GOSI Exam Domains 2026: Complete Guide to All 6 Content Areas

How GIAC Frames the GOSI Objectives

The GIAC Open Source Intelligence Certification (GOSI) validates a practitioner's ability to find, collect, process, and report on publicly available information in a disciplined, defensible way. GIAC organizes what it tests under six objective headings, published in this order:

1. Investigating Businesses
2. Investigating People
3. Network Data and Infrastructure Analysis
4. OSINT Methodology
5. Privacy and Operational Security Fundamentals
6. Searching, Collecting, and Processing Data

Two details matter before you plan anything. First, GIAC's objective list does not publish percentage weights for these headings, so any site claiming "Domain 3 is 22% of the exam" is inventing a number. Treat the six areas as unweighted and prepare for all of them. Second, the objective list does not state its own edition or publication date. The authoritative source for your specific attempt is the attempt page at exams.giac.org, which takes precedence over any article, including this one.

If you are still orienting yourself on the credential itself, start with what GOSI certification is and GOSI eligibility and prerequisites, then return here for the domain-by-domain breakdown.

Exam Format and Mechanics That Shape Domain Strategy

Your domain strategy should respect how the exam actually runs. The facts that influence preparation:

Registration mechanics also touch preparation. The certification attempt costs USD $999, a retake is USD $899, and the official practice exam is USD $399 (prices exclude applicable sales tax; SANS training tuition is separate). Once activated, you have 120 days to complete the attempt, delivered through Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility. For the full money picture see GOSI certification cost, and for scheduling logistics see GOSI exam dates and testing windows. The exact threshold is covered in GOSI passing score.

Domain 1: Investigating Businesses

Expect scenario-style questions that give you a situation and ask which source or approach best answers an investigative need. The skill being tested is source selection and interpretation, not memorizing a single database's interface. Know what categories of public business records exist, what each can and cannot prove, and how to pivot from one entity detail (a name, an address, an officer) to another.

Because business investigation often feeds into people research and infrastructure research, keep a cross-reference in your index: an officer name leads to Domain 2 techniques, and a company domain leads to Domain 3 techniques.

Domain 2: Investigating People

The recurring theme is attribution discipline. A candidate who can find an account is only half-prepared; the exam rewards knowing how to corroborate, how to avoid conflating people with similar names, and how to document confidence. Questions here often hinge on what a careful analyst would do next, not on what is technically possible.

The related SEC497 curriculum includes metadata and image analysis and AI-generated-content analysis, which are useful preparation for judging whether a profile photo or post is authentic. Remember that these are preparation topics rather than separate GIAC objective headings, so study them in service of the people-investigation skill set.

Domain 3: Network Data and Infrastructure Analysis

Candidates from a pure investigative background sometimes find this domain the steepest, while network and security professionals find it familiar. Whichever camp you are in, concentrate on interpretation: given a set of infrastructure records, what relationships can you reasonably infer, and what would be overreach? The exam is open book, so conceptual clarity plus a fast index lookup beats rote memorization of record formats.

Domain 4: OSINT Methodology

This is the connective tissue of the certification. Methodology questions tend to be principle-driven: what should you do first, how should you record what you found, how do you distinguish fact from inference? The SEC497 syllabus includes report writing and evidence capture (for example, preserving web content with a tool like ArchiveBox), which reflects why defensible documentation is treated as part of the craft, not an afterthought.

Because methodology answers are often "the most professional option," read every answer choice before selecting. Several may be technically feasible; the correct one usually reflects sound process, preservation of evidence, and honest handling of uncertainty.

Domain 5: Privacy and Operational Security Fundamentals

Operational security questions test judgment about risk. A tipped-off subject, a leaked investigative interest, or an accidental link between a personal account and a research task are the sorts of failures this domain is designed to prevent. The SEC497 curriculum covers dark web research, which carries its own heightened security and safety considerations; use that as a lens for understanding why disciplined opsec is foundational.

Do not treat this domain as the "easy" one because it sounds common-sense. Questions often present plausible but flawed precautions, and you must identify which control actually addresses the stated risk.

Domain 6: Searching, Collecting, and Processing Data

This is where the practical toolkit lives. The live SEC497 syllabus supports API data collection, ArchiveBox evidence capture, and Whisper-based audio/video transcription, plus broader data processing. Those are curriculum examples that illustrate the kinds of tasks this domain covers; they are not additional GIAC objective headings, and the exam is not a list of tool names to recite. Focus on what each technique accomplishes and when it is the right choice.

Mapping SEC497 Topics to the Six Domains

SANS SEC497, "Practical Open-Source Intelligence (OSINT)," is the preparation course associated with this certification. Training is optional and recommended, and the course prerequisite (basic computer knowledge) is separate from GIAC certification eligibility. The table below is an interpretive study aid, not an official GIAC crosswalk; course sections are unweighted curriculum and do not establish exhaustive exam coverage.

One caution: the currently linked SEC497 brochure differs from the live detailed syllabus. It does not name the ArchiveBox, API, AI-generated-content, or Whisper examples, and it retains cryptocurrency material that is absent from the live Section 5 topic list. If you rely on printed course materials, verify them against the current syllabus. Also note that the SEC497 capstone is a training exercise, not an additional GOSI certification assessment.

For a fuller view of the training option, see GOSI training, and for the study workflow itself see the GOSI study guide.

Sequencing the Domains Across Your Prep

Because the domains build on one another, order matters more than volume. One sensible sequence, adjustable to your background:

If you come from a network or security background, shorten the infrastructure week and extend people and business research. If you come from investigative or journalistic work, do the reverse. For a candid read on where candidates struggle, see how hard the GOSI exam is, and for what the outcome data does and does not show, see GOSI pass rate.

Building an Index Around the Domains

An open-book exam shifts the core skill from recall to retrieval. With 75 questions in 2 hours, a slow lookup is the same as a wrong answer. An index organized around the six domains gives you a fast first cut: identify the domain of the question, then drill into the specific topic.

• Use the domain headings as top-level tabs. They mirror GIAC's own published structure, so questions will map cleanly onto them.
• Index concepts and capabilities, not just terms. Questions are scenario-based, so you will search by what you are trying to do.
• Add a cross-domain pivot page. A one-page map of how business, people, and infrastructure findings connect saves time on chained questions.
• Keep notes clean of question-style content. Materials resembling practice or exam questions and answers are prohibited, and internet access and personal electronic references are not allowed.

The GOSI cheat sheet can help you decide which facts belong on a single review page, and you can pressure-test your index under timed conditions with GOSI practice tests. Practicing with a realistic clock is the only reliable way to learn whether your index actually speeds you up or slows you down.

Why the Domains Matter Beyond the Exam

The six headings read like a job description for modern investigative and security roles: researching organizations and individuals, tracing infrastructure, working methodically, protecting yourself, and processing data at scale. Employers in threat intelligence, corporate security, fraud and due diligence, investigations, and journalism-adjacent research value that blend. If you are weighing the credential against your career plans, see GOSI jobs, the GOSI salary guide, and the GOSI ROI analysis. The certification is valid for four years; renewal takes 36 approved CPE credits earned during that period or a renewal exam, plus the standard USD $499 renewal fee.

When you are ready to test yourself across all six areas, the full set of GOSI Exam Prep practice questions is the logical next step.

Frequently Asked Questions