- What You Are Actually Sitting: GOSI Exam Mechanics
- Open-Book Strategy: Building Your Index
- The Six Domains and What to Master in Each
- Using SANS SEC497 as Your Prep Backbone
- Hands-On Practice Beyond the Books
- Sequencing Your Weeks by Domain
- Registration, Fees, and the 120-Day Clock
- Exam-Day Execution
- After You Pass: Validity, Renewal, and Career Use
- Frequently Asked Questions
- The GOSI exam has 75 questions, a 2-hour limit, and a 69% minimum passing score.
- It is open book: hardcopy books, notes, and an index only. No internet or electronic references.
- Answers cannot be changed once submitted, so commit only after reading each question fully.
- GIAC publishes six unweighted domains, so balance your study time instead of chasing one area.
What You Are Actually Sitting: GOSI Exam Mechanics
The GIAC Open Source Intelligence Certification (GOSI) is a single proctored, web-based exam with 75 questions and a 2-hour time limit. The minimum passing score is 69%. That works out to roughly 52 correct answers out of 75, which leaves room for mistakes but not for a weak domain you ignored. If you are still orienting yourself, our overview What Is GOSI Certification? covers the credential at a high level, and GOSI Passing Score 2026 explains how the 69% standard applies.
The exam is administered by GIAC through Pearson VUE (onsite) or ProctorU (remote), subject to attempt-specific eligibility. There are no formal certification prerequisites, and SANS training is optional but recommended. Always confirm the objectives, format, and passing score for your specific attempt on the GIAC attempts page, because the assigned attempt's details take precedence over any third-party summary, including this one.
Open-Book Strategy: Building Your Index
GIAC permits hardcopy books, notes, and an index. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited. Read that last restriction carefully: do not bring in anything that looks like a question-and-answer sheet. Your index should be a lookup tool for concepts, tools, and definitions, not a transcript of practice items. For a deeper look at policies like this, see GOSI Requirements 2026.
What a Good OSINT Index Contains
- Term, then location. Each entry points to a book number and page, so you can find the explanation in seconds.
- Tools grouped by purpose. Cross-reference tools by what they collect (business records, people data, network data) rather than alphabetically only.
- Methodology vocabulary. Terms around planning, collection, and analysis of intelligence deserve their own entries because they appear across domains.
- Your own weak spots. Add entries for anything you missed while studying, in your own words.
Key Takeaway
Build the index while you study, not in the last week. The act of deciding what to index is itself a form of review, and a 2-hour exam punishes anyone who is still organizing their materials at the start. Tab your books by domain so you can jump to the right section before you search the index.
The Six Domains and What to Master in Each
GIAC lists six exam-objective headings for the GOSI. No official percentage weights are published for them, so treat the domains as roughly equal until your own practice results say otherwise. For a full breakdown, read GOSI Exam Domains 2026: Complete Guide to All 6 Content Areas. Below is how to think about each one from a candidate's perspective.
Domain 1: Investigating Businesses
Expect to reason about how organizations can be researched using open sources: who they are, who owns and runs them, and how they connect to other entities.
- Corporate registries, filings, and ownership structures
- Tracing relationships between companies, officers, and addresses
- Judging which public sources are authoritative for a business question
Domain 2: Investigating People
This domain is about researching individuals ethically and accurately using publicly available information.
- Identifying and correlating usernames, accounts, and online presence
- Verifying identity claims and avoiding false attribution
- Understanding the limits of what public data can support
Domain 3: Network Data and Infrastructure Analysis
Here the focus shifts to the technical footprint behind domains, hosts, and services.
- Domain, DNS, and hosting research
- Interpreting infrastructure relationships to link assets
- Reading technical records and understanding what they do and do not prove
Domain 4: OSINT Methodology
This is the connective tissue of the exam. Methodology questions test whether you can structure an investigation, not just run a tool.
- Planning collection around a defined requirement
- Assessing source reliability and information credibility
- Documenting findings so they are repeatable and defensible
Domain 5: Privacy and Operational Security Fundamentals
Investigators must protect themselves and their organizations while collecting open-source data.
- Reducing attribution of your own research activity
- Separating investigator identity from investigative infrastructure
- Legal and ethical boundaries around collection
Domain 6: Searching, Collecting, and Processing Data
This domain covers the practical craft: finding information efficiently, capturing it properly, and turning raw material into usable data.
- Advanced search techniques across engines and platforms
- Capturing and preserving evidence so it holds up later
- Processing, organizing, and structuring collected data for analysis
Candidates often find that the methodology and operational security domains feel soft until they hit scenario questions that require judgment rather than recall. If you are weighing effort against outcome, How Hard Is the GOSI Exam? discusses where candidates tend to feel pressure.
Using SANS SEC497 as Your Prep Backbone
GIAC and SANS are closely linked, and the SANS course most associated with this certification is SEC497: Practical Open-Source Intelligence (OSINT). Training is optional, and the course prerequisite is basic computer knowledge. That course prerequisite is separate from GIAC certification eligibility, which has no formal prerequisites. See GOSI Training for options.
The live SEC497 syllabus covers topics that map naturally to the exam's themes, including:
- Evidence capture with ArchiveBox
- Data collection through APIs
- Analysis of AI-generated content
- Audio and video transcription with Whisper
- Metadata and image analysis
- Infrastructure research and dark web research
- Data processing and report writing
Hands-On Practice Beyond the Books
OSINT is a craft discipline, and exam scenarios reward people who have actually done the work. Reading about a technique is not the same as having used it under mild time pressure. Build small, legal practice investigations using subjects you have permission to research, such as your own domain, your own public footprint, or a fictional scenario you design.
- Business drill: Pick a publicly traded company and map its officers, subsidiaries, and registered addresses from open sources only.
- People drill: Practice building a verified profile for a consenting volunteer, noting at each step how confident you are and why.
- Infrastructure drill: Take a domain you control and document every public record that describes it, then explain what an outsider could infer.
- Capture drill: Archive a set of web pages and media, then verify you can reproduce the evidence trail later.
- OPSEC drill: Write down how your research setup could reveal who you are, then fix each leak.
After each drill, write two or three index entries. That is how hands-on work turns into exam-day speed.
Sequencing Your Weeks by Domain
Generic schedules are less useful than a plan keyed to the exam's actual content. The sequence below front-loads the foundation that every other domain depends on. Adjust the length to your own experience level, and use the 120-day activation window as your outer limit rather than your target.
OSINT Methodology and Privacy/OPSEC
- Learn the investigation workflow first because it frames every other topic
- Set up a clean research environment and learn why each safeguard matters
- Start your index with methodology vocabulary
Searching, Collecting, and Processing Data
- Drill search techniques and evidence capture
- Practice organizing raw findings into structured notes
- Add tools-by-purpose entries to your index
Investigating Businesses and Investigating People
- Run the business and people drills from the previous section
- Focus on source reliability and avoiding false attribution
- Cross-reference entity relationships in your notes
Network Data and Infrastructure Analysis, then Full Review
- Work through domain, DNS, and hosting research
- Revisit every domain you scored lowest on in practice
- Take a timed practice run under real conditions, using only permitted materials
If you tend to forget material over time, space your reviews so that Domains 1 and 2 get a second pass after Domain 3 is complete. Beyond that, do not over-engineer the schedule. The structure above matters more than any study technique label. A quick one-page recap is also available in the GOSI Cheat Sheet 2026, though it works best as a review aid after you have studied, not a substitute for it.
Registration, Fees, and the 120-Day Clock
Planning your budget and timeline early removes avoidable stress. The fee structure published by GIAC is below. Prices exclude applicable sales tax, and SANS training tuition is separate. For a full breakdown, see GOSI Certification Cost 2026.
| Item | Amount (USD) |
|---|---|
| Certification attempt | $999 |
| Retake | $899 |
| Official practice exam | $399 |
| Renewal fee (every four years) | $499 |
Once your attempt is activated, you have 120 days to complete it. Treat that as a hard deadline and schedule your sitting early enough to leave room for a reschedule if something goes wrong. Scheduling specifics, including testing availability through Pearson VUE or ProctorU, are covered in GOSI Exam Dates 2026.
Exam-Day Execution
Pacing and Question Handling
Submitted answers cannot be changed, so the usual advice about blindly flagging and returning needs a caveat: make sure you are comfortable with how the testing interface handles review before you rely on it. Read every question completely, including qualifiers, before you open a book. Many OSINT questions are scenario-based, asking you to choose the most appropriate approach or the most reliable source, so the wrong answers are often plausible but less defensible.
- Answer what you know immediately and spend your book time only on questions that need it.
- Use your tabs to jump to the right book, then your index to find the page.
- Do not spend several minutes hunting for one answer at the expense of a dozen others.
Using Your Break Wisely
You are allowed 15 minutes of break time. Use it to reset rather than to cram, and follow the proctoring rules for what you may do during the break. If you are testing remotely, review the proctoring requirements in advance so that technical setup does not eat into your mental energy.
Key Takeaway
Because you cannot change a submitted answer, accuracy per question matters more than speed per question. Aim to finish with spare time rather than racing the clock, and give scenario questions your full attention on the first read.
After You Pass: Validity, Renewal, and Career Use
The certification is valid for four years. To renew, you need 36 approved CPE credits earned during the active four-year period or a renewal exam, plus the standard $499 renewal fee. Because OSINT tooling and platforms shift quickly, treat CPE activity as genuine upkeep rather than paperwork.
The credential suits roles where open-source research feeds decisions, such as threat intelligence, corporate investigations, fraud and due diligence work, and security teams that need to understand their external footprint. For realistic role titles and what employers look for, see GOSI Jobs, and for compensation context read the GOSI Salary Guide 2026. If you are still deciding whether the investment makes sense, Is the GOSI Certification Worth It? walks through the trade-offs. And if you want a data-driven look at how candidates fare, GOSI Pass Rate 2026: What the Data Shows is the place to start.
When you are ready to test your recall under realistic conditions, the GOSI practice tests at GOSI Exam Prep let you drill scenario-style questions and find the domains that need more work before you spend your attempt.
Frequently Asked Questions
The exam has 75 questions and a 2-hour time limit. The minimum passing score is 69%. You also get 15 minutes of break time, and submitted answers cannot be changed.
Yes, with limits. You may use hardcopy books, notes, and an index. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited, so build your index as a concept lookup tool.
There are no formal certification prerequisites, and training is optional but recommended. The SEC497 course lists basic computer knowledge as its own prerequisite, but that is separate from GIAC certification eligibility. See GOSI Requirements 2026 for details.
They are Investigating Businesses; Investigating People; Network Data and Infrastructure Analysis; OSINT Methodology; Privacy and Operational Security Fundamentals; and Searching, Collecting, and Processing Data. GIAC does not publish percentage weights for them.
A retake costs $899. Review your weakest domains, tighten your index where you lost time, and confirm the terms of your attempt on the GIAC attempts page before rescheduling. Prices exclude applicable sales tax.