What Is GOSI Certification?

What GOSI Certification Actually Is

GOSI stands for the GIAC Open Source Intelligence Certification. It validates that a practitioner can plan, run, and document open source intelligence work: finding information in publicly available sources, collecting it in a defensible way, processing it into something usable, and doing all of that without exposing themselves or their organization.

That definition matters because the acronym is not unique across the credential world. This article is about one thing only: the GIAC certification tied to OSINT tradecraft. If you want the shorter definitional versions of this topic, our pages on what GOSI is, what GOSI stands for, and the broader GOSI certification overview cover the naming question from different angles.

Unlike a purely theoretical exam, GOSI sits in the applied end of the GIAC portfolio. The topics are things an investigator, analyst, or threat researcher does on a working day: tracing a company's footprint, profiling a person from public records, mapping infrastructure behind a domain, and keeping the collection lawful and operationally safe.

Who Issues It and How the Exam Is Delivered

The certification is issued by GIAC Certifications (formerly Global Information Assurance Certification), administered by GIAC, LLC. Delivery runs through Pearson VUE, either onsite at a testing center or remotely through ProctorU, subject to the eligibility conditions attached to your specific attempt.

Two details deserve a second look. First, the 69% threshold applies to exam versions released on or after June 17, 2023, and GIAC states that the format and passing score shown for your assigned attempt take precedence over any general notice. Always check your own attempt page. Our dedicated explainer on the GOSI passing score unpacks what 69% means in practice across 75 questions.

Second, the "cannot change submitted answers" rule shapes pacing. Two hours for 75 questions leaves a little under two minutes per item, which is workable for an open-book exam only if your index is fast. Flipping through unindexed notes is where time disappears.

The Six Exam Domains

GIAC publishes six exam-objective headings for GOSI, in this order. GIAC does not publish percentage weights for them, so treat all six as fair game and avoid any study plan that assumes one domain is "worth" more than another. For a deeper walkthrough, see the complete guide to all 6 GOSI content areas.

Notice how the domains interlock. Domain 5 is not a standalone topic you can cram separately; operational security considerations show up inside questions about collection and investigation. Likewise, methodology (Domain 4) is the connective tissue for everything else.

What the Questions Reward

Because the exam is open book and applied, the questions lean toward scenario reasoning rather than pure definition recall. A typical item asks what you would do, which technique fits, or how to interpret a piece of evidence. Memorizing a glossary will not carry you; understanding why one approach is more defensible than another will.

That has two consequences for candidates:

• Your index is a navigation tool, not a substitute for understanding. If you must read a full page to answer, you lose the time advantage. If you know the concept and only need the exact detail, a good index gets you there in seconds.
• Hands-on exposure beats passive reading. Candidates who have actually run searches, captured pages, and traced infrastructure recognize the scenarios immediately.

If you are weighing how demanding this style will feel, our breakdown of how hard the GOSI exam is discusses where candidates tend to lose points, and the GOSI pass rate analysis explains why published pass-rate figures should be treated cautiously.

How SEC497 Relates to the Exam

The natural preparation path is SANS SEC497: Practical Open-Source Intelligence (OSINT). Training is optional and recommended rather than required, but the course aligns closely with the subject matter GOSI covers. See our page on GOSI training options for how candidates approach it.

The live detailed syllabus for SEC497 includes topics such as ArchiveBox evidence capture, API data collection, analysis of AI-generated content, Whisper audio and video transcription, metadata and image analysis, infrastructure research, dark web research, data processing, and report writing. These are preparation curriculum, not additional exam-objective headings. The course sections are unweighted and do not establish exhaustive exam coverage, so the six GIAC domains remain your authoritative scope.

One more distinction: the SEC497 capstone is a training exercise, not an additional GOSI certification assessment. And the course's own prerequisite, basic computer knowledge, is separate from GIAC certification eligibility, which has no formal prerequisites. Our GOSI requirements guide covers eligibility in full.

Fees, Eligibility, and Attempt Mechanics

SANS training tuition is separate from all of the above. Once your attempt is activated, you have a 120-day completion window to sit the exam. That window is a hard planning constraint: schedule your preparation so the exam lands comfortably inside it rather than at the final edge. For scheduling details, see GOSI exam dates and deadlines, and for the full financial picture, the GOSI certification cost breakdown.

The official practice exam is worth considering because it reproduces the testing interface and question style, which reduces surprises on exam day. Used alongside independent practice questions, it helps you find weak domains before the paid attempt starts the clock.

Four-Year Validity and Renewal

A GOSI certification is valid for four years. To renew, you have two routes: earn 36 approved CPE credits during the active four-year period, or pass a renewal exam. Either route also requires the standard $499 renewal fee.

For OSINT professionals, the CPE route is often natural, since ongoing casework, conference attendance, and tool training tend to accumulate credits. Track them as you go instead of reconstructing four years of activity at the end.

Who Benefits From the Credential

OSINT skills are used wherever someone needs to learn about an organization, person, or online infrastructure without breaking into anything. Roles that commonly rely on this work include:

• Threat intelligence and cyber defense analysts who research adversary infrastructure and personas
• Investigators in corporate security, fraud, and due diligence functions
• Law enforcement and public-sector analysts conducting lawful open-source collection
• Red team and social engineering assessors who need to understand an organization's public exposure
• Journalists and researchers who verify claims using public sources

Whether the credential pays off depends on your role and employer's expectations. We examine job paths in GOSI jobs, compensation in the GOSI salary guide, and the broader value question in whether GOSI is worth it. We deliberately avoid quoting salary numbers here, because credible figures vary by region, sector, and seniority.

A Domain-Ordered Preparation Sequence

Since GIAC publishes no domain weights, the sensible approach is to cover all six and sequence them by dependency. Methodology and operational security come first because they frame everything else; collection skills come next because they generate the material the investigation domains consume.

Adjust the pace to your background; an analyst who already works in threat intelligence may compress Week 3, while a newcomer may need longer on Week 2. For a fuller planning framework, see the GOSI study guide, and keep the GOSI cheat sheet handy as a last-pass review of must-know facts. When you are ready to test yourself under timed conditions, the GOSI practice tests are a good next step.

Frequently Asked Questions