- The Short Answer: What GWEB Means
- Who Issues the Credential
- Why the Word "Defender" Matters
- What the Name Covers: The 18 Exam Domains
- How the Exam Is Built
- Fees, Registration, and Attempt Access
- Training Behind the Name: SANS SEC522
- Who Uses the Credential
- Validity and Renewal
- Scheduling Your Prep by Domain
- Frequently Asked Questions
- GWEB stands for GIAC Certified Web Application Defender, issued by GIAC Certifications.
- The exam is one proctored, web-based test: 75 questions, 3 hours, 68% minimum passing score.
- GIAC publishes 18 exam-objective headings, from Access Control to XSS Defense and Client-Side Supply Chain, with no official percentage weights.
- The exam fee is USD 999; the certification stays valid for 4 years and renews with 36 CPE credits or a renewal exam.
The Short Answer: What GWEB Means
GWEB stands for GIAC Certified Web Application Defender. It is a cybersecurity certification that tests whether a practitioner can defend web applications, APIs, and the services around them. The acronym is a GIAC naming convention: the "G" marks the credential as part of the GIAC family, and "WEB" signals its focus on web application security.
Because several unrelated credentials and terms in the industry share similar-looking letter combinations, it is worth being precise. On this site, GWEB refers only to the GIAC credential described here: the web application defense certification tied to the SANS SEC522 course. Everything below, including the exam format, fees, and domains, describes that credential and nothing else.
If you want other angles on the same question, see our companion explainers: What Is GWEB?, What Does GWEB Stand For?, and GWEB Meaning. This article goes a step further and unpacks what the name implies about the knowledge you must demonstrate.
Who Issues the Credential
The certification is governed by GIAC Certifications, formerly known as Global Information Assurance Certification, and administered by GIAC, LLC. GIAC credentials are known in the security industry for testing applied knowledge rather than vocabulary recall, and GWEB follows that pattern: the questions emphasize understanding how an attack works and which defensive control actually stops it.
Candidate rules, including conduct expectations and attempt terms, are set out in the GIAC Candidate Agreement. Reading it before you purchase an attempt is a good habit, since it governs what is allowed during the proctored exam and what happens if the rules are broken.
Why the Word "Defender" Matters
The title is "Web Application Defender," not "Web Application Penetration Tester." That distinction shapes how you should think about the exam. You will certainly need to understand how attacks work, because you cannot defend against something you cannot explain. But the center of gravity is on controls: what to configure, what to validate, what to design differently, and what to monitor.
For a deeper look at how demanding that blend is, read How Hard Is the GWEB Exam?
What the Name Covers: The 18 Exam Domains
GIAC publishes 18 exam-objective headings for the certification. They are listed here in the issuer's order. GIAC does not publish official percentage weights for these headings, so any claim that one domain is "worth" a specific share of the exam should be treated with skepticism.
| # | Domain | What it signals for candidates |
|---|---|---|
| 1 | Access Control | Authorization models and the failures that bypass them |
| 2 | AI/LLM and Microservices Security | Modern architectures and the risks they introduce |
| 3 | Authentication | Proving identity and defending login and session mechanisms |
| 4 | Browser Security Features and Clickjacking | Browser-enforced protections and UI redress defenses |
| 5 | Cloud Security and SSRF | Cloud-hosted app risks and server-side request forgery |
| 6 | Cross-Site Scripting and Cross-Site Request Forgery | Two classic client-facing attack families |
| 7 | Deserialization, Business Logic, and Concurrency | Flaws that scanners often miss |
| 8 | HTTP Protocol Introduction | The protocol foundation under every web attack |
| 9 | Injection Foundations | How untrusted input becomes executable behavior |
| 10 | MLSecOps and Threat Modeling | Security practice for ML pipelines and structured threat analysis |
| 11 | Oauth, OIDC, JWT, and SAML | Delegated authorization, identity federation, and token handling |
| 12 | REST and GraphQL API Security | Protecting API-first applications |
| 13 | Same Origin Policy, CORS, and Cross-Origin Attacks | Browser trust boundaries and their misconfigurations |
| 14 | Transport Security and Cryptography | Protecting data in transit and applying crypto correctly |
| 15 | Unicode and Internationalization Security | Encoding and normalization pitfalls |
| 16 | Web Architecture and Configuration | Secure deployment and configuration choices |
| 17 | Web Services Security | Securing service-to-service and SOAP/XML-style interfaces |
| 18 | XSS Defense and Client-Side Supply Chain | Defensive controls for the browser and third-party script risk |
For a domain-by-domain walkthrough, see GWEB Exam Domains: Complete Guide to All 18 Content Areas.
Reading the domain list critically
A few headings deserve extra attention because they show how current the credential is. "AI/LLM and Microservices Security" and "MLSecOps and Threat Modeling" place the exam squarely in the era of AI-integrated applications, which differs from older web security certifications focused on the classic injection-and-XSS canon. At the same time, foundational headings such as "HTTP Protocol Introduction" and "Injection Foundations" confirm that fundamentals still anchor the exam.
Source caveat on XSS Defense and Client-Side Supply Chain
The issuer's published outcome description for this heading repeats wording that belongs to the AI/LLM and microservices material. The heading itself is what GIAC publishes, so it is retained here. The public SEC522 syllabus separately describes client-side XSS defenses, including Content Security Policy and Trusted Types.
- Treat the heading as authoritative for scope.
- Use the SEC522 syllabus topics (CSP, Trusted Types) to fill in the substance.
- Do not rely on this article to replace the issuer's duplicated outcome statement.
How the Exam Is Built
The GWEB exam is a single proctored, web-based test. The published format is:
- Questions: 75
- Time limit: 3 hours
- Minimum passing score: 68%, applicable to exam versions released on or after April 1, 2011
- Delivery: Pearson VUE onsite or ProctorU remote, depending on the modality GIAC assigns
Three hours for 75 questions works out to a comfortable average of roughly two and a half minutes per question, which reflects the scenario-heavy, applied style of GIAC items. The exam is open book with paper references only. Electronic references, internet access, and any materials containing exam or practice questions and answers are prohibited. This makes a well-organized, self-built index one of the most practical tools you can bring.
Important nuance on scope: GIAC states that your account's Certification Information governs the specific objectives, question types, format, and passing score for the attempt you purchase. Check it after purchase rather than assuming this article is the final word. Our GWEB Passing Score guide covers how the 68% threshold applies, and our GWEB Pass Rate analysis explains why no candidate pass rate is published for this exam.
Fees, Registration, and Attempt Access
| Item | Published price (USD, excluding tax) |
|---|---|
| Exam attempt | 999 |
| Retake | 899 |
| Optional practice exam | 399 |
| Renewal | 499 |
A standalone attempt gives you initial access for 120 days from activation, with extensions available under GIAC's attempt delivery policy. That window matters for planning: activate the attempt when you are ready to study intensively, not months ahead. For the complete financial picture, including how training costs fit alongside exam fees, see GWEB Certification Cost: Complete Pricing Breakdown, and for scheduling logistics see GWEB Exam Dates: Testing Windows, Deadlines & Scheduling.
There are no prerequisites to begin the certification process, and training is optional. If you are wondering whether you qualify, the answer is simply that you can register. Our GWEB Requirements guide expands on this.
Training Behind the Name: SANS SEC522
The recommended preparation for GWEB is the SANS course SEC522: Application Security: Securing Web Applications, APIs, and Microservices. The course title itself mirrors the credential's scope: web applications, APIs, and microservices. A public syllabus brochure is available from SANS, and it describes topics such as client-side XSS defenses including CSP and Trusted Types.
Two cautions keep expectations realistic:
- SANS course sections are unweighted preparation curriculum. They inform what to study but do not establish exhaustive exam coverage or official domain counts.
- Course hours, labs, and capstones are separate from the proctored exam time. Time spent in class or in labs does not reduce or change the 3-hour exam.
For a structured approach to turning that curriculum into exam readiness, see the GWEB Study Guide: How to Pass on Your First Attempt and the GWEB Training overview.
Who Uses the Credential
The title "Web Application Defender" points at a fairly clear set of roles. People who tend to find GWEB relevant include:
- Application security engineers who review designs, set secure coding standards, and respond to findings.
- Software developers and architects responsible for building authentication, authorization, and API layers correctly.
- Security analysts and blue-team members who defend internet-facing applications and triage web attack activity.
- DevSecOps and cloud engineers who configure the platforms and pipelines applications run on.
The heavy presence of cloud, API, identity-protocol, and AI-related headings suggests the credential speaks to teams building and operating modern, service-oriented applications rather than only traditional monolithic sites. For role-focused detail, see GWEB Jobs, and for compensation context see the GWEB Salary Guide. If you are weighing the investment, Is the GWEB Certification Worth It? walks through the trade-offs.
Validity and Renewal
A GWEB certification is valid for 4 years. To renew, you complete one of two routes within the active four-year cycle and pay the renewal fee:
- Earn 36 approved CPE credits during the cycle, or
- Pass a renewal exam.
The renewal fee is USD 499. Because the fast-moving topics in the domain list (AI/LLM security, cloud, token-based identity, client-side supply chain) change quickly, the renewal requirement acts as a built-in prompt to keep your knowledge current. GIAC's renewal how-to guide details which activities qualify for CPE credit.
Scheduling Your Prep by Domain
Rather than a generic weekly template, sequence your preparation so that foundational domains come before the ones that depend on them. Here is one logical ordering across a six-week plan, built around the actual domain names:
Foundations
- HTTP Protocol Introduction
- Web Architecture and Configuration
- Injection Foundations
Identity and access
- Authentication
- Access Control
- Oauth, OIDC, JWT, and SAML
The browser trust model
- Same Origin Policy, CORS, and Cross-Origin Attacks
- Cross-Site Scripting and Cross-Site Request Forgery
- Browser Security Features and Clickjacking
- XSS Defense and Client-Side Supply Chain
Services and APIs
- REST and GraphQL API Security
- Web Services Security
- AI/LLM and Microservices Security
Harder-to-spot flaws and platform risk
- Deserialization, Business Logic, and Concurrency
- Cloud Security and SSRF
- Unicode and Internationalization Security
- Transport Security and Cryptography
Synthesis and open-book readiness
- MLSecOps and Threat Modeling
- Finalize your paper index and cross-reference it against all 18 headings
- Timed practice runs sized to 75 questions in 3 hours
The ordering is deliberate: HTTP and injection basics make XSS, CSRF, and SSRF far easier to reason about, and understanding authentication and access control first helps you see why token protocols in the OAuth/OIDC/JWT/SAML domain fail the way they do.
Key Takeaway
Build your paper index alongside your study, one domain at a time, using the 18 published headings as your table of contents. An index organized around the issuer's own domain names is far faster to search under time pressure than one organized by when you happened to learn something. Our GWEB Cheat Sheet shows a compact way to condense the highest-value facts, and you can pressure-test your recall with the practice questions at our GWEB practice test site.
Frequently Asked Questions
GWEB stands for GIAC Certified Web Application Defender. It is issued by GIAC Certifications and focuses on defending web applications, APIs, and related services. For more variations of this question, see What Does GWEB Stand For?
No. There are no prerequisites to begin the certification process, and training is optional. SANS SEC522 is the recommended preparation, but registering for the exam does not require completing it. Details are in our GWEB Requirements guide.
The exam has 75 questions in a 3-hour proctored session, with a 68% minimum passing score. GIAC publishes the passing score but not a candidate pass rate. Your GIAC account's Certification Information governs the exact details of your purchased attempt.
Yes, but only paper references. The exam is open book with paper materials; electronic references, internet access, and anything containing exam or practice questions and answers are prohibited. Follow GIAC's proctoring guidance for your assigned testing modality.
The certification is valid for 4 years. Renewal requires either 36 approved CPE credits earned during the active cycle or a passing renewal exam, plus the USD 499 renewal fee. Prices exclude tax.
Understanding what GWEB means is the first step; the real work is mastering the 18 domains the name implies. Start with What Is GWEB Certification? for the broader picture, then move into GWEB Certification resources to plan your path.