GOSI Certification

What the GOSI Certification Actually Certifies

The GIAC Open Source Intelligence Certification (GOSI) validates that a practitioner can find, collect, process, and report on information from publicly available sources, and can do so without exposing themselves or their organization. It is issued by GIAC Certifications and administered by GIAC, LLC. If you are still orienting yourself on the basics, our explainers on what GOSI certification is and what GOSI stands for cover the naming and scope in plain language.

What separates this credential from a general security exam is its subject matter. There is no firewall configuration, no incident response playbook, and no cryptography math. Instead, the exam probes whether you can investigate a company, trace a person's public footprint, analyze network infrastructure, follow a defensible methodology, protect your own identity while researching, and process the data you gather into something usable.

Exam Format, Rules, and Open-Book Mechanics

The GOSI exam is a single proctored, web-based test. You answer 75 questions within a 2-hour time limit, and the minimum passing score is 69%. That works out to roughly 1 minute and 36 seconds per question if you spend the full time, which is tight for an open-book exam. For a deeper look at the cut score and how it applies to your attempt, see our guide to the GOSI passing score.

Testing is delivered through Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility. Check the details for your own assigned attempt at the GIAC exam portal, because the assigned attempt's objectives, format, and passing score take precedence over any general description, including this one.

What You Can and Cannot Bring

Rules That Change How You Pace

• Answers are final. Submitted answers cannot be changed, so do not rush to submit something you are unsure about when you could flag it for a pass-through first, if the interface allows review before submission.
• Breaks are limited. You get 15 minutes of break time in total, not per break.
• Practice-style materials are banned. Notes that resemble practice or exam questions and answers are prohibited, so build your reference material from course content and your own analysis, not from question dumps.

Fees, Registration, and the 120-Day Window

Costs are published by GIAC and exclude applicable sales tax. Here is the structure that matters for budgeting:

SANS training tuition is separate from all of these. If you plan to take the associated course, that cost sits outside the certification attempt fee. Our GOSI certification cost breakdown walks through how to combine these line items into a realistic total.

The Activation Clock

Once your attempt is activated, you have 120 days to complete it. That window is a scheduling constraint worth treating seriously: book your testing slot early, and do not activate the attempt until your index is close to finished. For scheduling specifics, see our GOSI exam dates and scheduling guide.

Eligibility

There are no formal certification prerequisites. Training is optional and recommended, not mandatory. The associated SANS course lists basic computer knowledge as its own prerequisite, but a course prerequisite is separate from GIAC certification eligibility. More detail is in our GOSI requirements guide.

The Six Objective Headings, Explained

GIAC publishes six objective headings for GOSI under "Exam Certification Objectives & Outcome Statements." They are listed below in the published order. GIAC does not publish percentage weights for these headings, so do not trust any source that claims to know how many questions come from each one. For a fuller treatment, read our complete guide to all 6 GOSI content areas.

How SEC497 Training Maps to the Exam

The most common preparation path is SANS SEC497, Practical Open-Source Intelligence (OSINT). Training is optional, but it is the course most candidates associate with this certification. Our GOSI training overview compares the options in more detail.

A few points are worth being precise about:

• The course is not the exam outline. SEC497 sections are unweighted preparation curriculum. They do not establish exhaustive exam coverage or define the official domain count. The six headings above are the authoritative scope.
• The live syllabus includes specific tooling topics. These include ArchiveBox for evidence capture, API-based data collection, analysis of AI-generated content, Whisper for audio and video transcription, metadata and image analysis, infrastructure research, dark web research, data processing, and report writing. These are preparation curriculum, not additional exam headings.
• The brochure and the live syllabus differ. The linked brochure does not name ArchiveBox, API collection, AI-generated content analysis, or Whisper, and it retains cryptocurrency material that is absent from the live Section 5 topic list. If you are comparing materials, trust the live syllabus for current topics.
• The capstone is a training exercise. It is not an additional GOSI certification assessment.

Building an Index for an Open-Book OSINT Exam

Because the exam permits hardcopy books, notes, and an index, your index is effectively a second set of knowledge you carry into the room. A good one lets you locate a concept in under thirty seconds. A bad one sends you flipping through pages while the clock runs.

What to Index

• Concepts, not just tool names. Questions are more likely to describe a scenario than name a tool, so index by the problem the tool solves.
• Methodology terms. Source evaluation, confidence language, evidence preservation, and documentation practices belong here because Domain 4 is process-heavy.
• Operational security decisions. Index the reasoning behind separation of identities and risk reduction, since Domain 5 questions tend to be judgment calls.
• Infrastructure terms. Registration data, shared-attribute pivoting, and interpretation cautions for Domain 3.

What to Leave Out

Do not build notes that resemble practice questions with answers, since materials resembling practice or exam questions and answers are prohibited. Keep your reference material focused on explanations and course content. Our GOSI cheat sheet shows the kind of condensed fact review that works well as a study aid before the exam, as distinct from what you bring into the testing room.

Scheduling Your Prep by Domain

One sequencing idea works well for GOSI because the domains build on each other. Start with method and security, then move to the investigative domains, then finish with collection mechanics and review. The 120-day window after activation means you should begin heavy study before you activate, not after.

For a fuller plan including resource selection, see the GOSI study guide. When you want timed question practice that mirrors the pace of a 75-question, 2-hour exam, our practice tests are built for that kind of rehearsal.

Who Values This Credential

OSINT skills show up wherever organizations need to understand people, companies, and infrastructure from public data. The roles below commonly list investigative research skills of this kind. The certification supports a case for these skills, but it does not by itself guarantee any particular job. Browse our GOSI jobs overview for role-by-role detail.

• Threat intelligence teams that need to profile actors, infrastructure, and exposure.
• Corporate security and investigations groups handling due diligence, fraud inquiries, and executive protection research.
• Fraud and risk functions verifying businesses and individuals.
• Red teams and penetration testers performing reconnaissance before an engagement.
• Journalists, researchers, and investigators who need defensible, documented sourcing.

Earnings vary by role, region, and experience, and GIAC does not publish salary figures for this certification. Our GOSI salary guide and ROI analysis discuss how to weigh the investment without relying on invented numbers.

Four-Year Validity and Renewal

A GOSI certification is valid for four years. To renew, you have two paths during the active period:

• Earn 36 approved CPE credits, or
• Pass a renewal exam.

Either route also requires the standard $499 renewal fee. The CPE route suits practitioners who attend conferences, publish research, or complete further training as part of their normal work, since those activities can accumulate credits over four years. Because the field of public-source investigation shifts as platforms change and new data sources emerge, steady ongoing learning pays off beyond the renewal requirement itself.

Frequently Asked Questions