- What GOSI Actually Is
- Who Issues It and How It Is Delivered
- The Six Exam Domains
- Format, Open-Book Rules, and Scoring
- Fees, Activation Window, and Retakes
- How SEC497 Relates to the Exam
- Who Benefits From the Credential
- Sequencing Your Preparation by Domain
- Staying Certified for Four Years
- Frequently Asked Questions
- GOSI is the GIAC Open Source Intelligence Certification, issued by GIAC and focused on practical OSINT work.
- The exam has 75 questions, a 2-hour limit, and a 69% minimum passing score.
- It is open book: hardcopy books, notes, and an index are allowed; internet access is not.
- The attempt costs USD $999, retakes cost USD $899, and the certification is valid for four years.
What GOSI Actually Is
GOSI stands for the GIAC Open Source Intelligence Certification. It is a credential that validates a practitioner's ability to find, collect, process, and report on information from publicly available sources in a disciplined, defensible way. The acronym is shared by several unrelated credentials in other industries, so it is worth being precise: everything on this page concerns the GIAC OSINT certification and nothing else. If you want shorter explainers on the naming question, see our pages on what GOSI stands for and the meaning of GOSI.
The certification sits in the practical end of the GIAC portfolio. Rather than testing abstract security theory, it tests whether you understand how investigators research companies and individuals, how they analyze network and infrastructure data, how they structure an investigation, and how they protect themselves while doing it. For a deeper look at the credential as a whole, our GOSI certification overview and what is GOSI certification articles cover adjacent angles.
Who Issues It and How It Is Delivered
GIAC Certifications, formerly the Global Information Assurance Certification, is administered by GIAC, LLC. GIAC is the certifying body; it is separate from SANS training, even though the two are closely associated and many candidates prepare with SANS coursework.
Exams are delivered through Pearson VUE at a test center or through ProctorU remotely, subject to the eligibility rules attached to your specific attempt. That last qualifier matters: the options available to you depend on the attempt you purchased, so confirm your delivery choices in your GIAC account rather than assuming both are open to you.
The Six Exam Domains
GIAC publishes six objective headings for GOSI. It does not publish percentage weights for them, so any site claiming exact domain weightings for this exam is inventing detail. Treat all six as fair game and plan for balanced coverage. Our complete guide to all six GOSI content areas goes deeper on each one.
Domain 1: Investigating Businesses
Researching organizations from open sources: who they are, how they are structured, and how they operate.
- Corporate structure, ownership, and registration information
- Tracing relationships between entities and their public footprints
- Corroborating claims against multiple independent sources
Domain 2: Investigating People
Researching individuals with attention to accuracy, attribution, and legitimate purpose.
- Linking identities, accounts, and online presence across platforms
- Image, metadata, and media analysis as supporting evidence
- Avoiding false attribution when identifiers overlap or are spoofed
Domain 3: Network Data and Infrastructure Analysis
Reading the technical trail that organizations and actors leave on the internet.
- Domain, hosting, and infrastructure relationships
- Interpreting network-related data to connect assets to owners
- Understanding what infrastructure records can and cannot prove
Domain 4: OSINT Methodology
The process layer: how an investigation is planned, run, documented, and reported.
- Defining requirements before collection begins
- Evidence handling, source evaluation, and reproducibility
- Report writing that separates facts from assessments
Domain 5: Privacy and Operational Security Fundamentals
Protecting the investigator, the investigation, and the people being researched.
- Keeping your research identity and infrastructure separate from your own
- Recognizing how your own collection activity can be observed
- Handling sensitive data responsibly
Domain 6: Searching, Collecting, and Processing Data
The hands-on core: finding material efficiently and turning raw results into usable data.
- Advanced search techniques and query construction
- Capturing and preserving content before it changes or disappears
- Processing collected data into a form that supports analysis
Format, Open-Book Rules, and Scoring
The exam is a single proctored, web-based test with 75 questions and a 2-hour time limit. The minimum passing score is 69%, which applies to exam versions released on or after June 17, 2023. Fifteen minutes of break time are allowed. Submitted answers cannot be changed, so there is no flagging-and-returning strategy that relies on editing a prior response. Our dedicated pages on the GOSI passing score and how hard the exam is expand on what this means in practice.
| Exam Element | Detail |
|---|---|
| Questions | 75 |
| Time limit | 2 hours |
| Minimum passing score | 69% |
| Break time | 15 minutes |
| Answer changes | Not permitted once submitted |
| Delivery | Pearson VUE onsite or ProctorU remote, subject to attempt eligibility |
| Prerequisites | None formal; training optional and recommended |
What "open book" really means here
GIAC allows hardcopy books, notes, and an index. It prohibits internet access, personal electronic references, and any materials resembling practice or exam questions and answers. That last restriction is easy to violate by accident, so do not carry in anything that looks like a question bank or answer key.
An open-book exam with a 2-hour clock rewards a different skill than memorization: knowing exactly where to find an answer fast. Candidates commonly build an index that maps concepts, tools, and terms to book and page. A good index is a deliberate study product rather than an afterthought, and it forces you to engage with the material while you build it. For a compact companion to that process, see our GOSI cheat sheet of must-know facts, bearing in mind that only hardcopy materials you prepared yourself belong in the exam room.
Fees, Activation Window, and Retakes
Pricing from GIAC's published fee schedule, before any applicable sales tax:
| Item | Fee (USD) |
|---|---|
| Certification attempt | $999 |
| Retake | $899 |
| Official practice exam | $399 |
| Renewal fee | $499 |
SANS training tuition is separate from all of the above. Once your attempt is activated, you have 120 days to complete it. That window shapes your schedule: do not activate until you are close to ready, but do not let it lapse. Our full GOSI cost breakdown walks through budgeting scenarios, and our exam dates and scheduling guide covers how to plan around the window.
How SEC497 Relates to the Exam
The training most directly associated with GOSI is SANS SEC497: Practical Open-Source Intelligence (OSINT). Training is optional and recommended rather than required. SEC497's own prerequisite is basic computer knowledge, and that course prerequisite is distinct from GIAC certification eligibility, which has no formal prerequisites. For a fuller picture, read our GOSI training overview and GOSI requirements guide.
The live SEC497 syllabus covers topics including evidence capture with ArchiveBox, API-based data collection, analysis of AI-generated content, audio and video transcription with Whisper, metadata and image analysis, infrastructure research, dark web research, data processing, and report writing. These are preparation curriculum topics. They are not additional exam-objective headings, and the course sections do not establish exhaustive exam coverage. The exam objectives remain the six domains listed above.
Who Benefits From the Credential
GOSI fits people whose daily work involves researching public information and turning it into something decision-makers can rely on. Typical profiles include:
- Threat intelligence and security analysts who profile adversaries, infrastructure, and exposed assets
- Fraud, corporate security, and due diligence investigators who research businesses and individuals
- Journalists and researchers who need rigorous, reproducible sourcing
- Investigators in government, law enforcement support, and compliance roles who need defensible methodology and operational security
Employers value the credential as evidence of structured method rather than tool familiarity alone, since Domain 4 and Domain 5 test judgment about process and risk. To explore the market side, our articles on GOSI jobs, the GOSI salary guide, and whether the certification is worth it examine hiring signals and return on investment without guessing at figures the issuer does not publish.
Sequencing Your Preparation by Domain
Because the exam is open book and unweighted, the most effective preparation pairs learning with index-building. One reasonable ordering follows the logic of an investigation: foundations first, then techniques, then the technical depth, then integration.
Domain 4 and Domain 5 first
- Learn the methodology and operational security framework everything else depends on
- Start your index with process terms, since later domains reference them
Domain 6 hands-on practice
- Practice search, capture, and processing workflows until they are routine
- Index tools and techniques by task, not just by name
Domains 1, 2, and 3
- Apply your workflow to businesses, people, and infrastructure
- Note where a technical record proves something versus only suggests it
Integration and timing
- Take a timed practice run against the 2-hour limit
- Refine the index based on what you could not find quickly
For a broader plan, see our GOSI study guide. When you are ready to test yourself under realistic conditions, our GOSI practice tests let you rehearse the question style and pacing. For broader benchmarking context, our GOSI pass rate page explains what is and is not publicly known.
Key Takeaway
Build your index while you study, not the week before the exam. Candidates who map concepts to page numbers as they learn them retrieve answers faster and retain more, which matters when you have under 100 seconds per question.
Staying Certified for Four Years
GOSI is valid for four years. To renew, you either earn 36 approved CPE credits during the active four-year period or pass a renewal exam, and in either case you pay the standard USD $499 renewal fee. Because renewal through CPEs is built around ongoing professional activity, practitioners who keep investigating, training, and publishing typically accumulate credits naturally. Plan to document your activity as you go rather than reconstructing it near expiration.
If you want to confirm details before you commit, our what is GOSI hub and the main practice test site are good starting points for orienting yourself.
Frequently Asked Questions
Here, GOSI means the GIAC Open Source Intelligence Certification, issued by GIAC. The same acronym is used by unrelated credentials elsewhere, so always confirm the certifying body when researching.
Yes, with limits. Hardcopy books, notes, and an index are permitted. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.
The exam has 75 questions with a 2-hour limit. The minimum passing score is 69% for exam versions released on or after June 17, 2023. Check your assigned attempt for the controlling details.
No. GIAC lists no formal certification prerequisites, and training is optional but recommended. SEC497 is the associated SANS course, with basic computer knowledge as its own prerequisite.
It is valid for four years. Renew with 36 approved CPE credits earned in that period or by passing a renewal exam, plus the USD $499 renewal fee.