GCDA Certification Cost 2026: Complete Pricing Breakdown

The GCDA Fee Schedule at a Glance

The GIAC Certified Detection Analyst (GCDA) is administered by GIAC, and its published pricing is straightforward. The part that surprises most candidates is not the exam fee itself but everything surrounding it: training, retake exposure, and the renewal cycle. This guide breaks down every line item so you can build a realistic budget before you commit.

Here are the official GIAC figures for this credential. All amounts are in US dollars and exclude applicable tax.

You can always confirm current figures on the GIAC pricing page before purchasing, since prices are set by GIAC and may change. For a companion look at difficulty and effort alongside cost, see our guide on how hard the GCDA exam is.

What the $999 Exam Fee Actually Covers

The $999 fee buys one proctored attempt at the certification exam. Understanding what that attempt looks like helps you judge whether you are ready to spend the money.

Exam format you are paying for

• One web-based, proctored exam with 75 questions in a 2-hour window.
• Minimum passing score of 76%, applicable to exam versions released on or after 2026-04-27. Details are in our breakdown of the GCDA passing score.
• Open book with paper references only. Electronic references, internet access, and any materials containing exam or practice Q&A are prohibited.
• Testing providers: Pearson VUE onsite or ProctorU remote, subject to the modality GIAC assigns to your attempt.

The 120-day clock

Under GIAC's Certification Attempt Delivery policy, initial standalone-attempt access is 120 days from activation, and extensions are available. That window matters financially: if you activate the attempt before you have studied, you may end up paying for an extension or, worse, sitting the exam underprepared. Treat activation as the start of a countdown, not a purchase receipt.

No prerequisites, no mandatory course

One of the most useful cost facts is also the simplest: GIAC lists no prerequisites to begin the certification process, and training is optional. That means a candidate with strong SIEM and detection engineering experience could, in principle, pay only the exam fee. A candidate new to the field will almost certainly spend more. Our GCDA requirements guide covers eligibility in more depth.

Training Costs: The Variable Everyone Underestimates

The recommended preparation path for this credential is the SANS course SEC555: Detection Engineering and SIEM Analytics. SANS sets its own pricing and it varies by delivery format and promotions, so check the course page for the current figure rather than relying on a number from a blog. What we can say qualitatively is that for most candidates, training dwarfs the exam fee as a share of total spend.

What SEC555 teaches versus what the exam tests

It is worth being precise here, because the money you spend on training should map to what you will be tested on. GIAC publishes nine exam objectives. The SANS course organizes its material into five teaching sections, and these are supplemental preparation groupings, not the exam outline. The course sections do not establish exhaustive exam coverage. One further wrinkle: the current SEC555 webpage and its linked brochure use different titles for some preparation sections, including Sections 3 and 5. When in doubt, the nine GIAC objectives are authoritative.

The nine objectives you are actually paying to be tested on are:

1. Application and User Monitoring Analytics
2. Application Protocol Analytics
3. Asset and Network Analytics
4. Azure and AWS Logging Overview
5. Defender and Sentinel Overview
6. Endpoint Analytics
7. Log Analysis and Alerting
8. Log Collection and Enrichment
9. SIEM Overview

For a domain-by-domain walkthrough, read our complete guide to all nine GCDA content areas. If you are weighing whether formal training fits your budget, our overview of GCDA training options is a good companion.

Hidden training-adjacent costs

• Lab infrastructure. Detection engineering is hands-on. If you build your own SIEM lab, expect to spend on compute, storage, or cloud credits.
• Cloud accounts. Two exam objectives, Azure and AWS Logging Overview and Defender and Sentinel Overview, reward familiarity with real cloud logging. A free-tier account or trial subscription helps, though you should watch for charges that exceed free limits.
• Printing and indexing. The exam is open book with paper references only. Printing course books, building tabbed indexes, and buying sticky tabs is a small but real cost.

The Optional $399 Practice Exam

GIAC sells an optional practice exam for $399. Whether it is worth buying depends on how you otherwise measure readiness.

One caution that applies to every practice resource: GIAC prohibits bringing materials that contain exam or practice Q&A into the testing session. Keep your indexed paper references clean of practice questions.

Retake Economics

A retake costs $899, a $100 discount from the first-attempt price. That sounds forgiving until you do the math: failing once pushes your exam spending to $1,898 before any training. Our GCDA pass rate article explains an important caveat here: GIAC's published exam source gives a passing score, not a candidate pass rate, so no one can honestly quote you a failure probability.

The better framing is expected value. The retake discount is nice, but the real cost of a failed attempt includes lost study momentum and potentially another extension fee if your access window is running short. Spending a little more on readiness beforehand is almost always cheaper than a second attempt.

Renewal Costs Over the Four-Year Cycle

The certification is valid for 4 years. To renew, you have two routes, and both require paying the $499 renewal fee:

• CPE route: Earn 36 approved CPE credits during your active four-year cycle.
• Exam route: Pass a renewal exam.

The CPE route is usually cheaper in cash terms if you already attend conferences, webinars, or training that qualify. The exam route trades cash and prep time for convenience. GIAC publishes full details on its renewal how-to pages, and you should verify which activities count before assuming a given course or event will be accepted.

Annualized view

Spreading the cost across the validity period gives a clearer picture of ownership. At the published figures, the exam and a single renewal total $1,498 over roughly eight years, before any training. That is the baseline cost of holding the credential through one renewal cycle.

Three Budget Scenarios

Because training is optional and SANS pricing is separate, here is how total spend changes depending on your path. Figures use only GIAC's published fees; add your own SANS and lab costs where indicated.

For a sense of whether the total investment pays off, see our ROI analysis of the GCDA and the GCDA salary guide. We do not publish invented salary numbers here, and neither article should be read as a guarantee for your market.

Where Your Preparation Money Should Go

Because only some of your budget is flexible, direct it where the exam objectives are hardest to learn from reading alone. A short, domain-tied way to think about it:

For the full preparation strategy, our GCDA study guide pairs well with this budget plan, and the GCDA cheat sheet is a handy final-week review.

Getting an Employer to Pay

Detection engineering and SIEM analytics map directly to security operations, threat detection, and incident response work, so employer sponsorship is a realistic ask in many organizations. Think of roles on SOC teams, detection engineering groups, and managed security providers; our GCDA jobs overview covers where the credential tends to show up in postings.

Making the business case

• Bundle the request. Ask for exam fee, training, and renewal together rather than three separate approvals.
• Tie it to detection outcomes. Frame the credential around improving alert quality, reducing noise, and expanding log coverage.
• Clarify ownership. Some employers require repayment if you leave soon after funding. Understand that before signing.
• Plan for renewal. Ask whether CPE-eligible training and conference attendance are already in the team budget, since 36 CPE credits over four years is far easier with employer support.

If you are still orienting yourself on what the credential is, the explainers on what GCDA certification is and what GCDA stands for are quick reads. Remember that here, GCDA means the GIAC Certified Detection Analyst, which is distinct from other credentials that happen to share the acronym. For another look at the same pricing topic, see the GCDA certification cost breakdown, and when you are ready to test your knowledge, head to the GCDA practice test site.

Frequently Asked Questions