Meet the New GSE: The Ultimate Achievement in Cybersecurity Certification

We are celebrating the 20^th anniversary of the GIAC Security Expert (GSE) certification this year! As someone who is has been a fan of GIAC/SANS for more than 20 years and lucky enough to be an employee for almost 18 of those, now seems like a good time to discuss how the GSE has evolved since it was introduced.  

After a trip through the Wayback machine, I unearthed a couple of blog posts about how the GSE got its start in 2003:  

• Introducing the GSE, from David Hoelzer (GIAC Director at the time) 

• First two GSEs earned by Lenny Zeltser and John Jenkinson 

I still remember the moment I read that second post from June of 2003, because I was studying for my GSEC at the time.  I thought to myself, “Wow – Lenny and John are nothing less than modern day heroes! What a wonderful achievement!  What a wonderfully difficult and complex thing the GSE must be – I cannot imagine!” 

A few years later, I found myself working at GIAC and tasked with helping to create the next version of the GSE— for me, a dream job with a Herculean challenge!  

The GSE went through many revisions from 2006-2019. The earliest of those were on the rough side compared to where we ended up. The labs got better over the years as the technology and talent got better. I earned the GSE myself in 2013 when a new version of the lab was introduced.  By the end of 2019, we had six GSEs on staff and GIAC had certified 255 GSEs over the course of 16 years.   

However, as the industry grew and evolved, the GSE wasn’t scaling well. Those relatively few candidates who were willing to deal with the logistics of a live lab that only ran twice a year at SANS US-based conferences had to wait 45 days for their lab results. We tried to grow the program to meet demand, but there were ever increasing logistical and technical challenges with delivering a live lab, and we were worried about scaling the quality.   

And then 2020 happened and the entire world was locked down. COVID kept GIAC from running a live lab in 2020 and 2021. All that time, we were building a backlog of unhappy candidates to whom we could not deliver a live lab. Would this spell the end of the GSE program? Some thought so.  

Yet, most of us felt that GSE must go on. The simple fact is a far greater percentage of GSEs have gone on to be thought leaders and difference makers in cyber security than any other credential. What could be more in alignment with our mission at GIAC/SANS than that? All of us who had skin in the game (held the GSE) felt that the GSE must survive, and so we began to innovate and think about how we might be able deliver a lab remotely – not only to solve for COVID, but maybe to solve for scaling problems for the future of the program. 

Many GIAC employees are very technical, with extensive backgrounds in cyber security. We have often come up with CyberLive content (GIAC’s hands-on practical testing environment) that is too difficult or too challenging to use for standard GIAC certifications exams. That got us thinking… What if we set our most technical people free to create GSE-level content in the CyberLive environment? Could we create GSE-level content in CyberLive?   

After some internal debate, senior management gave us permission to try it. After all, we had to do something to flush backlog in the GSE queue. Without doing something, the alternative would be effectively pulling the rug out from all of those who were waiting since COVID shut things down.  

By the end of our experiment, we created the best, most difficult content to appear on any version of the GSE…. ever.  We alpha tested the content internally with existing GSEs, and we all thought it was at least as difficult as the old lab while being better, more thorough exams to boot. We then beta tested throughout all of 2022, using two large very cohorts from the existing GSE queue. The content performed even better than we imagined, both statistically and psychometrically. 

Satisfied with the content of our new GSE lab, we went back to an idea that had previously been on the table to address two primary concerns:   

1. Existing GSEs felt like there were not enough of them for the credential to have enough presence in the market to make a difference. They wanted us to figure out how to market the GSE, and that also meant we had to be able to scale it.   

2. People who never attempted the GSE, including many SANS instructors, felt like it wasn’t relevant to them or their career path. Penetration testing, digital forensics, and cloud security were not part of the content, and there was no room for it to grow.    

We realized that we could create GSE-level content for any technical domain where we already have a CyberLive certification. We don’t have to be limited to those older domains that gave rise to the content in the old GSE lab. The field has changed in 20 years, and it was time the GSE changed, too.  

Furthermore, it is no longer possible for a single person to be an expert in every aspect of cyber. The challenge we were now left with was, how can we add new content to the program as we go forward in a way that protected the spirt of the GSE. This brings us to the genesis of the Applied Knowledge exams (noted with the letters “GX-” which stand for “GIAC Experienced” 

The idea here is that a true expert (at least in the GIAC/SANS sense of the word) has real hands-on chops and will be able to demonstrate technical depth in multiple areas of cyber security.  The exact areas don’t matter as much, as those change over time. What matters is being able to demonstrate the ability to solve hard problems that exist in our field.  

Each Applied Knowledge/GX- exam is a potential component of a new and improved GSE lab that can be delivered remotely. After all, required GX- lab components (depth) and Practitioner certifications (breadth) are earned when the GSE is awarded. While our initial launch includes three already-released Applied Knowledge exams, we intend to release more Applied Knowledge exams as we go forward in time. Each one will cover GSE-level content in a different domain, allowing experts to create a GSE that matches their own career, while also ensuring that those who earn the GSE are the best in the field. 

In the end, the outcome of the changes is a GSE that is more robust and flexible than ever before. Both the data and my 18+ years of experience with the GSE and testing support this.  Now take a look at the below tables comparing the Fall 2019 version of the GSE lab to what we are offering going forward: 

Requirements

*Note: Previously, Practitioner Certifications could be substituted for Gold Papers and vice-versa, so the minimum was three Practitioner certifications plus two Gold Papers. 

Content

Testing Logistics

Quality

**Test reliability is the definition of how consistent a measure is of a particular element over a period of time, and between different participants.  https://www.psychometrictest.org.uk/test-reliability/ 

Market Presence