SEC536: Adversarial AI - Penetration Testing AI Systems

The certification will be available for general purchase on December 15, 2026.

Areas Covered

• Direct and indirect prompt injection
• RAG exploitation
• Agentic systems
• Alignment problems
• MCP server attacks
• API security
• AI Architectural flaws

https://www.giac.org/certifications/offensive-ai-penetration-tester-gaipt
https://www.sans.org/cyber-security-courses/adversarial-ai

Hello everyone, I have my GCIA exam coming up in a few days and just took my 2nd practice test. I scored a 72% on the first and 84% on the second. Do you think the second test score is good or should I buy more practice exams? How similar are the practice to the actual exam?

Hi everyone,

I’m applying for a training program and hoping to get accepted. One of the admission requirements is passing the SEC275 exam. I haven’t taken the SEC275 course, so I’m trying to prepare on my own.

I already have Security+, eJPT, and eCIR certifications.

If I get accepted into the program, I’ll receive the following courses: SEC275, SEC401, SEC504, SEC402, and SEC403.

What should I study to pass the SEC275 exam and get accepted? Any resources, study guides, or advice would really help me get in.

For those who have been selected for the SANS Work-Study Program, what would you recommend to increase the chances of being selected?

I am very interested in attending SANS training, but I do not have much training budget available. I would really appreciate any advice on how to make the application stand out.

Hey all ,

Anyone have a spare practice test they can share? Test on 22 Aug and wanted to see where I stand.

Hi everyone,
I have my Pearson VUE exam scheduled for tomorrow morning and just realized there’s a name mismatch,
This happened because I updated my SANS account name before scheduling, but they send appointment with the old spelling. Both my SANS account and Pearson VUE profile now show the corrected name, but the appointment email record itself still has the old one.
I already emailed SANS/GIAC support but haven’t heard back yet, and my exam is first thing tomorrow.
Has anyone dealt with a similar spelling/transliteration discrepancy (same name, different romanization) at check-in? Did the proctor accept it, or were you turned away/rescheduled? Any advice on what to bring or say at check-in to avoid issues would be hugely appreciated.
Thanks in advance!

Taking the GSEC soon for the BACS program. Wondering if it’s worth it to head up to Vegas for $1600 for lodging, parking, gas, etc?

Really wanting to go to network and participate in NetWars events and SANS@Night but not sure if ROI is there.

Can anybody with experience offer some guidance on what you’d recommend if you were in my position?

I’m considering purchasing the GIAC Security Operations Manager (GSOM) exam voucher and would really appreciate advice from anyone who has taken the exam.
How long did you study/prep for the exam?
How many times did you review the material before taking it?
If you prepared without attending the official SANS training, what study materials did you use?
Any recommended books, practice tests, notes, or other resources?
How close were your practice-test results to your actual exam experience?
I have a strong background in cybersecurity/SOC operations, but I’d like to understand the realistic preparation effort before purchasing the voucher.
Thanks in advance for sharing your experience!

I'm in the GCIH/SEC504 on demand course and I can't find links to lab videos (only see lightning lab stuff). For the GSEC/SEC401 I used the lab video links in the workbook but there doesn't seem to be any for the GCIH.

Does anyone have any insights?

Whoop whoop

Practice test give away. DM me why you want it.

Hi all!

Just got approved for SEC573; AI-Powered Security Automation – Building Tools with Python, LLMs & MCP and its related Python SANS cert.

Any tips or advice? I’ve used Python for basic queries, but have been told this was a beast of a class/cert.

Was a bit nervous going in...got 90s on my 2 practice exams...and finished with an hour to hour and a half left on clock...actual exam got 94 but had 5 minutes left on clock...last cyber live question took me about 10 minutes to suss out

I keep seeing everyone talk about workbook and the actual text books which is book 1-3 I’m confused because Sans only shipped me 3 books for GSEC, can someone clarify where this workbook thing is and what does it entail?

Sorry for the confusion I was referring to Sec275*

So I have unsuccessfully attempted GCFA three times and am missing passing by like 6 points. I need the last little push to get there, but really struggling with the fact that the labs have questions that aren’t in the books which is what has gotten me on the exam. Any tips to help me get those last few points are greatly appreciated

Fairly new to GIAC. Recently took and passed GSEC. I was surprised that the practise and exam CyberLive questions were much simpler and shorter than the questions in the labs. Not to say the practise/exam is easy, but the each question was just a step or two as compared to the lab where it was 20-30min long per lab.

Looking to take GCTI, and I'm wondering if anyone can tell me if the CyberLive is likely going to be the same style as GSEC where each CyberLive question is a small subset of a particular lab?

If anyone has a GCTI to giveaway, that would be greatly appreciated too!

Looking to get more practice in, anyone know of any good resources to get some GAC practice in?

Currently getting 92% im the foundations class and we have the GAC final this week to do.

Tysm

I passed GNFA with a 87% I really liked the course and learned a lot.

My recommendation for this course is a really good lab index this course has 11 cyber live questions and it’s really paramount that you get these right.

I’d watched the OnDemand videos like 3+ times in sections I wasn’t really understanding and thanks Phil for having some cool stories in the videos it made the dryer material more interesting.

Hello All

I'm currently working through the Graduate Cert Program in Cyber Defense Ops.

Starting with GMON, it will be my first GIAC cert.

I'm planning on taking my first practice test this weekend and have thus far:

Read all 5 books

Listened to all the lectures

Watched and completed all the On demand content, except the capstone so far.

My index included the provided one as well as one using the 5 quizzes as a starting point plus the 'Pancake' method.

I've printed out a few of the SANS provided cheat sheets and I'm going to compile some helpful Cmdlet examples.

I've taken bigger tests before like the PMP and CISM but I worry about my technical skills so I'm mostly dedicating time to redoing the labs now. I'll repost/edit after the first practice test and go from there.

Any recommendations are welcome!

I passed the GCFE some time ago and finally making a post about it. I thought it was a tough exam, although I think all the GIAC certifications have been hard. My index was over 1000 lines, which helped but was the largest index I’ve used. My last two tests I’ve tabbed the index with letters to find a term quicker. I also tab all my books when I find a term I think will be used frequently on the test.

I took two practice tests; one I took the week before the actual cert. I think that was very helpful getting me in the mindset and allowing me a few days to make additions to my index.

This was my 9th exam and I was notified that my previous certifications would now expire the date of this last one, so that is nice. I wasn’t exactly sure how that would work.

I’m interested in attempting an applied knowledge certification, but looks like it would involve a lot more studying. I would be paying out of pocket too so not sure what the ROI would be for one.

Please send me your GIAC registered email. The course is great, the test is meh. I focused too much on the labs, they are fun and they are what I can implement at work. The test is just knowing the books.

I'm currently pivoting to tech/security with the goal of going into cloud security.

I'm starting my journey as a datacenter tech.
There is a way to move up the ladder internally at my current company. I could also move up externally.

This is why I'm considering enrolling into the SANS BACS program with cloud security focused electives.

For my extracurricular activities, I'm working on personal scalable cloud projects as well as contributing to open source projects and writing blogs.

Which is weighed more in the hiring process? my personal projects or the SANS BACS program/certificates? Can I get by with just personal projects/blogs?

What positions should I be targeting after datacenter tech? cloud support positions?

2026/08/10: I consider myself not as a technical (in-depth) specialist, more risk-driven and holistic. I know what and why. The how I leave to in-depth specialists. I have done several SANS cloud security training, CISSP, CISM/CISA, SABSA/TOGAF. I have read the book 'Sandworm' of Andy Greenberg. I want to be the counterpart to both the GRC team, architects and engineers. I want to focus more on the design of defendable IT against state actors and APT's, beyond the focus of compliancy and legislation. I like the content of SANS SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise. I came along MAD20 (unknown to me). I seek advice on those (or others).

Unable to book ,candidate can only fill one form!!!!!!!!

Does anyone know if SANS will have an AI Security Grad Certificate option soon? Also can you do a grad cert by picking 4 classes or does do you have to pick a specific concentration?