GIAC Cyber Threat Intelligence (GCTI)
GIAC Cyber Threat Intelligence (GCTI) covers the CTI lifecycle, threat actor analysis, kill chain and Diamond Model analysis, structured analytic techniques, and intelligence report writing. The exam is open-book; the candidate's hand-built index is the working reference. 82 questions, 3 hours, 71% passing score, verified against GIAC's current published exam format.
We could not confirm which languages this exam is offered in. Check the owner's page before you book.
Owner: GIAC · Read: · Source: GIAC GCTI certification page
Exam fee at last check: $999, per the vendor. The official objectives are at www.giac.org/certifications/cyber-threat-intelligence-gcti/. Verified 2026-09-26.
Practice is free. The full analysis adds the right answer, the explanation and the source for every question, readiness by domain and a study plan, for one payment.
What's on the exam
CTI Lifecycle and Tradecraft
Direction, collection, processing, analysis, dissemination, feedback.
- Priority Intelligence Requirements (PIRs) and the SANS CTI lifecycle
- Collection management: HUMINT, SIGINT, OSINT, technical telemetry
- Processing: deduplication, normalization, enrichment
- Analytic tradecraft (ICD 203 standards): accuracy, source citation, expression of uncertainty
- Dissemination: tactical, operational, strategic audiences
Primary sources: ICD 203 Analytic Standards, GIAC GCTI certification page
Models and Frameworks
Kill chain, Diamond Model, MITRE ATT&CK, F3EAD.
- Cyber Kill Chain (Hutchins et al. 2011): reconnaissance, weaponization, delivery, exploitation, installation, C2, actions
- Diamond Model: adversary, infrastructure, capability, victim
- MITRE ATT&CK Tactics, Techniques, Sub-techniques, Mitigations
- F3EAD (Find, Fix, Finish, Exploit, Analyze, Disseminate) for IR-aligned CTI
- Pyramid of Pain: indicators by adversary cost to change
Primary sources: Hutchins, Cloppert, Amin: Intelligence-Driven Computer Network Defense (2011), Caltagirone et al.: Diamond Model (2013), MITRE ATT&CK
Threat Actor Analysis and Attribution
Tracking and characterizing threat actors over time.
- Naming conventions across vendors (APT-NNN, BLIZZARD, SPIDER, BEAR, PANDA, etc.)
- Attribution levels of confidence
- Threat actor profiles: motivations, capabilities, infrastructure
- Campaign tracking and cluster analysis
- Sharing standards: STIX 2.1, TAXII 2.1, MISP
Primary sources: STIX 2.1 specification, MITRE ATT&CK Groups catalog
Analytic Techniques
Structured analytic techniques to fight cognitive bias.
- Analysis of Competing Hypotheses (Heuer)
- Key Assumptions Check
- Quality of Information Check
- Devil's Advocacy and Red Team analysis
- Heuer's cognitive biases catalog (anchoring, mirror imaging, satisficing)
Primary sources: Heuer, Pherson: Structured Analytic Techniques for Intelligence Analysis (CIA / CQ Press)
Reporting and Dissemination
Writing intelligence reports that decision-makers can use.
- BLUF (bottom line up front) structure
- Source citation and confidence statements
- Estimative language standards (ICD 203, NIPF probability table)
- Audience-specific products: technical IOC feeds, tactical reports, strategic briefs
- TLP (Traffic Light Protocol) sharing labels
Primary sources: ICD 203 Analytic Standards (estimative language), CISA TLP
Exam-day strategy
Build your open-book index against the SANS FOR578 material plus the primary sources above. Pre-tab pages so you can find ATT&CK technique IDs, Kill Chain phases, Diamond Model vertices, and ICD 203 elements in under 30 seconds.
On every question, identify the framework first (Kill Chain vs Diamond vs ATT&CK vs Heuer). The right answer almost always lives in one specific framework's vocabulary.
Watch for distractors that confuse Kill Chain phases (delivery vs exploitation vs installation) and Diamond Model vertices (capability vs infrastructure).
On structured-analytic-technique questions, the correct technique is the one that specifically addresses the cognitive bias the scenario sets up.
Pace at roughly 2 minutes 30 seconds per question. The 4-hour GIAC exam window is generous; resist the temptation to over-research each question.
How to prepare for GIAC Cyber Threat Intelligence (GCTI)
- EVIDENCE-BACKEDPractice in the same format as the exam. How well practice matches the final test shapes how much it helps. (Yang et al., 2021)
- EVIDENCE-BACKEDStart practice questions in week one, even on topics you have not studied. Failed attempts before seeing the answer still helped learning. (Kornell et al., 2009 and others)
- EVIDENCE-BACKEDSpace your reviews over weeks instead of cramming the week before. (Cepeda et al., 2006 and others)
- PLAUSIBLEDivide the minutes by the questions before you start, and keep a margin for a second pass if the exam allows one. (Sound arithmetic; no study compared time budgets on a licensing exam.)
Why this works
EVIDENCE-BACKED At least one peer-reviewed study or official source found the effect or states the fact. A study can be small.
PLAUSIBLE Reasonable and partly studied, but not tested on exams, or the results are mixed.
Practice that matches the final test format works better than practice that does not.
Failed attempts before seeing the answer still improved later learning of the material asked about; the benefit for material not asked about was virtually nil.
Spacing beat massing across hundreds of experiments and beat cramming with flashcards; combined with retrieval it raised scores on a real high-stakes exam.
Sound arithmetic; no study compared time budgets on a licensing exam.
Sources
- Yang, C., Luo, L., Vadillo, M. A., Yu, R., & Shanks, D. R. (2021). Testing (quizzing) boosts classroom learning: A systematic and meta-analytic review. Psychological Bulletin, 147(4), 399-435. doi.org/10.1037/bul0000309
- Kornell, N., Hays, M. J., & Bjork, R. A. (2009). Unsuccessful retrieval attempts enhance subsequent learning. Journal of Experimental Psychology: Learning, Memory, and Cognition, 35(4), 989-998. doi.org/10.1037/a0015729
- Richland, L. E., Kornell, N., & Kao, L. S. (2009). The pretesting effect: Do unsuccessful retrieval attempts enhance learning? Journal of Experimental Psychology: Applied, 15(3), 243-257. doi.org/10.1037/a0016496
- St. Hilaire, K. J., Chan, J. C. K., & Ahn, D. (2024). Guessing as a learning intervention: A meta-analytic review of the prequestion effect. Psychonomic Bulletin & Review, 31(2), 411-441. doi.org/10.3758/s13423-023-02353-8
- Cepeda, N. J., Pashler, H., Vul, E., Wixted, J. T., & Rohrer, D. (2006). Distributed practice in verbal recall tasks: A review and quantitative synthesis. Psychological Bulletin, 132(3), 354-380. doi.org/10.1037/0033-2909.132.3.354
- Kornell, N. (2009). Optimising learning using flashcards: Spacing is more effective than cramming. Applied Cognitive Psychology, 23(9), 1297-1317. doi.org/10.1002/acp.1537
- Kang, S. H. K. (2016). Spaced repetition promotes efficient and effective learning: Policy implications for instruction. Policy Insights from the Behavioral and Brain Sciences, 3(1), 12-19. doi.org/10.1177/2372732215624708
- Janes, J. L., Dunlosky, J., Rawson, K. A., & Jasnow, A. (2020). Successive relearning improves performance on a high-stakes exam in a difficult biopsychology course. Applied Cognitive Psychology, 34(5), 1118-1132. doi.org/10.1002/acp.3699
Additional resources
Explore Related Cybersecurity Resources
DecipherU is independent of GIAC. GCTI (GIAC Cyber Threat Intelligence) is a trademark of GIAC. DecipherU is not endorsed by, sponsored by, or affiliated with any certifying body.