- GOSI is the GIAC Open Source Intelligence Certification: one proctored exam, 75 questions, 2 hours, 69% minimum passing score.
- The exam objectives list six domains, from Investigating Businesses through Searching, Collecting, and Processing Data, with no published weights.
- The exam is open book with hardcopy books, notes, and an index; internet access and personal electronic references are prohibited.
- A certification attempt costs USD $999; the certification is valid for four years and renews with 36 CPE credits or a renewal exam.
What a GOSI Actually Is
When people ask "what is a GOSI?", the answer on this site is specific: the GIAC Open Source Intelligence Certification (GOSI). It is a credential for practitioners who find, collect, verify, and report on information from publicly available sources. The acronym is shared by other, unrelated credentials and organizations elsewhere in the world, so it is worth being precise: everything here concerns the GIAC certification in open source intelligence (OSINT), nothing else.
OSINT work is less about a single tool and more about a disciplined workflow. An analyst frames a question, identifies where public data about a business, a person, or a network might live, collects it in a defensible way, processes it into something usable, protects their own identity while doing so, and then writes it up for a decision-maker. The GOSI exam is built to test whether you can do that reliably, not just whether you know the names of search engines.
If you want a shorter orientation to the terminology before going deeper, our pages on what GOSI certification is and what GOSI stands for cover the naming question directly.
Who Issues It and How the Exam Is Delivered
GIAC Certifications, administered by GIAC, LLC, issues the credential. GIAC was formerly known as Global Information Assurance Certification. The exam is a single proctored, web-based test, delivered through Pearson VUE at a testing site or remotely through ProctorU, subject to the eligibility rules attached to your specific attempt.
| Exam Attribute | GOSI Detail |
|---|---|
| Issuer | GIAC Certifications (GIAC, LLC) |
| Number of exams | One proctored, web-based exam |
| Questions | 75 |
| Time limit | 2 hours |
| Minimum passing score | 69% |
| Proctoring | Pearson VUE onsite or ProctorU remotely |
| Prerequisites | None formal; training optional and recommended |
| Attempt completion window | 120 days from activation |
| Certification validity | Four years |
One detail trips up candidates who rely on older forum posts: the 69% passing standard applies to exam versions released on or after June 17, 2023. GIAC also states that the objectives, format, and passing score shown for your assigned attempt on its attempts page take precedence over any third-party summary, including this one. Always confirm against your own attempt before test day. For a focused look at scoring, see our GOSI passing score guide.
The Six Exam Domains
GIAC publishes the exam objectives as six headings. The published list does not assign percentage weights to them, so any source claiming exact domain percentages is guessing. Treat the six areas as roughly comparable obligations until your own preparation shows where you are weakest. Our complete guide to all six GOSI content areas goes deeper on each; here is the orientation.
Domain 1: Investigating Businesses
Corporate research is a core OSINT use case: due diligence, fraud inquiries, supplier vetting, and threat actor attribution through front companies.
- Locating and interpreting corporate registration and filing records
- Mapping ownership, officers, and affiliated entities
- Correlating a business's public footprint across sources
Domain 2: Investigating People
Person-focused research is where methodology and ethics collide most often, so expect questions on both capability and restraint.
- Finding and cross-referencing public identifiers and online presence
- Distinguishing a confirmed identity from a coincidental name match
- Understanding the limits of what public data can responsibly support
Domain 3: Network Data and Infrastructure Analysis
This domain bridges OSINT and cybersecurity: reading the internet's plumbing to learn who operates what.
- Interpreting domain, hosting, and infrastructure information
- Pivoting from one network artifact to related assets
- Using infrastructure research to support attribution and scoping
Domain 4: OSINT Methodology
The process layer: how an investigation is planned, executed, documented, and reported so that others can trust and reproduce it.
- Framing collection requirements before touching a tool
- Evaluating source reliability and information credibility
- Structuring findings into clear, defensible reporting
Domain 5: Privacy and Operational Security Fundamentals
Investigators leave traces. This domain covers protecting the analyst, the investigation, and the subject of the research.
- Separating investigative identities and environments from personal ones
- Reducing the chance of tipping off a target through your own activity
- Handling collected data with appropriate care
Domain 6: Searching, Collecting, and Processing Data
The mechanics of getting data and making it usable, from advanced search technique to preserving and structuring what you find.
- Constructing effective queries across search engines and platforms
- Capturing and preserving evidence in a durable form
- Cleaning, organizing, and analyzing collected material
How SEC497 Relates to the Exam
The most common preparation path is the SANS Institute course SEC497: Practical Open-Source Intelligence (OSINT). It is optional; GIAC requires no formal prerequisites for the certification, and SEC497 itself lists only basic computer knowledge as its prerequisite. SANS tuition is also separate from GIAC's exam fees.
It helps to be clear about what the course is and is not. The course sections are preparation curriculum. They do not establish exhaustive exam coverage, and they are not a seventh, eighth, or ninth set of exam domains. The exam objectives are the six headings above, full stop.
That said, the live SEC497 syllabus gives a concrete sense of the hands-on skills the discipline demands. Topics it supports include:
- Evidence capture with ArchiveBox
- Collecting data through APIs
- Analyzing AI-generated content
- Transcribing audio and video with Whisper
- Metadata and image analysis
- Infrastructure research and dark web research
- Data processing and report writing
A caution on sources: the currently linked SEC497 brochure differs from the live detailed syllabus. It does not name the ArchiveBox, API, AI-generated-content, or Whisper examples, and it still carries cryptocurrency material that is absent from the live Section 5 topic list. If you are comparing course materials from different dates, expect drift. The course capstone is a training exercise, not an additional GOSI assessment. For help deciding whether the course is worth it for you, see our GOSI training overview.
Open Book, Index, and Question Style
The GOSI exam is open book, but only in a narrow, physical sense. You may bring hardcopy books, notes, and an index. You may not use internet access, personal electronic references, or materials resembling practice or exam questions and answers. Two other rules shape how you should approach the clock:
- Submitted answers cannot be changed. Treat each submission as final.
- 15 minutes of break time are allowed during the session.
With 75 questions in 2 hours, you have well under two minutes per question on average. That is generous for questions you know cold and punishing if you spend several minutes hunting through a poorly built index. The index is the real skill the open-book format tests: not whether the answer exists in your materials, but whether you can locate it fast.
Because the format rewards applied judgment, memorizing tool names will carry you only partway. Questions tend to probe whether you understand why you would choose one collection approach, one source, or one operational-security precaution over another. Our GOSI cheat sheet distills the must-know facts, and our guide on how hard the GOSI exam is discusses where candidates tend to struggle.
Fees, Attempt Windows, and Renewal
The money and logistics are straightforward, but they are worth knowing before you commit. Prices below exclude applicable sales tax.
| Item | Amount |
|---|---|
| Certification attempt | USD $999 |
| Retake | USD $899 |
| Official practice exam | USD $399 |
| Renewal fee | USD $499 |
Once your attempt is activated, you have 120 days to complete it. That window is a real constraint: if you register before you have built your index or worked through the domains, the clock is already running. Decide on a realistic preparation timeline first, then activate. Our GOSI certification cost breakdown covers how these numbers combine with training tuition, and our exam dates and scheduling guide explains booking mechanics.
Keeping the Credential Current
A GOSI is valid for four years. To renew, you either earn 36 approved CPE credits during the active four-year period or pass a renewal exam, and in either case you pay the standard USD $499 renewal fee. For OSINT practitioners, CPE credits are often a natural byproduct of ongoing work: conference sessions, training, and research that you were likely doing anyway.
Who Benefits from Holding a GOSI
OSINT skills cut across several professions, which is part of the credential's appeal. The people who typically find it relevant include:
- Cyber threat intelligence analysts who attribute infrastructure and profile adversaries from public data
- Corporate security and investigations teams conducting due diligence, insider-risk review, and fraud inquiries
- Government and law-enforcement-adjacent analysts who need documented, repeatable collection methods
- Journalists and research professionals who verify claims and trace entities
- Red teamers and penetration testers performing reconnaissance during authorized engagements
The domain list reflects this breadth: business and people research on one side, network infrastructure on another, and methodology plus operational security tying them together. Whether it translates into pay or promotion depends heavily on your employer and role, so we avoid quoting figures here. If you are weighing the investment, our GOSI jobs overview, salary analysis, and worth-it breakdown take that question on directly. For eligibility details, see GOSI requirements.
Sequencing Your Preparation Around the Domains
You do not need an elaborate methodology, but the order in which you tackle the six domains matters because they build on one another. Methodology and operational security come first in a sensible plan, since every other domain assumes you can plan an investigation and protect yourself while running it.
Foundations: Domains 4 and 5
- Learn how OSINT investigations are scoped, documented, and reported
- Study privacy and operational security fundamentals before any hands-on collection
- Start your index with methodology and opsec entries
Collection Mechanics: Domain 6
- Practice advanced searching, evidence capture, and data processing
- Add index entries for each collection and preservation technique
Entity Research: Domains 1 and 2
- Work through business-focused and person-focused investigation scenarios
- Note the verification and ethics questions that arise in each
Infrastructure and Review: Domain 3
- Cover network data and infrastructure analysis
- Take the official practice exam, then patch index gaps it exposes
Adjust the pacing to your background: a network analyst may compress Week 4 and expand Weeks 1 and 3, while a researcher from a non-technical field may do the reverse. The principle holds either way: start with process and safety, then move to collection, then to the entity and infrastructure work built on top of them. Our GOSI study guide expands this into a fuller plan, and our pass rate discussion explains why we avoid citing unverified numbers.
Key Takeaway
Because the exam is open book but time-limited and final-answer, your index is a study output, not a last-minute chore. Build it incrementally as you finish each domain, then test it against timed practice questions from our GOSI practice tests so you know you can find answers in well under two minutes.
Frequently Asked Questions
On this site, GOSI means the GIAC Open Source Intelligence Certification, issued by GIAC Certifications. It validates practical open source intelligence skills across six areas: investigating businesses, investigating people, network data and infrastructure analysis, OSINT methodology, privacy and operational security fundamentals, and searching, collecting, and processing data.
The exam has 75 questions and a 2-hour time limit, with a minimum passing score of 69% for exam versions released on or after June 17, 2023. Confirm the details for your assigned attempt on GIAC's attempts page, which takes precedence over any summary.
No. GIAC lists no formal certification prerequisites, and training is optional but recommended. SEC497 (Practical Open-Source Intelligence) is the common preparation route, but its tuition is separate from GIAC's exam fees, and its content is preparation curriculum rather than the official exam objectives.
No. The exam is open book only for hardcopy books, notes, and an index. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited. Submitted answers also cannot be changed, and you get 15 minutes of break time.
The certification is valid for four years. Renewal requires either 36 approved CPE credits earned during that period or a renewal exam, plus the standard USD $499 renewal fee. You can start practicing now with our GOSI practice exams and review the broader overview on our GOSI certification page.