GIAC Just Added Three New AI Security Certifications: What GASAE, GAIPS, and GOAA Actually Test

GIAC spent most of 2026 doing something it rarely does: building an entire new certification track from scratch instead of just refreshing an existing exam blueprint. Between April and July, the organization behind some of the most respected hands-on cybersecurity credentials in the industry rolled out three new certifications aimed squarely at one problem: almost nobody securing AI systems today has a way to prove they know how.

The three credentials, the GIAC AI Security Automation Engineer (GASAE), the GIAC AI Platform Security certification (GAIPS), and the GIAC Offensive AI Analyst (GOAA), cover three different jobs that didn’t formally exist a couple of years ago. A fourth is still on the way. None of them are theoretical multiple-choice exercises either. All three use GIAC’s CyberLive format, which means candidates work inside a live virtual lab and complete real tasks rather than picking an answer from a list.

If you’re weighing whether a new GIAC certification is worth the money right now, or you already hold one and are wondering how this changes your next move, here’s what actually launched, what each exam covers, what it costs, and which one (if any) fits the job you actually want.

Why GIAC Built an Entirely New AI Security Track in 2026

This wasn’t a rebrand or a bolt-on badge. Jeremy Rabson, GIAC’s Director of Content and Certifications, put it plainly in GIAC’s own announcement: “As organizations adopt AI, their risk profiles change fast. These certifications give teams and leaders a clear signal of readiness.” That’s a direct response to a hiring market that’s moving faster than most training programs can keep up with.

A few numbers explain the urgency behind the timing:

• More than 60 percent of cybersecurity job listings in 2026 now mention AI, machine learning, or automation skills as a requirement or strong preference, according to industry job-posting analysis.
• Roles like AI Red Teamer, ML Security Engineer, and LLM Security Architect didn’t exist as formal job titles two years ago. They now show up in postings with real budgets attached.
• GIAC and SANS have tied the new track to federal priorities as well, referencing both America’s AI Action Plan and the Department of Defense’s 8140 job-role framework as reasons the credentials needed role-specific, hands-on validation rather than a single generic “AI security” badge.

Microsoft went through a comparable overhaul of its own exam catalog earlier this month, retiring several older role-based certifications in favor of new ones built around agentic AI and Copilot workloads. GIAC’s move follows the same logic from the security side of the industry: the old exam objectives simply didn’t cover what people are actually being asked to secure now.

The Three New Certifications, Broken Down

Each of the three new credentials maps to a specific SANS course, but GIAC’s exams are open enrollment. True to GIAC’s model across its whole catalog, none of the three require you to sit the paired course first, even though the exam objectives are built directly from that course’s content.

GIAC Offensive AI Analyst (GOAA): Weaponizing AI for Red Teams

GOAA is aimed at red teamers, penetration testers, and SOC analysts who need to understand how attackers are already using AI, not just how to defend against it. The certification validates the ability to apply real offensive AI techniques, from automated reconnaissance to AI-assisted exploit development, against realistic environments. It maps to SANS SEC535: Offensive AI – Attack Tools and Techniques.

Exam Format

The GOAA exam runs 56 questions over a 2-hour window, blending traditional multiple-choice questions with CyberLive tasks performed on live virtual machines using real tools. Candidates need a 67 percent passing score. The exam is proctored either remotely through ProctorU or in person through Pearson VUE.

Cost and Renewal

A standalone exam attempt costs 999 dollars, in line with GIAC’s standard pricing for its non-entry-level certifications. Pairing it with the official SEC535 course pushes the total investment past 6,300 dollars, though plenty of self-study candidates skip the course and go straight for the exam. Once earned, GOAA is valid for four years. Renewal opens at the two-year mark and requires 36 continuing professional education credits plus a one-time 499 dollar renewal fee.

GIAC AI Platform Security (GAIPS): Locking Down LLMs and GenAI Pipelines

GAIPS takes the opposite angle from GOAA. Instead of attacking AI systems, it validates the ability to audit and secure generative AI applications and large language model development pipelines, the kind of work an AI platform engineer or application security lead does when a company starts shipping its own GenAI features. It became available for general purchase on July 28, 2026, and maps to SANS SEC545: GenAI and LLM Application Security.

The exam itself runs 54 questions across a 2-hour window, using the same hands-on CyberLive format. Candidates sitting exam versions released on or after July 25, 2026 need a 65 percent passing score. Like the other two new credentials, the standalone exam fee sits at 999 dollars, and both remote and onsite proctoring are available.

GIAC AI Security Automation Engineer (GASAE): Automating Detection and Response with AI

GASAE is the broadest of the three, built for SOC analysts, incident responders, cloud security engineers, and DevSecOps teams who are using AI to accelerate their own operations rather than attack or build AI systems directly. It covers automated vulnerability discovery, AI-driven attack simulation for testing purposes, SOAR-driven incident response, and infrastructure automation workflows. It maps to SANS SEC598: Automate Security with Generative AI and was the first of the three to launch, with its current exam version active since April 10, 2026.

It’s also the longest and toughest exam of the three on paper:

• 82 questions, the most of any of the new certifications
• 3-hour time limit, an hour longer than GAIPS or GOAA
• 70 percent minimum passing score, the highest bar of the three
• 999 dollar standalone exam fee, with 120 days from activation to schedule and complete the attempt

A Fourth Certification Is Still Coming

GIAC and SANS have signaled that a fourth AI-focused credential is on the way before the end of 2026, mapped to SANS SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals. As of publication it hasn’t been named or opened for registration yet, which tracks with how GIAC rolled out the first three roughly a few months apart rather than all at once. Anyone weighing whether to wait for a broader data-science-flavored option should expect that decision to firm up later this year.

You Don’t Have to Wait: A GIAC AI Certification You Can Already Take

If GASAE, GAIPS, and GOAA all sound a little too new to commit to yet, GIAC already has an established option that doesn’t require betting on a brand-new exam blueprint. GIAC’s Machine Learning Engineer certification validates the ability to apply machine learning principles inside a security operations context, and it isn’t sitting still either. Its syllabus was bumped to version 6.1 as of July 27, 2026, so it’s being actively maintained alongside the newer AI-focused push rather than left to go stale.

GMLE tends to be the better starting point if a few things are true for you:

• You want AI security experience on your resume this quarter, not after watching a brand-new exam blueprint settle over its first year
• You’d rather work from prep material that’s already been tested against a live exam than a syllabus with no track record yet
• Your role leans toward applying machine learning to detection and analysis work, rather than red team or platform-security specialization

If none of those quite fit, GMLE still sits alongside the rest of GIAC’s broader security certification catalog, where a more traditional path might make more sense depending on where you are in your career.

Which GIAC AI Certification Actually Fits Your Role?

The fastest way to pick between these is to match the certification to the work, not the acronym. A few questions cut through most of the confusion:

1. Are you trying to break into AI systems to test them, or defend the ones your company already has? GOAA is built for the first, GAIPS for the second.
2. Is your day-to-day work more about automating existing security operations than building or attacking AI itself? GASAE is the closest match.
3. Do you want a credential you can pursue today without waiting on exam maturity data from a brand-new blueprint? GMLE is already established and recently updated.
4. Are you leadership or governance focused rather than hands-on technical? None of the four new-generation credentials are built for that audience specifically, which is worth knowing before you register.

What This Means for AI Security Salaries and Hiring in 2026

None of this is happening in a vacuum. GIAC-certified professionals in the United States earn an average of roughly 134,166 dollars a year as of July 2026, according to ZipRecruiter’s salary data. That’s already ahead of most general IT roles, and the AI-specific slice of the market is pulling numbers higher still. Projected 2026 salaries for LLM Security Engineer roles run from about 160,000 to 230,000 dollars, according to ZipRecruiter’s listings for that title.

Established GIAC credentials give a useful baseline for comparison. PayScale’s data on GIAC Certified Incident Handler (GCIH) holders puts their average salary at around 132,000 dollars a year, a role with real overlap to what GASAE now validates more specifically. The gap between that figure and the newer AI-specific salary ranges is a decent proxy for how much of a premium the market is currently placing on provable AI security skills rather than general security experience alone.

It’s a similar story to what played out when AWS retired its Machine Learning Specialty credential and pushed candidates toward its newer AI-focused certification portfolio earlier this year, or when ISC2 rewrote its CCSP outline to fold in more cloud security content tied to AI risk. Certification bodies across the industry are converging on the same read of the job market at roughly the same time, which is a stronger signal than any single vendor’s announcement on its own.

A Quick Reality Check on GIAC and SANS

PracticeTestSoftware is an independent certification prep provider. We aren’t affiliated with, endorsed by, or sponsored by GIAC or the SANS Institute, and exam blueprints for exams this new tend to shift as GIAC gathers real candidate data. Always confirm current exam objectives, question counts, and pricing directly on GIAC’s own certification pages before you register, since those details are the ones most likely to move in the months after a fresh launch like this one.

Frequently Asked Questions

{
“@context”: “https://schema.org”,
“@type”: “FAQPage”,
“mainEntity”: [
{
“@type”: “Question”,
“name”: “How much does a new GIAC AI certification cost?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “GASAE, GAIPS, and GOAA are all priced at 999 dollars for a standalone exam attempt, matching GIAC’s standard pricing for its non-entry-level certifications. That figure does not include the paired SANS course, which typically runs several thousand dollars more if you choose to take it.”
}
},
{
“@type”: “Question”,
“name”: “Do I have to take a SANS course before I can sit these exams?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “No. GIAC exams are open enrollment, so you can register and test directly. The exam objectives for each new credential are built from its paired course (SEC598 for GASAE, SEC545 for GAIPS, SEC535 for GOAA), but taking that course first is not a requirement.”
}
},
{
“@type”: “Question”,
“name”: “What is the real difference between GASAE and GOAA?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “GASAE is a defensive and operations-focused credential built around using AI to automate detection, response, and cloud security workflows. GOAA is built for offensive work, simulating how attackers actually use AI against a target. They also differ on paper: GASAE runs 82 questions over 3 hours with a 70 percent passing bar, while GOAA runs 56 questions over 2 hours at a 67 percent bar.”
}
},
{
“@type”: “Question”,
“name”: “Is there a GIAC AI certification I can take right now without waiting on a new exam to mature?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “Yes. GIAC Machine Learning Engineer (GMLE) has been part of the catalog and was updated to syllabus version 6.1 on July 27, 2026, making it a well-established option for candidates who want an AI-adjacent credential without registering for one of the brand-new 2026 launches.”
}
},
{
“@type”: “Question”,
“name”: “How does the CyberLive exam format compare to GIAC’s older multiple-choice exams?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “CyberLive exams require candidates to complete real tasks inside a live virtual lab environment within the time limit, rather than selecting answers from a list. GAIPS and GASAE are fully CyberLive, while GOAA blends multiple-choice questions with CyberLive tasks. GIAC has been expanding this format across more of its catalog over the past couple of years.”
}
},
{
“@type”: “Question”,
“name”: “Will GIAC release a fourth AI certification?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “GIAC and SANS have indicated a fourth credential is planned for release by the end of 2026, mapped to SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals. It had not been named or opened for registration as of this article’s publication.”
}
}
]
}