GWEB Exam Dates 2026: Testing Windows, Deadlines & Scheduling

Scope of this article: This guide covers the exam GIAC publishes as the GIAC Certified Web Application Defender (GWEB). It focuses on scheduling mechanics and timeline planning. For the content itself, see our complete guide to all 18 GWEB content areas.

The 120-Day Attempt Window Explained

According to GIAC's Certification Attempt Delivery policy (updated 2025-05-20), initial standalone-attempt access is 120 days from activation. Extensions are available if you need more time. This single number is the backbone of every GWEB scheduling decision.

What the window means for planning

• The clock starts at activation. Do not activate an attempt as a motivational gesture. Activate when you are ready to commit to a preparation schedule.
• The window covers both study and testing. You must book and sit the proctored exam inside it. A late booking can collide with proctor availability.
• Extensions exist but cost planning flexibility. Treat them as a safety net, not a strategy. Check the current policy and pricing page for extension terms before relying on one.

Scheduling Element	What GIAC Publishes
Initial attempt access	120 days from activation (standalone attempt)
Extensions	Available under the Certification Attempt Delivery policy
Exam length	3 hours, one sitting
Question count	75 questions
Minimum passing score	68% (applies to exam versions released on or after 2011-04-01)
Certification validity	4 years

Note that the 68% figure is a score threshold, not a published candidate pass rate. GIAC does not publish pass-rate data on its exam page, which we cover in what the data shows about GWEB pass rates. For the scoring details, see exactly what you need to pass.

Registration, Fees, and What Starts the Clock

GIAC's published pricing sets the financial side of your timeline. The exam fee is USD 999, a retake is USD 899, an optional practice exam is USD 399, and renewal is USD 499. Prices exclude tax. Our complete GWEB pricing breakdown walks through how these combine with optional training.

No prerequisites to begin

There are no prerequisites required to begin the certification process, and training is optional. That removes one common scheduling bottleneck: you do not need to wait for a prior credential or a documented experience period before activating an attempt. The practical eligibility picture is covered in GWEB requirements and how to qualify.

Recommended preparation and its timing

GIAC's recommended preparation for this certification is SANS SEC522: Application Security: Securing Web Applications, APIs, and Microservices. Course hours, labs, and capstones are entirely separate from the proctored exam time. If you take SEC522 in a live or online format, build that calendar first and then place your attempt activation after the course ends, so your 120 days are spent on consolidation rather than first exposure. More on the learning side is in our GWEB training overview.

Pearson VUE vs. ProctorU: Choosing Your Testing Path

GWEB is delivered through two proctoring providers: Pearson VUE for onsite testing and ProctorU for remote testing, subject to the modality GIAC assigns to your attempt. The assignment matters for scheduling because it determines whether you are hunting for a testing-center seat or arranging a quiet, compliant space at home or work.

Factor	Pearson VUE (Onsite)	ProctorU (Remote)
Location	Testing center	Your own environment
Scheduling pressure	Seat availability near you	Room, desk, and connectivity readiness
Paper references	Permitted under GIAC open-book rules	Permitted under GIAC open-book rules
Best planning habit	Book early near your window's end	Test your setup well before exam day

Always confirm your assigned modality and the current procedures on GIAC's proctoring page before you commit to a date, since the provider requirements govern identity checks, workspace rules, and check-in timing.

Working Backward From Your Deadline

Because the 120-day window is the only hard boundary GIAC publishes, the most reliable method is to pick a target test date first and subtract. A reasonable GWEB backward plan looks like this:

1. Fix your target sitting date at least two to three weeks before your window closes, leaving room for a reschedule or a proctor conflict.
2. Reserve the final week for index building and paper-reference review only, with no new material.
3. Place a full-length timed practice session about two weeks out. The real exam is 75 questions in 3 hours, which gives you an average of roughly 2.4 minutes per question, so pacing is a skill to rehearse.
4. Allocate the earliest weeks to the domains where you have the least hands-on experience.

Sequencing the 18 Domains Across Your Window

GIAC publishes 18 exam-objective headings for GWEB but does not publish percentage weights, so you cannot allocate time by official proportion. Instead, sequence by dependency and difficulty. Foundations first, then attack surfaces, then the architectural and emerging-risk topics that build on both. For a deeper breakdown of each heading, read the GWEB study guide alongside this schedule.

This layout fits within roughly 17 weeks, which is just under the 120-day window, and it intentionally leaves any compression to you. Candidates with strong appsec backgrounds can collapse the foundations block; candidates new to web security should protect it.

Why this order works for GWEB

One source caveat is worth knowing: GIAC's outcome description for the XSS Defense and Client-Side Supply Chain heading duplicates wording from the AI/LLM and microservices heading. The published heading is retained here, and the SEC522 syllabus independently covers client-side XSS defenses, so use the heading itself as your guide to scope. Our GWEB difficulty guide discusses which of these areas candidates tend to find hardest.

Exam-Day Rules That Affect Your Booking

GWEB is an open-book exam with paper references. Electronic references, internet access, and any materials containing exam or practice Q&A are prohibited, per the GIAC Proctored Exam Reference Guide. This rule shapes your final-week schedule more than most candidates realize.

• Your index is a deliverable with a deadline. Build it as you study each domain, not in the last few days. Schedule index review the same way you would schedule a lab.
• Do not rely on reference sources that contain practice Q&A. Those materials are prohibited at the table, so your paper references should be course books, notes, and your own summaries.
• Know what you may bring before you book. Confirm the current rules on GIAC's proctor knowledge-base page, since provider procedures govern check-in.

For a compact refresher of high-yield facts to include in your own notes, see the GWEB cheat sheet. When you want to test your readiness under timed conditions, the GWEB practice tests on our main site let you rehearse the 75-question pace before your proctored sitting.

After You Pass: The Four-Year Renewal Cycle

Your scheduling does not end at the exam. A GWEB certification is valid for 4 years. Renewal requires either 36 approved CPE credits earned during the active four-year cycle or passing a renewal exam, plus the renewal fee of USD 499. Mark your expiration date the day you pass and begin logging CPE activity early rather than scrambling in year four.

If you are weighing the long-term return on this timeline, our ROI analysis of the GWEB certification and salary guide cover the career side, and GWEB jobs outlines the roles that tend to value a web application defender credential, such as application security engineers, secure-development leads, and defensive web security specialists. If you are new to the credential entirely, start with what GWEB certification is.

Frequently Asked Questions