- The Short Answer: What the Letters Mean
- Why the Acronym Sounds Ambiguous
- Who Issues the Credential
- What "Defender" Actually Signals
- The 18 Objective Areas Behind the Name
- Exam Format in One Glance
- Fees, Access Window, and Renewal
- Who Looks for This Credential
- Preparation Path Tied to the Domains
- Frequently Asked Questions
- GWEB stands for GIAC Certified Web Application Defender, issued by GIAC Certifications.
- The exam is one proctored, open-book (paper only) test: 75 questions, 3 hours, 68% to pass.
- GIAC publishes 18 exam-objective headings but no official percentage weights for them.
- Exam fee is USD 999; certification is valid 4 years and renews via 36 CPEs or an exam.
The Short Answer: What the Letters Mean
GWEB stands for GIAC Certified Web Application Defender. The "G" is the issuer's brand prefix (GIAC), and "WEB" compresses "Web Application Defender" into a four-letter code. That is the whole expansion, and it is the only meaning relevant to this site. If you arrived looking for a quick answer to "what does GWEB stand for," you can stop reading here. If you want to understand what the name implies about the exam, the skills it measures, and the employers who care about it, keep going.
For related definitions, see our short explainers on what GWEB is, the meaning of GWEB, and the broader overview of what GWEB certification involves.
Why the Acronym Sounds Ambiguous
Four-letter acronyms collide constantly in IT and security. Searching "GWEB" can surface unrelated credentials, tools, or organizations that happen to share the letters. This article deliberately addresses a single credential: the one administered by GIAC for application security defenders. Every number and objective cited below belongs to that credential and no other.
Who Issues the Credential
GIAC Certifications, formerly known as Global Information Assurance Certification, governs the GWEB credential. The entity that administers it is GIAC, LLC. Candidates agree to the GIAC Candidate Agreement (most recently updated 2025-02-18) when they take the exam, and that agreement, along with GIAC's proctoring and attempt-delivery policies, defines what you may bring, how long you have to complete your attempt, and what happens if you violate exam rules.
GIAC is closely associated with SANS training, and the recommended preparation course for GWEB is SANS SEC522: Application Security: Securing Web Applications, APIs, and Microservices. Training is optional. You can purchase and attempt the exam without taking the course, a point covered in detail in our GWEB requirements guide.
What "Defender" Actually Signals
The word "Defender" in the title matters. It positions the credential on the defensive, engineering side of application security rather than on offensive testing. A candidate is expected to understand how attacks against web applications work, but the point of that knowledge is recognizing weaknesses and building or configuring controls that stop them.
Defensive Thinking in Practice
In exam terms, "defender" translates to questions that ask what control prevents a given attack, what misconfiguration enables it, or which design choice reduces exposure. Expect to reason about both sides: why a flaw exists and how to close it.
- Recognize the weakness: identify the flaw class from a described behavior or snippet.
- Explain the mechanism: know why the attack works at the protocol, browser, or application layer.
- Choose the countermeasure: select the control, header, library behavior, or architectural change that mitigates it.
The 18 Objective Areas Behind the Name
GIAC publishes 18 exam-objective headings for GWEB. Unlike some certifications, the public source lists no official percentage weights, so you should not assume any domain is worth more than another based on published data. Treat the list as a coverage map. For deeper treatment of each area, see our complete guide to all 18 GWEB content areas.
| # | Published Objective Heading | Theme |
|---|---|---|
| 1 | Access Control | Authorization models and enforcement |
| 2 | AI/LLM and Microservices Security | Modern service and model-driven architectures |
| 3 | Authentication | Verifying identity and protecting sessions |
| 4 | Browser Security Features and Clickjacking | Client-enforced protections |
| 5 | Cloud Security and SSRF | Cloud-hosted app risks |
| 6 | Cross-Site Scripting and Cross-Site Request Forgery | Classic client-side attack classes |
| 7 | Deserialization, Business Logic, and Concurrency | Logic and state-handling flaws |
| 8 | HTTP Protocol Introduction | Protocol foundations |
| 9 | Injection Foundations | Untrusted input reaching interpreters |
| 10 | MLSecOps and Threat Modeling | Security process and ML pipeline risk |
| 11 | Oauth, OIDC, JWT, and SAML | Federated identity and tokens |
| 12 | REST and GraphQL API Security | API-specific attack surface |
| 13 | Same Origin Policy, CORS, and Cross-Origin Attacks | Browser trust boundaries |
| 14 | Transport Security and Cryptography | TLS and applied crypto |
| 15 | Unicode and Internationalization Security | Encoding and normalization pitfalls |
| 16 | Web Architecture and Configuration | Deployment and server configuration |
| 17 | Web Services Security | SOAP/XML-style service concerns |
| 18 | XSS Defense and Client-Side Supply Chain | Output defenses and third-party script risk |
Reading the Domain List Critically
The range of topics tells you what "Web Application Defender" now encompasses. It is far broader than the old "OWASP Top 10 and a firewall" picture.
- Core web attacks (injection, XSS, CSRF, access control) sit alongside identity standards (OAuth, OIDC, JWT, SAML).
- Modern architecture is explicit: APIs, GraphQL, microservices, cloud, and AI/LLM security appear as named headings.
- Foundational topics such as HTTP, transport security, and Unicode handling show that protocol-level fluency is tested, not just attack names.
Exam Format in One Glance
GWEB is delivered as a single web-based proctored exam. The core parameters:
- Questions: 75
- Time limit: 3 hours
- Minimum passing score: 68% (applicable to exam versions released on or after 2011-04-01)
- Open book: paper references are allowed; electronic references, internet access, and materials containing exam or practice Q&A are prohibited
- Proctoring: Pearson VUE onsite or ProctorU remote, depending on the modality GIAC assigns
Because the exam is open book with paper materials, the name "Defender" is earned through applied understanding rather than recall alone. Candidates commonly build indexed notes to locate details quickly, but an index only helps if you already understand the concepts well enough to know what to look up. Our GWEB cheat sheet and passing score breakdown cover those mechanics further.
Key Takeaway
GIAC publishes a passing score (68%), not a candidate pass rate. Be skeptical of any site quoting a precise pass percentage; our pass rate analysis explains what the available evidence does and does not show. Your actual attempt's objectives, question types, and scoring details are governed by the Certification Information in your GIAC account.
Fees, Access Window, and Renewal
The concrete administrative facts, per GIAC's published pricing and policies (prices exclude tax):
| Item | Detail |
|---|---|
| Exam fee | USD 999 |
| Retake | USD 899 |
| Optional practice exam | USD 399 |
| Renewal fee | USD 499 |
| Standalone attempt access | 120 days from activation (extensions available) |
| Certification validity | 4 years |
| Renewal requirement | 36 approved CPE credits earned in the active cycle, or pass a renewal exam, plus the renewal fee |
That 120-day window is worth planning around: it starts at activation, not at your first study session, so schedule activation when your preparation is nearly complete. For a full breakdown of what you will spend, see the GWEB certification cost guide, and for scheduling logistics see GWEB exam dates and deadlines.
Who Looks for This Credential
Because GWEB certifies defensive web and API security skill, it appeals to organizations that build, host, or assess web-facing software. Typical roles where the credential is relevant include:
- Application security engineers embedded in development organizations who review designs and code for the flaw classes in the 18 domains.
- Secure software developers who want formal validation of defensive coding practice.
- Security analysts and architects responsible for web, API, and cloud-hosted application risk.
- Consultants and assessors whose clients value a recognized GIAC credential.
We deliberately do not quote salary figures here, because we only publish numbers we can source. For a qualitative look at compensation drivers, read the GWEB salary guide, browse GWEB jobs, and weigh the investment using our ROI analysis.
Preparation Path Tied to the Domains
The recommended training is SANS SEC522, whose public syllabus is a useful topic reference. Course sections are unweighted curriculum; they inform what to study but do not define the exam's exact coverage, and course hours and labs are separate from the proctored exam time. Our GWEB study guide and training overview go deeper.
One way to sequence the 18 areas, building from foundations upward:
Foundations first
- HTTP Protocol Introduction and Web Architecture and Configuration, since every later attack builds on request/response behavior.
- Transport Security and Cryptography, so TLS and token concepts are solid before federated identity.
- Injection Foundations and Unicode and Internationalization Security.
Browser and identity
- Same Origin Policy, CORS, and Cross-Origin Attacks; Browser Security Features and Clickjacking.
- Cross-Site Scripting and CSRF, then XSS Defense and Client-Side Supply Chain (CSP, Trusted Types).
- Authentication, Access Control, and Oauth, OIDC, JWT, and SAML.
Services, architecture, and process
- REST and GraphQL API Security, Web Services Security, and Cloud Security and SSRF.
- Deserialization, Business Logic, and Concurrency; AI/LLM and Microservices Security.
- MLSecOps and Threat Modeling, then timed review and paper-index building.
Adjust the pacing to your background: an experienced developer may compress the foundations, while a network-focused analyst may want extra time on identity protocols and browser security. To gauge readiness, check how hard the GWEB exam is and then use timed questions on our practice test platform to locate weak domains before you activate your attempt.
Frequently Asked Questions
GWEB stands for GIAC Certified Web Application Defender, a certification issued by GIAC Certifications that validates defensive web application and API security knowledge. See also our page on what GWEB means.
No. There are no prerequisites to begin the certification process, and training is optional. SANS SEC522 is the recommended preparation, but you may purchase and attempt the exam independently.
The exam has 75 questions and a 3-hour time limit, with a minimum passing score of 68%. It is open book using paper references only; electronic materials and internet access are prohibited.
GWEB is valid for 4 years. To renew you need 36 approved CPE credits earned during the active cycle or a passing renewal exam, plus the renewal fee of USD 499.
GIAC sells an optional practice exam for USD 399, and you can also drill domain-by-domain questions on our GWEB practice test site. Remember that materials containing actual exam or practice Q&A are not allowed in the testing room.