- The Honest Difficulty Verdict
- What Actually Makes the GOSI Exam Hard
- Format and Time Pressure: 75 Questions, 2 Hours
- Difficulty by Domain
- The Open-Book Reality
- How Your Background Changes the Difficulty
- Where SEC497 Fits In
- Sequencing Your Preparation by Domain
- The Cost of Underestimating It
- Frequently Asked Questions
- The GOSI exam has 75 questions in 2 hours, with a minimum passing score of 69%.
- It is open book, but only hardcopy books, notes, and an index are allowed.
- Submitted answers cannot be changed, so careless clicking costs points permanently.
- A retake costs USD $899, which makes a failed first attempt expensive.
The Honest Difficulty Verdict
The GIAC Open Source Intelligence Certification (GOSI) is a moderately demanding, applied exam. It is not a trivia test of acronyms, and it is not a purely theoretical certification either. The difficulty comes from breadth, speed, and the practical nature of open source intelligence work: you are expected to know how to find, verify, process, and report on information about businesses, people, and network infrastructure while protecting your own operational security.
GIAC does not publish a pass rate in the materials we verified, and we will not invent one here. If you want to understand what is and is not known on that front, see our breakdown in GOSI Pass Rate 2026: What the Data Shows. What we can describe with confidence is the structure of the exam, the published objectives, and the preparation patterns that make the difference between a comfortable pass and an expensive retake.
What Actually Makes the GOSI Exam Hard
Four factors drive the difficulty of this particular certification. Understanding them lets you aim your preparation at the real obstacles rather than at generic exam anxiety.
Breadth Across Six Domains
GIAC's published objective headings cover six areas: Investigating Businesses, Investigating People, Network Data and Infrastructure Analysis, OSINT Methodology, Privacy and Operational Security Fundamentals, and Searching, Collecting, and Processing Data. GIAC does not publish percentage weights for these headings in the objective list we verified, so you cannot safely assume that one domain matters far more than another. Treat all six as testable. For a deeper walkthrough of each area, read our GOSI exam domains guide.
Applied, Scenario-Style Thinking
OSINT is a craft discipline. Candidates are expected to reason about which source, technique, or tool fits a given investigative problem, and about how to handle the data responsibly once it is collected. Memorizing definitions helps, but recognizing the right approach for a scenario is what carries you through.
A Fixed Clock and Irreversible Answers
With 75 questions and 2 hours, you have an average of under two minutes per question. Submitted answers cannot be changed. That combination means you cannot casually skip ahead planning to revisit and revise. Each answer needs to be committed with confidence.
Index Dependence
Because the exam is open book, many candidates assume it is easy. In practice, an open-book exam shifts the difficulty from recall to retrieval. A poorly built index is worse than no index because it gives false comfort while burning your time.
Format and Time Pressure: 75 Questions, 2 Hours
Here is the exam structure as published by GIAC, set out so you can judge the pressure for yourself.
| Exam Element | GOSI Detail | Why It Affects Difficulty |
|---|---|---|
| Questions | 75 total | Broad coverage across six domains |
| Time limit | 2 hours | Under two minutes per question on average |
| Passing score | 69% minimum | Little room for large gaps in any domain |
| Answer changes | Not permitted after submission | Forces commitment on each item |
| Breaks | 15 minutes allowed | Useful for resetting, but plan when to use it |
| Delivery | Proctored, web-based; Pearson VUE onsite or ProctorU remote | Test-center or remote-proctoring rules apply |
| Activation window | 120 days from activation | Creates a firm preparation deadline |
The 69% threshold on 75 questions means you need roughly 52 correct answers. Our dedicated page on the GOSI passing score explains how that standard works and how it applies to exam versions released on or after June 17, 2023. Always confirm the objectives, format, and passing score for your specific assigned attempt on the GIAC attempts page, since that takes precedence over any third-party summary, including ours.
Difficulty by Domain
Because GIAC does not publish weights, we cannot rank domains by exam share. We can, however, describe what each domain asks of you and where candidates typically need to put in more practice based on the nature of the material.
Domain 1: Investigating Businesses
Expect to reason about how organizations can be researched through public sources.
- Corporate structure, ownership, and registration information
- Connecting entities, officers, and affiliated organizations
- Knowing which kinds of sources answer which kinds of questions
Domain 2: Investigating People
This domain tests research on individuals, which raises both technical and ethical considerations.
- Identifying and correlating public information about a person
- Verifying identity and avoiding false attribution
- Understanding the boundaries of responsible collection
Domain 3: Network Data and Infrastructure Analysis
For candidates without a networking background, this is often the steepest climb.
- Researching domains, hosting, and the infrastructure behind online assets
- Interpreting what technical records reveal about ownership and relationships
- Connecting infrastructure findings to broader investigative questions
Domain 4: OSINT Methodology
This domain covers the disciplined process around the tools: planning, structuring a collection effort, evaluating sources, and documenting results.
- Framing a question before collecting anything
- Assessing source reliability and bias
- Producing findings that are traceable and defensible
Domain 5: Privacy and Operational Security Fundamentals
Investigators must protect themselves and their investigations, not only the subjects they research.
- Reducing your own digital footprint during collection
- Separating investigative identities and environments
- Understanding how your activity can expose you or your organization
Domain 6: Searching, Collecting, and Processing Data
The hands-on core of OSINT: getting data, preserving it, and making it usable.
- Effective search technique across engines and platforms
- Capturing and preserving evidence so it remains usable later
- Processing and organizing collected data for analysis and reporting
Key Takeaway
Do not assume your strongest professional domain will carry you. With no published weights and a 69% threshold, a single neglected domain can quietly pull your score below passing. Plan coverage of all six before you optimize any one.
The Open-Book Reality
GIAC permits hardcopy books, notes, and an index. It prohibits internet access, personal electronic references, and materials resembling practice or exam questions and answers. That last restriction matters: do not bring annotated printouts of practice questions into the exam. Our GOSI cheat sheet is meant for review before the exam, not as a reference to carry in.
Why an Index Can Make or Break You
An index works when it maps terms and concepts to the exact place in your materials where the answer lives. It fails when it is vague, incomplete, or organized in a way you do not instinctively understand. Build yours while you study, not the week before the exam, and test it by trying to answer practice questions using only your books and index.
Open Book Does Not Mean Look Everything Up
At under two minutes per question, you cannot research every item. The practical rule most successful candidates follow is to answer what you know immediately, reserve the index for items where you need to confirm a specific detail, and avoid long hunts that drain the clock.
How Your Background Changes the Difficulty
There are no formal certification prerequisites for GOSI, and training is optional but recommended. Our GOSI requirements guide covers eligibility in detail. The practical difficulty, however, depends heavily on where you start.
- Investigators, journalists, and threat intelligence analysts: You likely have strong methodology and people-research instincts, but may need focused work on network and infrastructure analysis and on the tooling side of data collection and processing.
- Network and security practitioners: Infrastructure analysis will feel familiar, while business and people investigation, source evaluation, and structured reporting may require deliberate practice.
- Career changers and newcomers: The breadth is the main challenge. Expect to spend more time on fundamentals across every domain, and consider structured training rather than self-study alone.
- Corporate security and due-diligence professionals: Business investigation will be a strength; verify that your operational security and technical collection skills keep pace.
Where these skills lead professionally is covered in our pages on GOSI jobs and the GOSI salary guide, which can help you decide how much preparation effort is justified.
Where SEC497 Fits In
SANS offers SEC497: Practical Open-Source Intelligence (OSINT) as preparation for this certification. Training is optional, and the course prerequisite is basic computer knowledge. Note that a course prerequisite is separate from GIAC certification eligibility.
The live detailed SEC497 syllabus includes topics such as ArchiveBox evidence capture, API-based data collection, analysis of AI-generated content, Whisper audio and video transcription, metadata and image analysis, infrastructure research, dark web research, data processing, and report writing. These are preparation curriculum topics. They are not additional GIAC exam-objective headings, and the course sections do not establish exhaustive exam coverage. The course also includes a capstone, but that is a training exercise and not an additional GOSI certification assessment.
One caution: the currently linked SEC497 brochure differs from the live syllabus. It does not name the ArchiveBox, API, AI-generated-content, or Whisper examples, and it retains cryptocurrency material that is absent from the live Section 5 topic list. If you study from the brochure alone, you may be working from an older picture of the course. Read more about options in our overview of GOSI training.
Sequencing Your Preparation by Domain
Generic study advice is easy to find. What matters here is the order in which you attack the six domains, since your 120-day activation window creates a real deadline. The schedule below is a sample you can compress or stretch. For a full methodology, see our GOSI study guide.
Foundation: Methodology and Opsec
- Study OSINT Methodology first, because every other domain depends on it
- Cover Privacy and Operational Security Fundamentals early so safe habits shape all your practice
- Start your index with core terms from both domains
Collection Skills
- Work through Searching, Collecting, and Processing Data hands-on
- Practice capturing and preserving evidence, not just reading about it
- Add search and processing techniques to your index
Targets: Businesses and People
- Cover Investigating Businesses and Investigating People back to back to compare their source types
- Practice correlating findings and verifying identity before drawing conclusions
Infrastructure and Full-Length Practice
- Give Network Data and Infrastructure Analysis extra time if networking is new to you
- Take timed practice exams to rehearse the 75-question, 2-hour pace
- Refine your index based on where retrieval was slow
You can pressure-test this schedule with the timed questions on our GOSI practice test platform, which helps you rehearse pacing and spot weak domains before you pay for a live attempt. If you want to take the official practice exam as well, note that GIAC lists it at USD $399.
The Cost of Underestimating It
Difficulty has a financial dimension here. A certification attempt costs USD $999, a retake costs USD $899, and the official practice exam costs USD $399, with prices excluding applicable sales tax. SANS training tuition is separate. A failed first attempt therefore adds a substantial cost on top of lost time. See the GOSI certification cost breakdown for the full picture and our ROI analysis for whether the investment makes sense for your goals.
Once earned, the certification is valid for four years. Renewal requires 36 approved CPE credits earned during the active period or a renewal exam, plus the standard USD $499 renewal fee. Scheduling questions are addressed in our guide to GOSI exam dates. If you are still orienting yourself, start with what GOSI certification is, then use our practice exams to measure readiness honestly before you book.
Key Takeaway
Treat the first attempt as the one you intend to pass. With a USD $899 retake fee and a 120-day completion window, the smartest preparation investment is timed practice across all six domains and a tested index, not extra reading in your strongest area.
Frequently Asked Questions
Difficulty is subjective and depends on your background. GOSI is applied and broad, with 75 questions in 2 hours and a 69% passing score, and it is open book. We do not have verified comparative data, so we avoid ranking it against other GIAC certifications.
GIAC lists no formal certification prerequisites, and training is optional but recommended. Self-study is possible if you already have hands-on OSINT experience and build a strong index, but the course material aligns closely with the skills the certification measures.
No. You may use hardcopy books, notes, and an index, but with under two minutes per question, slow retrieval is a real risk. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.
No. Submitted answers cannot be changed. This means you should answer decisively, use your index for specific confirmations, and avoid planning to revisit items you have already submitted.
It depends on your experience. GIAC does not publish domain weights, so no single domain is officially larger. Candidates without networking experience often find Network Data and Infrastructure Analysis steepest, while others struggle most with methodology and source evaluation. Practice all six domains.