- The Short Answer: What a GWEB Is
- Who Issues It and How the Credential Works
- Exam Mechanics: Format, Fees, and Rules
- The 18 Domains at a Glance
- Topics That Separate Defenders From Memorizers
- Where SEC522 Fits (and Where It Doesn't)
- Who Needs It and Where It Gets Used
- A Domain-Ordered Preparation Sequence
- Keeping the Credential Active
- Frequently Asked Questions
- GWEB is GIAC Certified Web Application Defender: a defensive web application security credential administered by GIAC, LLC.
- The exam is one proctored sitting: 75 questions in 3 hours, with a 68% minimum passing score.
- Fee is USD 999, retake USD 899, and renewal USD 499 after a four-year validity period.
- GIAC publishes 18 objective headings but no official percentage weights, so cover every domain evenly.
The Short Answer: What a GWEB Is
A GWEB is a person who holds the GIAC Certified Web Application Defender credential, and "GWEB" is also the shorthand for the certification itself. If someone asks "what is a GWEB?" in a hiring or training context, they mean a practitioner who has proven, under proctored exam conditions, that they can defend web applications, APIs, and the services behind them.
The word that matters is defender. Plenty of web security credentials lean toward offense: finding bugs, chaining exploits, writing proof-of-concept payloads. GWEB centers on the other side of the table. It asks whether you can recognize how attacks work well enough to design controls that stop them, from authentication flows and access control models to browser security headers, transport configuration, and API hardening.
This site covers that single credential only. If you are looking for the broader overview, the sibling pages What Is GWEB? and What Does GWEB Stand For? approach the same question from slightly different angles, and the GWEB Certification hub collects the logistics.
Who Issues It and How the Credential Works
The credential is issued by GIAC Certifications (formerly Global Information Assurance Certification), operated through GIAC, LLC. GIAC is the certification body most often paired with SANS Institute training, though the two are distinct: SANS trains, GIAC certifies. You can pursue the certification without attending any course.
Each purchased attempt is tied to your GIAC account. The account's Certification Information governs the specifics of that attempt: objectives, question types, format, and the passing score. That detail matters because the public objectives page is a summary, and your account is the authoritative record for the attempt you actually bought. Standalone attempts begin with 120 days of access from activation, and extensions are available under GIAC's attempt delivery policy.
Exam Mechanics: Format, Fees, and Rules
The exam is a single web-based proctored sitting. Here is the structure at a glance:
| Item | GWEB Detail |
|---|---|
| Questions | 75 |
| Time limit | 3 hours |
| Minimum passing score | 68% |
| Exam fee | USD 999 |
| Retake fee | USD 899 |
| Optional practice exam | USD 399 |
| Renewal fee | USD 499 |
| Validity | 4 years |
| Delivery | Pearson VUE onsite or ProctorU remote, per GIAC's assigned modality |
Prices exclude tax. For a full breakdown of what you will actually spend, including how optional items stack up, read GWEB Certification Cost 2026: Complete Pricing Breakdown.
The 68% line, translated
With 75 questions, 68% works out to roughly 51 correct answers. That is a useful mental anchor, but treat it as an estimate: your account's Certification Information is what governs the passing score and question types for your attempt. GIAC publishes a passing score rather than a candidate pass rate, so any claim about what percentage of people pass should be treated skeptically. Our page on the GWEB passing score and the one on what the pass-rate data does and does not show go deeper.
Open book, with strict limits
The exam is open book, but only for paper references. Electronic references and internet access are prohibited, and so are materials containing exam or practice Q&A. In practice, that shapes how serious candidates prepare: you build an index of your paper materials so you can locate a concept in seconds rather than rereading chapters. Open book rewards organization, not shortcuts. If you have never worked with a self-built index, the GWEB cheat sheet shows the kind of compressed, topic-keyed reference that helps, though remember that anything you bring into the room must comply with GIAC's proctoring rules.
The 18 Domains at a Glance
GIAC publishes the exam objectives as 18 headings. It does not publish percentage weights for them, so there is no official guidance on how many questions come from each area. The rational response is breadth: assume anything on the list can appear, and avoid betting your result on a favorite topic. A fuller walk-through lives in GWEB Exam Domains 2026: Complete Guide to All 18 Content Areas; here is how I would group them mentally.
Foundations and architecture
- HTTP Protocol Introduction
- Web Architecture and Configuration
- Injection Foundations
- Transport Security and Cryptography
Identity, sessions, and trust
- Authentication
- Access Control
- Oauth, OIDC, JWT, and SAML
Browser-side defenses and attacks
- Browser Security Features and Clickjacking
- Cross-Site Scripting and Cross-Site Request Forgery
- Same Origin Policy, CORS, and Cross-Origin Attacks
- XSS Defense and Client-Side Supply Chain
- Unicode and Internationalization Security
Services, APIs, and modern platforms
- REST and GraphQL API Security
- Web Services Security
- AI/LLM and Microservices Security
- Cloud Security and SSRF
Logic, process, and design
- Deserialization, Business Logic, and Concurrency
- MLSecOps and Threat Modeling
Topics That Separate Defenders From Memorizers
Because the exam is open book with paper references, raw recall matters less than reasoning. These are the areas where I would expect conceptual understanding to pay off, based on the domain headings themselves.
Access Control and Authentication
These two domains are about getting the "who are you" and "what may you do" questions right, and they interact with nearly everything else on the list.
- Distinguishing authentication failures from authorization failures in a described scenario
- Recognizing broken object-level and function-level access patterns
- Understanding session handling and where credential or session weaknesses creep in
Oauth, OIDC, JWT, and SAML
Federation and token-based identity are a heavy conceptual lift because four related but different technologies share one domain.
- Knowing which protocol solves which problem (delegated authorization versus identity assertion)
- Spotting token validation mistakes and trust-boundary errors
- Understanding how misconfigured flows turn into account takeover
Same Origin Policy, CORS, and Cross-Origin Attacks
This is where browser security model knowledge becomes practical. Candidates who treat CORS as "just a header" tend to struggle.
- What the same origin policy actually restricts and what it does not
- How overly permissive cross-origin settings expose authenticated data
- How these controls relate to CSRF defenses and clickjacking protections
Cloud Security and SSRF
Server-side request forgery sits beside cloud security for a reason: in cloud-hosted applications, an SSRF flaw can reach internal services and metadata endpoints.
- How SSRF arises when applications fetch attacker-influenced URLs
- Why cloud environments change the blast radius
- Defensive layers: egress restrictions, allow-listing, and network segmentation
Deserialization, Business Logic, and Concurrency
These are the flaws scanners handle poorly, so they reward defenders who think about how an application is supposed to behave.
- Why untrusted serialized data is dangerous
- Business logic abuse that no input filter will catch
- Race conditions and state-handling errors in concurrent requests
Unicode and Internationalization Security
An unusual domain that many web security programs skip entirely. Expect to reason about how encoding and normalization can defeat validation.
- Why filtering before normalization is fragile
- How character-set handling interacts with injection and XSS defenses
Key Takeaway
The most distinctive domains here, such as Unicode and Internationalization Security, MLSecOps and Threat Modeling, and AI/LLM and Microservices Security, are the ones generic web security study plans tend to skip. Make sure your preparation touches each of them before test day.
If you want a candid read on overall difficulty, see How Hard Is the GWEB Exam? Complete Difficulty Guide 2026.
Where SEC522 Fits (and Where It Doesn't)
GIAC's recommended preparation for this credential is SANS SEC522: Application Security: Securing Web Applications, APIs, and Microservices. The course covers the same territory the domain list implies: web application and API defense, client-side protections, and modern architecture concerns.
Two caveats are worth stating plainly. First, the SEC522 syllabus is preparation curriculum, not the exam outline. Its sections are unweighted and do not define exhaustive exam coverage, so use the 18 published domain headings as your scope checklist and SEC522 as one way to learn them. Second, course hours, labs, and capstones are separate from the proctored exam. A great lab performance does not substitute for time spent drilling the kind of scenario questions you will see in a timed multiple-question sitting.
Training is optional, but many candidates find structured courseware valuable for the domains that are new to them. Our overview of GWEB training options compares routes, and the GWEB Study Guide shows how to combine them with self-study.
Who Needs It and Where It Gets Used
Roles that naturally align with a defensive web application credential include:
- Application security engineers embedded with development teams, reviewing designs and fixing classes of flaws.
- Secure software and DevSecOps practitioners building security checks into delivery pipelines.
- Security architects responsible for authentication, API, and cloud-integration patterns.
- Web and API developers who want to move into security-focused work or lead secure-coding practices.
- Security analysts and consultants who assess or advise on web-facing systems.
The domain list tells you what employers get from a GWEB holder: someone fluent in the full lifecycle of web risk, from HTTP fundamentals and threat modeling through identity, APIs, cloud, and client-side supply chain. For how those skills translate into real postings, browse GWEB jobs. For earnings context, the GWEB salary guide discusses what can and cannot be said about pay, and the ROI analysis weighs the USD 999 fee against career outcomes.
A Domain-Ordered Preparation Sequence
Since there are no official weights, an ordering by dependency makes more sense than an ordering by importance. Foundational concepts first, then topics that build on them. Here is one way to sequence a candidate working with several weeks of runway:
Foundations
- HTTP Protocol Introduction and Web Architecture and Configuration, because everything else assumes you can read a request and response fluently
- Injection Foundations and Transport Security and Cryptography
Identity and browser trust
- Authentication, Access Control, and Oauth, OIDC, JWT, and SAML
- Same Origin Policy, CORS, and Cross-Origin Attacks, then Cross-Site Scripting and Cross-Site Request Forgery, Browser Security Features and Clickjacking, and XSS Defense and Client-Side Supply Chain
Services, platforms, and design
- REST and GraphQL API Security, Web Services Security, Cloud Security and SSRF
- AI/LLM and Microservices Security, MLSecOps and Threat Modeling, Deserialization, Business Logic, and Concurrency, Unicode and Internationalization Security
Index and rehearse
- Finalize your paper index against the 18 headings
- Run timed question sets at the 75-questions-in-3-hours pace, using our practice tests
Why this order? Browser trust topics reuse concepts from identity (cookies, tokens, origins), and the services and design topics reuse almost everything before them. If you want a longer plan, the full study guide expands this into a first-attempt strategy.
Keeping the Credential Active
A GWEB certification is valid for four years. To renew, you earn 36 approved CPE credits during the active four-year cycle, or pass a renewal exam, and pay the USD 499 renewal fee. Because web security shifts quickly (the presence of AI/LLM and client-side supply chain topics on the current domain list shows how fast), the renewal cycle is a practical way to keep your knowledge current. Build CPE-earning activity into your work year rather than scrambling in year four.
Frequently Asked Questions
A GWEB is a holder of the GIAC Certified Web Application Defender credential, which validates defensive web application security skills across 18 published domains, from HTTP fundamentals to API, cloud, and client-side security.
No. There are no prerequisites to begin certification, and training is optional. SEC522 is the recommended preparation, but you can pursue the exam through self-study.
The exam has 75 questions with a 3-hour time limit and a 68% minimum passing score. It is delivered as a web-based proctored exam, onsite through Pearson VUE or remotely through ProctorU, depending on GIAC's assigned modality.
The exam is open book with paper references only. Electronic references, internet access, and materials containing exam or practice Q&A are prohibited, so check GIAC's proctoring guidance before test day.
It is valid for four years. Renewal requires 36 approved CPE credits earned in the cycle or a passed renewal exam, plus the USD 499 renewal fee.