GWEB Certification Cost 2026: Complete Pricing Breakdown

The GIAC Price List for GWEB

GIAC Certified Web Application Defender (GWEB) is issued by GIAC Certifications, administered by GIAC, LLC. Unlike many vendor credentials, the published fee structure is short and easy to model. Here are the line items you can plan around, all drawn from GIAC's public pricing page:

All of these exclude tax, so your final invoice may be higher depending on where you are billed. Because GIAC's pricing can be updated, always confirm the live figures on GIAC's pricing page before you budget. If you want the wider picture of how this spending fits into a career decision, our GWEB ROI analysis weighs cost against outcomes.

What the $999 Exam Fee Actually Buys

The exam fee buys one proctored attempt at a single web-based test: 75 questions in 3 hours, with a minimum passing score of 68% (applicable to exam versions released on or after 2011-04-01). That works out to roughly 2.4 minutes per question, which matters for how you think about value. You are not paying for a lengthy multi-part assessment; you are paying for a dense, time-pressured attempt at an exam that rewards applied knowledge across 18 objective areas.

Delivery runs through Pearson VUE (onsite) or ProctorU (remote), depending on the modality GIAC assigns to your attempt. The fee does not change based on which provider you use. For details on scoring and what the threshold means for your preparation, see our guide to the GWEB passing score.

The Training Question: Optional but Expensive

Here is the single biggest swing factor in your total cost: GIAC does not require any prerequisites to begin the GWEB certification process, and training is optional. The recommended preparation is the SANS course SEC522: Application Security: Securing Web Applications, APIs, and Microservices. The SANS course is a separate purchase from the GIAC exam fee, and its pricing is set by SANS rather than GIAC. Check the SEC522 course page for current rates and delivery formats.

What does SEC522 give you? According to the public syllabus, it covers the defensive territory that maps closely onto GWEB topics: authentication and access control, injection foundations, cross-site scripting and CSRF defenses (including CSP and Trusted Types), API security for REST and GraphQL, OAuth/OIDC/JWT/SAML, and more. The syllabus is a preparation curriculum rather than an official statement of exam coverage, so treat it as a strong guide, not a guarantee of every tested item. Course hours, labs, and capstones are also separate from the proctored exam time.

If you are weighing whether to pay for the course or self-study, our GWEB training overview and GWEB study guide lay out both paths. The honest framing: training is optional, so the real question is whether your existing web-security experience already covers the 18 areas, or whether structured instruction will save you from an $899 retake.

Is the $399 Practice Exam Worth It?

GIAC sells an optional practice exam at $399. Think of it as a diagnostic rather than a study resource: it tells you how your preparation holds up against GIAC's own question style before you commit $999 to the real attempt. The decision comes down to a simple comparison:

• Practice exam cost: $399, which is meaningfully less than the $899 retake fee.
• What it prevents: walking into the proctored exam without knowing whether your paper index actually works under time pressure.
• What it does not replace: broad topic coverage. A practice exam samples; it does not teach.

If budget is tight, a lower-cost alternative is to use third-party practice questions from the GWEB practice test site to find weak domains first, then decide whether the official practice exam is still worth buying. Remember that materials containing real exam Q&A are prohibited from the testing room, so use only legitimate practice content when building your reference binder.

Retake Costs and the 120-Day Clock

Two policies shape your real-world cost more than any single price tag: the retake fee and the access window.

Retakes: A retake costs $899, only $100 less than the first attempt. That small discount means a failed attempt is nearly as costly as starting over. Our look at how hard the GWEB exam is can help you judge whether you are ready, and the GWEB pass rate article explains why no official candidate pass rate is published, only a passing score.

The 120-day window: Under GIAC's Certification Attempt Delivery policy, initial standalone-attempt access runs 120 days from activation, and extensions are available. Extensions may carry their own cost, so verify the current terms on the attempt delivery policy page. The practical lesson: do not activate your attempt until you are close to ready, because the clock starts at activation, not at purchase intent. For scheduling mechanics, see GWEB exam dates and scheduling.

Renewal and the Four-Year Cost Picture

GWEB is valid for 4 years. To renew, you need 36 approved CPE credits earned during your active four-year cycle, or you can pass a renewal exam, plus the $499 renewal fee in either case. The details are laid out in GIAC's renewal instructions.

For budgeting, the base four-year cost of holding the credential, if you pass on the first try and renew via CPEs, is the exam fee plus the renewal fee: $999 + $499 = $1,498, before tax and before any training. CPE credits can often be earned through activities you may already do, such as conferences, webinars, and relevant work, which can keep the credit side of renewal inexpensive. But the cost of earning those credits depends on how you choose to earn them, and approval standards apply. Budget a little time every year, not a scramble in year four.

Three Budget Scenarios Compared

The fixed GIAC costs are only part of the story. These scenarios show how your choices change the total, using only the published GIAC figures. SANS course pricing varies, so it is shown as a separate line to look up rather than a number.

The comparison shows why the practice exam can be a rational purchase: the $399 spent on a diagnostic is less than half the cost of a retake. Whether you also add SANS SEC522 on top of any of these scenarios depends on your background, and the course fee is the largest variable in the whole equation. Our GWEB requirements guide confirms there is no mandatory training step, which keeps the self-study route fully legitimate.

Where Prep Money Should Go: Mapping Spend to Domains

GIAC publishes 18 exam objective areas without official percentage weights, so you cannot rank domains by their share of the exam. What you can do is spend your limited prep money where your personal gaps are largest. Our complete guide to all 18 GWEB content areas walks through each one. Here are three clusters where candidates commonly need to invest the most effort:

A note on one source quirk worth knowing: GIAC's outcome description for the XSS Defense and Client-Side Supply Chain objective duplicates AI/LLM and microservices wording, although the heading itself is clear. Since the linked SEC522 syllabus independently describes client-side XSS defenses, use it to fill in what that domain heading implies, while remembering that your own GIAC account's Certification Information governs the objectives for your purchased attempt.

If you only have budget for a modest study plan, a sensible sequencing logic is to build foundations first (HTTP Protocol Introduction, Web Architecture and Configuration, Injection Foundations) before the identity and cross-origin clusters, because later topics assume you can read raw HTTP traffic. Our GWEB cheat sheet is a handy one-page companion for that review.

Getting an Employer to Pay

Many candidates never pay the full amount themselves. Because GWEB sits squarely in application security, it is the kind of credential that security, DevSecOps, and engineering managers often sponsor. To make the request easier to approve:

• Tie it to a project: link the 18 objective areas (for example, API security, authentication, or cloud SSRF) to systems your team is actively building.
• Present the whole cost: exam fee, optional practice exam, any training, and the $499 renewal at year four, so there are no surprises.
• Offer a retake plan: acknowledge the $899 retake fee up front and propose how you will avoid needing it.
• Ask about CPE support: conference attendance that earns CPE credits also helps your renewal.

Roles that value web application defense skills include application security engineers, secure code reviewers, penetration testers, and DevSecOps staff. See GWEB jobs for how employers frame these roles, and the GWEB salary guide for earnings context. We do not quote specific salary figures here, since we avoid unsourced numbers.

Frequently Asked Questions

For a broader view of what the credential represents before you commit funds, read what GWEB certification is, then compare the numbers above against your own career goals and employer support options.