GCTI (GIAC Cyber Threat Intelligence)

About the GCTI (GIAC Cyber Threat Intelligence)

GCTI is the GIAC Cyber Threat Intelligence certification, paired most often with SANS FOR578: Cyber Threat Intelligence training. The exam tests strategic, operational, and tactical intelligence work: collection management framework design, structured analytic techniques (ACH, key assumptions check), MITRE ATT&CK mapping, intrusion analysis using the Diamond Model and Kill Chain, threat actor attribution methodology, and intelligence reporting for executive consumers. It is one of two GIAC certs in the CTI lane (GCTI and GREM for malware-side work) and is the credential most commonly listed on senior CTI analyst job descriptions at Mandiant, CrowdStrike, Recorded Future, and federal contractors. DoD 8140 maps GCTI to All-Source Analyst and Cyber Intel Planner work roles.

Who should earn it

SOC Tier 2 and Tier 3 analysts moving into a dedicated CTI seat, incident responders adding strategic intelligence to their tactical IR work, and federal contractor analysts who need the DoD 8140 mapping. The right cert when the role requires producing finished intelligence (FINTEL) for executives, not just IOC feeds.

Exam details

Provider

GIAC

Exam code

GCTI

Questions

82

Duration

3 hours

Passing score

71%

Exam fee

$999 (verify with GIAC)

Renewal

Every 4 years via CPE

Experience level

Advanced

DoD 8570/8140

Approved

Prerequisites

None enforced. GIAC recommends prior incident response or threat-hunting experience and completion of SANS FOR578 (Cyber Threat Intelligence) before sitting the exam. The exam is open-book proctored; prepared candidates bring an indexed reference binder from FOR578 course materials.

Key domains

• Intelligence cycle and collection management framework
• Structured analytic techniques (ACH, key assumptions, red team analysis)
• MITRE ATT&CK and Diamond Model intrusion analysis
• Threat actor attribution and tracking
• Indicators of compromise and IOC management
• Strategic, operational, and tactical intelligence reporting
• OSINT collection and source evaluation

Federal and DoD relevance

The GCTI (GIAC Cyber Threat Intelligence) is approved under DoD Directive 8570.01-M (now 8140), so cybersecurity roles supporting US Department of Defense information systems can use it to satisfy the baseline certification requirement for their IAT, IAM, or CSSP workforce category. That matters for federal contractors, cleared facilities, and agencies where 8140 compliance is a hiring gate.

Salary impact

GCTI is the most-requested CTI-specific cert on senior analyst postings in the $130,000 to $180,000 range. ISC2 2024 Workforce Study reports a measurable compensation premium for practitioners with named CTI credentials versus general SOC certs at comparable experience. GCTI holders working at threat-intel vendors (Mandiant, Recorded Future, Flashpoint) and federal contractors cluster at the higher end of the range due to clearance and vendor specialization.

Most relevant roles