What Is GWEB?

What GWEB Is (and Which GWEB We Mean)

GWEB stands for GIAC Certified Web Application Defender. It is a defensive application security credential: the exam tests whether you can recognize web, API, and microservice weaknesses and, more importantly, apply the controls that stop them. Several unrelated credentials in other industries share the same four letters. This site and this article concern only the GIAC certification, and everything below applies to that credential alone.

If you are comparing terminology across our other explainers, the same certification is covered from different angles in What Does GWEB Stand For? and What Is GWEB Certification?. This guide is the broad orientation: what the credential is, how the exam is built, what it covers, and who it suits.

Who Runs It and How the Credential Works

The credential is governed by GIAC Certifications (formerly Global Information Assurance Certification) and administered by GIAC, LLC. GIAC certifications are closely associated with SANS Institute training, and GWEB aligns with the SANS course SEC522, Application Security: Securing Web Applications, APIs, and Microservices. However, taking the course is not a condition for sitting the exam.

The certification process has no prerequisites. You can purchase an attempt, schedule it, and test without holding any other credential or work-history requirement. For the full picture of eligibility, see GWEB Requirements.

Your GIAC account is the source of truth for your specific attempt. Its Certification Information page governs the objectives, question types, format, and passing score that apply to the attempt you purchased, so check it after activation rather than relying solely on third-party summaries, including this one.

The Exam Itself: Format, Proctoring, and Rules

Pacing the 75 questions

Three hours across 75 questions averages out to roughly two and a half minutes per question. That sounds generous until you hit scenario items that require reading a request, a header set, or a token and deciding what is wrong. Because the exam is open book, the time pressure is less about recall and more about how quickly you can locate and interpret your own notes.

The open-book rule and its limits

GIAC permits paper references. It prohibits electronic references, internet access, and any materials containing exam or practice question-and-answer content. That last restriction matters for how you build your reference set: organize your own notes, indexes, and course books by topic, and never lean on question-bank content as a printed reference. Review GIAC's proctoring guidance before test day, since remote and onsite rules differ in practical details.

The 18 Published Exam Objectives

GIAC's public certification page lists 18 objective headings. It does not publish percentage weights for them, so no domain should be treated as officially "worth" more than another. The headings are:

1. Access Control
2. AI/LLM and Microservices Security
3. Authentication
4. Browser Security Features and Clickjacking
5. Cloud Security and SSRF
6. Cross-Site Scripting and Cross-Site Request Forgery
7. Deserialization, Business Logic, and Concurrency
8. HTTP Protocol Introduction
9. Injection Foundations
10. MLSecOps and Threat Modeling
11. Oauth, OIDC, JWT, and SAML
12. REST and GraphQL API Security
13. Same Origin Policy, CORS, and Cross-Origin Attacks
14. Transport Security and Cryptography
15. Unicode and Internationalization Security
16. Web Architecture and Configuration
17. Web Services Security
18. XSS Defense and Client-Side Supply Chain

For a deeper treatment of each heading, see GWEB Exam Domains: Complete Guide to All 18 Content Areas.

What a Candidate Actually Has to Master

Reading the headings as clusters makes the scope less intimidating. The 18 objectives group naturally into several families of skills.

Candidates who come from pure penetration testing often find that the defensive framing, along with the AI/LLM and threat modeling material, needs deliberate attention. Our difficulty guide discusses where different backgrounds tend to feel friction.

Training and Preparation Path

The recommended preparation is the SANS course SEC522, Application Security: Securing Web Applications, APIs, and Microservices. SANS publishes a public syllabus brochure outlining the course sections. Those sections are unweighted curriculum, so they inform what to study but do not establish exhaustive exam coverage or an official domain count. Course hours, labs, and capstones are separate from the 3-hour proctored exam.

Training is optional. Experienced application security engineers sometimes self-prepare using the 18 objective headings as a checklist. Either way, the quality of your paper reference set determines how well you can exploit the open-book format. Build an index that maps each objective heading to where you recorded the key controls, configuration values, and attack-to-defense pairings.

For a step-by-step approach, read the GWEB Study Guide, and for a compact refresher near exam day, the GWEB Cheat Sheet. You can also gauge your readiness with timed questions on our GWEB practice test site. More on structured learning options is in GWEB Training.

Fees, Attempt Windows, and Renewal

The 120-day window starts at activation, not at purchase, so activate when your preparation timeline is realistic. Extensions exist if life intervenes, but plan around the initial window. The full breakdown of what these numbers mean for your budget is in GWEB Certification Cost, and scheduling mechanics are covered in GWEB Exam Dates.

Renewing after four years

The credential is valid for 4 years. To renew, you need either 36 approved CPE credits earned during your active four-year cycle or a passing renewal exam, in addition to paying the renewal fee. Because CPE credits must be earned within the cycle, it pays to log relevant activities (conference talks, training, security research, internal knowledge sharing) as you go rather than scrambling at the end.

Who Benefits From GWEB

GWEB targets people who build, review, or defend web-facing software. Typical fits include application security engineers, secure-development leads, DevSecOps practitioners, security-minded developers, and defenders responsible for protecting APIs and microservices. Organizations that run large web estates or ship customer-facing platforms tend to value the credential because it signals defensive, implementation-level knowledge rather than purely offensive skill.

We do not quote salary figures here because we do not want to guess. For a qualitative discussion of how the credential relates to compensation and role progression, see GWEB Salary Guide, and for the career angle, GWEB Jobs. If you are weighing the investment, Is the GWEB Certification Worth It? works through the trade-offs.

Sequencing Your Preparation Around the Domains

Because GIAC publishes no weights, a sensible plan covers all 18 objectives and orders them by dependency. Here is one example sequence for a roughly six-week effort; adjust it to your background.

The ordering reflects dependency, not importance: identity and browser-trust topics lean on HTTP fundamentals, while the advanced domains assume you already speak the vocabulary of earlier ones.

Frequently Asked Questions