- What the GWEB Credential Actually Is
- Exam Format, Fees, and Testing Mechanics
- The 18 Objective Areas, Grouped by Theme
- The SEC522 Training Path
- Working With an Open-Book, Paper-Only Exam
- Sequencing Your Preparation by Domain
- Who Hires Web Application Defenders
- Keeping the Credential Current
- Frequently Asked Questions
- GWEB is GIAC Certified Web Application Defender: one proctored exam, 75 questions, 3 hours, 68% minimum to pass.
- GIAC publishes 18 exam objective headings but no percentage weights, so study breadth matters more than guessing emphasis.
- The exam is open book with paper references only; electronic materials and practice Q&A content are prohibited.
- The exam costs USD 999; a retake is USD 899, and renewal after four years is USD 499.
What the GWEB Credential Actually Is
GWEB stands for GIAC Certified Web Application Defender. It is issued by GIAC Certifications (formerly Global Information Assurance Certification), administered by GIAC, LLC, and it validates a practitioner's ability to defend web applications, APIs, and the services around them. The word "defender" is the important part: the exam is oriented toward understanding how attacks work well enough to build, configure, and review software that resists them, rather than toward offensive tradecraft for its own sake.
Because the acronym is short, it is worth being precise about scope. This article covers only the GIAC credential. If you are new to the terminology, the explainers at What Is GWEB Certification? and What Does GWEB Stand For? cover the naming in more detail, and GWEB Requirements walks through eligibility.
The headline eligibility fact is simple: no prerequisites are required to begin the certification process, and training is optional. That does not make the exam easy. It means GIAC leaves the decision about readiness to you, and the breadth of the objective list (covered below) is where candidates tend to get surprised.
Exam Format, Fees, and Testing Mechanics
The GWEB attempt is a single web-based proctored exam. The details that matter for planning are below.
| Item | Detail |
|---|---|
| Questions | 75 |
| Time limit | 3 hours |
| Minimum passing score | 68% (applies to exam versions released on or after 2011-04-01) |
| Exam fee | USD 999 (excluding tax) |
| Retake fee | USD 899 |
| Optional practice exam | USD 399 |
| Renewal fee | USD 499 |
| Access window | 120 days from activation for a standalone attempt; extensions available |
| Delivery | Pearson VUE onsite or ProctorU remote, per GIAC's assigned modality |
Two practical points deserve emphasis. First, 68% of 75 questions means you need to answer roughly 51 correctly, though the account-level Certification Information on your GIAC page is the authority for your specific attempt's question types and format. Second, the 120-day activation window is a real constraint if you are balancing a day job; treat activation as the start of a countdown, not a formality. For the full money picture, see GWEB Certification Cost, and for scheduling logistics see GWEB Exam Dates.
The 18 Objective Areas, Grouped by Theme
GIAC lists 18 objective headings for GWEB. It does not publish percentage weights, so you should not assume any one area is "small enough to skip." The cleanest way to absorb 18 headings is to group them by the layer of the stack they protect. The exact heading names are preserved below; for a heading-by-heading walkthrough, see GWEB Exam Domains: Complete Guide to All 18 Content Areas.
Foundations: protocol, architecture, and input handling
HTTP Protocol Introduction; Web Architecture and Configuration; Injection Foundations
These headings establish the vocabulary everything else depends on. If you cannot read a raw HTTP exchange comfortably, later topics become memorization instead of understanding.
- Request and response structure, headers, methods, and state handling
- How components in a web architecture trust (and fail to trust) one another
- Why injection arises: untrusted data crossing into an interpreter, and the defensive patterns that separate data from code
Identity and authorization
Authentication; Access Control; OAuth, OIDC, JWT, and SAML
Three headings cover who a user is, what they may do, and how identity is delegated and asserted across systems.
- Authentication weaknesses and the controls that harden login and session flows
- Access control failures such as broken object-level and function-level authorization
- Token and assertion formats: how JWTs, OAuth flows, OIDC, and SAML are validated, and the classic mistakes in each
Browser-side attacks and defenses
Cross-Site Scripting and Cross-Site Request Forgery; XSS Defense and Client-Side Supply Chain; Same Origin Policy, CORS, and Cross-Origin Attacks; Browser Security Features and Clickjacking
Four headings concentrate on what happens in the browser. Expect to reason about both the attack and the mitigation.
- Output encoding and contextual escaping for XSS; anti-CSRF patterns
- Content Security Policy and Trusted Types as client-side XSS defenses
- What the Same Origin Policy does and does not protect, and how CORS misconfiguration undermines it
- Browser-enforced protections and framing controls against clickjacking
APIs, services, and modern architectures
REST and GraphQL API Security; Web Services Security; AI/LLM and Microservices Security; Cloud Security and SSRF
This cluster reflects how modern applications are actually built: many small services, many APIs, and a cloud environment around them.
- Authorization and rate-limiting problems specific to REST and GraphQL
- Securing SOAP-style and other web service interfaces
- Security concerns when applications integrate AI/LLM components or are decomposed into microservices
- Server-side request forgery and why cloud metadata endpoints make it more dangerous
Deeper application logic and data handling
Deserialization, Business Logic, and Concurrency; Transport Security and Cryptography; Unicode and Internationalization Security
These headings reward candidates who think past the obvious injection categories.
- Unsafe deserialization, workflow abuse, and race conditions
- TLS configuration and sound use of cryptographic primitives
- How character encoding and normalization quirks bypass input filters
Process and security engineering
MLSecOps and Threat Modeling
The remaining heading ties defense to process: identifying threats early and extending security practice to machine-learning pipelines. Expect questions about reasoning methodically rather than recalling a single tool's syntax.
The SEC522 Training Path
The recommended preparation is SANS SEC522: Application Security: Securing Web Applications, APIs, and Microservices. It is a recommendation, not a requirement; anyone can register for the exam without taking it. The public SEC522 brochure describes a curriculum covering client-side XSS defenses, API security, and microservices topics that line up well with the GWEB objective list.
A caution is worth stating plainly: SEC522's sections are unweighted preparation curriculum, and they do not establish exhaustive exam coverage or define the official domain count. Course hours, labs, and capstones are also separate from the 3-hour proctored exam. Use the course as a structured way to learn the material, and use the GIAC objective list as the checklist for what you must be able to answer. For a broader look at training choices, see GWEB Training.
Working With an Open-Book, Paper-Only Exam
GWEB is open book, but only for paper references. Electronic references and internet access are prohibited, and so are materials containing exam or practice Q&A. That combination shapes how you should prepare.
- Your index is a study tool. Building a paper index forces you to organize the 18 objective areas in your own words. A thin, well-labeled index beats a thick, unfamiliar one.
- Lookup speed matters. With 75 questions in 3 hours, you have roughly two and a half minutes per question on average. If every question requires a lookup, you will run short. Reserve the index for details you cannot reliably recall, such as specific header syntax or token validation checklists.
- Know the rules before exam day. Review GIAC's proctoring guidance and the Proctored Exam Reference Guide so a permitted-materials question does not surprise you at check-in. Pearson VUE and ProctorU have different check-in procedures, and GIAC assigns the modality.
Key Takeaway
Use open-book permission to offload fine-grained details (exact header values, flow steps), not to replace understanding. Concepts like why CORS misconfiguration breaks the Same Origin Policy must live in your head; your notes should hold the lookup-friendly specifics. A condensed review sheet is a good companion, and our GWEB Cheat Sheet shows the kind of facts worth capturing.
Sequencing Your Preparation by Domain
Rather than a generic weekly template, order your study so that each topic builds on the one before it. The sequence below follows dependency, not difficulty, and assumes you have the 120-day access window in mind. Stretch or compress it to your own pace; the full planning approach is in the GWEB Study Guide.
Protocol and architecture first
- HTTP Protocol Introduction and Web Architecture and Configuration
- Injection Foundations, so later attack classes have a shared mental model
Identity before delegation
- Authentication and Access Control
- Then OAuth, OIDC, JWT, and SAML, which assume you understand sessions and authorization
The browser cluster together
- Cross-Site Scripting and CSRF, then XSS Defense and Client-Side Supply Chain
- Same Origin Policy and CORS, then Browser Security Features and Clickjacking
Services and platform
- REST and GraphQL API Security and Web Services Security
- AI/LLM and Microservices Security, then Cloud Security and SSRF
The subtle material, then consolidation
- Deserialization, Business Logic, and Concurrency; Transport Security and Cryptography; Unicode and Internationalization Security
- MLSecOps and Threat Modeling, followed by index building and a timed full review
Because GIAC publishes no weights, do not skip a phase on the theory that it is lightly tested. The optional GIAC practice exam (USD 399) is one way to gauge readiness; our own free GWEB practice questions can complement it for topic-level drilling. For an honest read on difficulty before you commit, see How Hard Is the GWEB Exam?.
Who Hires Web Application Defenders
GWEB lines up with roles where the daily job is making applications harder to break. Typical fits include application security engineers, secure-development and DevSecOps practitioners, security-minded software developers, and security consultants or reviewers who assess web applications and APIs. Employers such as software companies, financial and e-commerce firms, and consultancies that review client applications are natural places for this skill set.
We deliberately avoid quoting salary numbers here, since GIAC does not publish them and unsourced figures mislead more than they help. For an honest framing of earning potential and return, see the GWEB Salary Guide, the GWEB ROI analysis, and the role overview at GWEB Jobs.
Keeping the Credential Current
The certification is valid for 4 years. To renew, you need either 36 approved CPE credits earned during the active four-year cycle or a passing renewal exam, plus the USD 499 renewal fee. Starting CPE collection early is far less stressful than scrambling in year four, and activities such as training, conference attendance, and security writing or research may qualify under GIAC's renewal rules. Check GIAC's renewal how-to guide for the current list of approved activity types.
Frequently Asked Questions
No. GIAC does not require prerequisites to begin the certification process, and training is optional. SANS SEC522 is the recommended preparation, but it is not mandatory. See GWEB Requirements for more.
The exam has 75 questions in 3 hours, with a minimum passing score of 68%. Your GIAC account's Certification Information governs the specific question types and format for your purchased attempt.
Yes, paper references are permitted because the exam is open book. Electronic references, internet access, and any materials containing exam or practice Q&A are prohibited, so confirm the rules in GIAC's proctoring guidance before test day.
GIAC publishes the 18 objective headings but no official percentage weights. Prepare across all areas rather than assuming a few dominate. The domains guide covers each heading.
Four years. Renewal requires 36 approved CPE credits earned during the cycle or a passing renewal exam, plus a USD 499 renewal fee.