphQL APIs, single sign-on protocols and AI features that GIAC's older topic summary doesn't mention. Check any study material against that list first.

Who should take GWEB, and who wants GWAPT

GIAC aims GWEB at application developers, application security analysts and managers, architects, and auditors who need to judge the defenses in front of them. It also names penetration testers who want the defensive view and staff at organizations covered by the Payment Card Industry Data Security Standard (PCI DSS). In practice that means a developer moving into an AppSec role, or an AppSec engineer who reviews designs and writes the fixes.

If your job is to break applications and write up what you found, the GIAC Web Application Penetration Tester (GWAPT) is the better fit. It tests exploitation, includes hands-on CyberLive items, and pairs with SEC542 instead of SEC522. The two overlap on SQL injection, XSS and cross-site request forgery (CSRF), but GWAPT asks how to exploit them and GWEB asks how to prevent and detect them.

GWEB in numbers

GWEB
Format75 questions; GIAC lists no CyberLive section for GWEB
Time3 hours
Passing score68% (exam versions released on or after April 1, 2011)
Price$999 per attempt; $899 retake; $399 per practice test
DeliveryProctored online through ProctorU or at a Pearson VUE test center; 120 days from activation
Materials allowedPrinted books, notes and your own index; nothing electronic
PrerequisitesNone set by GIAC; SEC522 expects HTML, JavaScript, SQL and scripting basics
ValidityFour years; renew with 36 CPEs and a $499 fee, or by retaking the current exam

Eighteen objectives, from HTTP basics to MLSecOps

GIAC publishes 18 objectives with no weights. SANS groups them by SEC522 section, which is the easiest way to see the shape:

  • Web foundations: HTTP protocol introduction, web architecture and configuration, cloud security and server-side request forgery (SSRF)
  • Input attacks: injection foundations; XSS and CSRF; Unicode and internationalization; deserialization, business logic and concurrency
  • Identity and crypto: authentication; access control; OAuth, OpenID Connect (OIDC), JSON Web Tokens (JWT) and SAML; transport security and cryptography
  • Interfaces and the browser: web services (SOAP, XML, WSDL); REST and GraphQL APIs; same-origin policy and cross-origin resource sharing (CORS); XSS defense and client-side supply chain; browser security features and clickjacking
  • AI and microservices: AI/LLM and microservices security; MLSecOps and threat modeling

The interfaces group is the largest at five objectives, but identity runs through the whole list. The federation objective asks for the trust checks and configuration that defend single sign-on against assertion manipulation, token replay and redirect abuse, and four objectives in all deal with who a user is and what they may do.

GIAC's page has two quirks. The short "Areas Covered" summary near the top still lists older topics such as AJAX and "response readiness". And the outcome statement under XSS Defense and Client-Side Supply Chain repeats the AI/LLM wording, which looks like a copy error. Go by the objective titles, and check the version of your own attempt in the GIAC portal, which GIAC says is the authority on format and pass mark.

Without CyberLive, GWEB rewards precise knowledge of controls more than speed with tools: which Content Security Policy directive blocks inline script, why a JWT library must pin its algorithm, what a CORS response header actually allows.

A preparation plan for developers and AppSec analysts

SEC522 runs five days in person or about 30 hours self-paced, with 17 labs and a Defend the Flag capstone on the last afternoon. SANS lists most current sessions at $8,260 before tax, and adding the GIAC attempt brings two practice tests. The labs include passkeys and WebAuthn origin binding, JWT algorithm confusion, broken object level authorization (BOLA) in an API, Content Security Policy and clickjacking, and defending a chatbot built on a large language model (LLM). Jason Lam is the listed author.

If you study on your own, the OWASP projects map closely to the objectives:

  • OWASP Cheat Sheet Series for the fix side of nearly every objective, from injection to OAuth
  • OWASP Application Security Verification Standard (ASVS) as a checklist for authentication, session and access control requirements
  • OWASP API Security Top 10 for the REST and GraphQL objective
  • OWASP Top 10 for LLM Applications for the two AI objectives
  • PortSwigger's Web Security Academy, free, to see each attack work before you defend against it

GIAC's survey puts typical study at about 55 hours beyond any class, and up to three times that if the material is new to you. A developer with web experience might split ten weeks this way: two on HTTP, architecture and configuration; three on input handling and the browser; three on identity, tokens and cryptography; one on APIs and AI; and one on practice tests. Build a printed index by objective as you go, because GIAC exams are open book on paper only and you can't return to an answered question. After the first practice test, rework every objective that scores below four stars.

Keeping GWEB current, and where to go next

GWEB lasts four years. Renewal takes 36 continuing professional education (CPE) credits and a $499 fee, and further GIAC renewals within two years of a full-price one cost $249 each. SANS courses and new GIAC certifications count for up to 36 CPEs, and SEC522 itself is listed at 30. If you fail, there's a 30-day wait, the $899 retake adds 60 days to your deadline, and three failures end the attempt.

Next steps:

  • GWAPT for the attacker's view of the same flaws, if your role starts to include testing
  • CSSLP, ISC2's eight-domain credential for the whole software lifecycle, which needs four years of experience
  • OSWE if you want to prove you can find exploitable flaws by reading source code

Our view

GWEB has no CyberLive section, so it says less about hands-on skill than GIAC's practical exams do, and a multiple-choice score can't show that you'd catch a flaw in code review. What it has going for it is a current syllabus. Its objectives cover GraphQL, OAuth and OIDC, client-side supply chain and LLM features, where GWAPT's list still opens with AJAX. It's worth $999 when an employer funds SEC522 alongside it or when you're making the move from developer to AppSec. If you need one credential to put in front of recruiters, we'd weigh CSSLP first, once you have the four years it asks for.

Sources