Sorting Through the Noise: GIAC's New Path to the GSE

On Monday we announced the launch of our Applied Knowledge exams and portfolio certifications. We have been paying attention to social media and to the questions we have received from members of the GIAC Advisory Board. The questions relate primarily to the GIAC Security Expert (GSE) portfolio certification but are also relevant for the new GIAC Security Professional (GSP) portfolio certification as well as the Applied Knowledge certifications. These questions are:

1. Have you watered down the GSE by not having a specific test at the end?
2. I have taken a CyberLive exam and I found it straightforward, so how is this any different?
3. Won’t this cost me a lot more because I need 10 certifications?
4. Will the exams I have taken in the hope of getting a GSE still matter? Have you moved the goalposts on me by requiring me to take more courses?
5. Renewing 10 underlying certifications is going to cost a lot more than it previously cost. Can you explain what will happen with renewal?
6. There are only 3 Applied Knowledge exams, so how can I actually earn the GSE if it requires 4?

Let’s take them one at a time.

1. Have you watered down the GSE by not having a specific test at the end?

Absolutely not. Comparing the data from the old lab and the new exams show the new exams are more difficult. Here is feedback we received from a student who sat the old lab in-person and has also taken the new exams:

I initially thought the new GSE examination might be less challenging than the previous one, but after taking both exams I can say with confidence that it’s equally or even more difficult, in my opinion. The new electronic format presents a wider range of questions (and higher volume) that would be very difficult to replicate in the previous exam version I sat. To pass these exams, it’s not enough to just know a single concept or tool. You need to have a comprehensive understanding of various concepts and the ability to apply them in a variety of ways. The exam endeavor was robust and varied! - Matthew Austin | GSE #332

We appreciate that there is a difference in experience between taking a lab in-person versus sitting for several very difficult exams. GIAC’s objective, though, is not to focus on a singular experience but to identify hands-on-keyboard experts who have breadth as well as depth of knowledge and can apply what they know to solve challenging problems. The new exams do exactly that, and unlike the old version, they provide the flexibility to find a path that works for your career.

2. I have taken a CyberLive exam, and I found it straightforward so how is this any different?

The new Applied Knowledge exams are hugely different from our other exams – even those that include CyberLive. We encourage you to try one of the demos we have available or perhaps ask a peer who has taken the new exams what they think.

Here’s what a well-respected SANS instructor had to say about the Applied Knowledge exams:

“I'm proud of all my certs, but the satisfaction I felt after passing the applied knowledge exam was nothing like I had felt after any prior cert or exam. These exams will test your mettle!” - Bryan E. Simon | President of Xploit Security Inc., SANS Senior Instructor and Course Author

3. Won't this cost me a lot more because I need 10 certifications?

The new GSE is very similar to the old one. In part that is because we did not want to disrupt our customers who have already done the prep work, but the more important reason is that the GSE has always been about proving breadth and depth of knowledge over multiple steps. So, let’s compare the old GSE program with the new.

_{*Note: Previously, Practitioner Certifications could be substituted for Gold Papers, so the minimum was three Practitioner certifications plus two Gold Papers.}

More than 80% of the current GSEs held at least 6 Practitioner Certifications before sitting for the GSE exams, so the streamlined version matches the quality of the old program very closely. Furthermore, the new program is not tied to specific certifications so it can evolve alongside the emerging sectors of cyber security knowledge. In summary, the updated GSE requirements are geared toward ensuring students have the same breadth of knowledge as before, while now providing greater flexibility.

As for the depth of knowledge component, the updated requirements are again very similar, and the pricing is lower. The cost of an Applied Knowledge Certification is $499 when you have the recommended Practitioner Certification ($1,299 otherwise). This means that for someone who holds the GCIH Practitioner certification, they will only pay $499 to take the GX-IH Applied Knowledge Certification exam. We anticipate most people will hold the Practitioner Certification for the Applied Knowledge certifications they attempt, so the total cost will be $1,996 for the 4 Applied Knowledge exams. The comparable cost under the old program for the Entrance Exam and the 15-hour lab was $3,548 plus the cost for airfare, hotel, car, and food.

In short, for most people, the GSE will be less expensive than it has been historically.

Finally, there is much less risk associated with your money than before. In the past you had $3,548 plus your travel expenses on the line when you sat for the GSE lab. If you did not pass you had a complete financial loss – even if there was a topical area you did very well on. Today, it is no longer an all-or-nothing game. If you fail an Applied Knowledge exam, you can work on your skills and test again without having to retake the Applied Knowledge exams you have already passed.

4. Will the exams I have taken in the hope of getting a GSE still matter? Have you moved the goalposts on me by requiring me to take more courses?

The goalposts have not moved. The key points to know here are:

• There are no training courses specifically associated with Applied Knowledge exams, just as there were no courses associated with the old entrance exam and in-person lab event. In other words, you do not have to take 4 additional training courses under the new program.
• Whichever Practitioner Certifications you have already earned count towards the six you need for the GSE. Nothing you have done is wasted, and all the knowledge will help as you move toward taking the Applied Knowledge exams.
• The three exams we have launched so far line up with the most common certifications, and the ones that were previously required for the GSE. That means if you were preparing for the GSE, your certifications will line up perfectly and preferred pricing will apply.
• The four Applied Knowledge exams replace the four sections of the old live lab.
• Finally, we were very careful to take care of anyone who had signed up for any portion of the GSE under the old process. All those candidates were invited to beta test the new exams in 2022 and some of them are now GSEs.

5. Renewing 10 underlying certifications is going to cost a lot more than it previously cost to renew the GSE. Can you explain how renewal will work and how much it will cost?

We can ensure with absolute certainty that the renewal for the GSE will not cost 10 times the $469 standard renewal price. We are still working through the logistics of changes to the renewal program, as this question impacts more than just GSE holders.

There are many people who hold multiple GIAC certifications. Some may not have the GSE yet; others may never intend to get it. Some people graduate from SANS.edu with a large number of certifications. All these groups add levels of nuance to the renewal program today, and this means that we need to make improvements to our program as a whole, not just for GSE holders. Given the complexity, this will take some time for us to complete. The good news, for those worried about our existing GSEs, is that there will not be a single GSE renewal due before late 2024, so we can take the time we need to get it right.

As we set about improving our program, we want to ensure that people who have multiple certifications (GSE, GSP, or otherwise) are not penalized for having achieved more certifications. That’s our goal, and we look forward to creating a renewal program that will accommodate everyone better.

In the meantime, we have already made some changes you can take advantage of today which will help with renewal. When you earn your GSP or GSE, all your active non-retired certs will renew automatically. This means for those of you who are not yet a GSE, if you earn your GSP certification, all your active non-retired certs will automatically be extended four years. If you go on to earn your GSE, your certifications will extend again.

6. There are only 3 Applied Knowledge Exams, how can I actually earn the GSE if it requires 4?

We have 3 exams now: GX-CS, GX-IA, and GX-IH. We have two more coming by the end of 2023, so you will have choices in what you want your GSE to look like as you contemplate your future in the cyber industry. Additional Applied Knowledge exams will roll out in the future.

These exams are beyond what most have ever seen from GIAC or other certification tests. They take a lot of effort to develop so we need a little more time to get the additional exams ready for launch.

Final Thoughts

With these changes to the program, our goal was to ensure the GSE was extremely challenging to earn for the right reasons. That is to say, it should be challenging because of the content of the exams and the hands-on experience you must have acquired. We do NOT want the GSE to be challenging from the perspective of needing to complete a laundry list of items and arrange mandatory travel.

By simplifying the process while maintaining the highest quality content, the GSE is now more accessible to the thousands of experts globally that exist in our field. We worked extensively with our GSE community throughout our development process so that we could ensure we matched our historical standards of excellence.

We hope this information helps address questions you may have had. We will continue to listen and invest in a program that works for you and our many outstanding certification holders across the globe.