GRTP Certification

What the GIAC Red Team Professional Certification Actually Is

GRTP stands for GIAC Red Team Professional. It is issued by GIAC Certifications (administered by GIAC, LLC) and validates that a candidate can plan and run a red team engagement, build and operate attack and command-and-control infrastructure, move through an Active Directory environment, and communicate the results. The acronym is shared with other credentials from unrelated bodies, so when you see a price, question count or passing score for "GRTP", confirm it comes from GIAC before you plan around it. If you are still orienting yourself, the explainers at What Is GRTP Certification? and What Does GRTP Stand For? cover the naming question in more depth.

The credential is aimed at practitioners who emulate adversaries rather than simply scan for vulnerabilities. That distinction matters for how you prepare: the exam rewards understanding why an operator picks a technique, how it will look to defenders, and how it fits into an engagement narrative, not only whether you can run a tool.

The Exam in Numbers: Format, Timing and Scoring

The figures below come from GIAC's own published pages as of the research date for this article. Always confirm them against the certification information page for the specific attempt you purchase, since that page governs your attempt.

A note on the passing score: 76% is a minimum threshold, not a pass rate. The share of candidates who pass is a different quantity, and GIAC does not publish it for this exam. Our discussion in GRTP Passing Score 2026 and GRTP Pass Rate 2026: What the Data Shows separates these ideas, and it is worth reading before you trust any seller's claimed "success rate".

How CyberLive Changes Preparation

GIAC identifies GRTP as using CyberLive, its performance-based testing method in which candidates interact with virtual machines rather than only answering abstract questions. GIAC's GRTP page describes CyberLive as replacing traditional multiple-choice testing, while its broader article on hands-on testing describes practitioner exams as combining multiple-choice and practical challenges. That wording difference means nobody outside GIAC can responsibly tell you the exact split between item types, or how many items are scored versus unscored. Be skeptical of any guide that claims to know.

What you can do is prepare for both ends of the spectrum:

• Be fluent at the command line. If a task asks you to enumerate a domain, interpret tool output or recognize a misconfiguration, you need muscle memory, not a lookup you plan to perform mid-exam.
• Understand output, not just invocation. Knowing what a command returns, and what a defender would see, is what separates operators from tool-runners.
• Keep theory sharp. Engagement planning, rules of engagement, threat-informed emulation and reporting concepts are still testable knowledge areas.

One distinction deserves emphasis. Marketplace practice questions that show you a snippet of C2 output and ask what it means are useful for pattern recognition, but they are not the same as operating a live virtual machine under GIAC's conditions. We have not inspected paid third-party material, so we make no claim about its equivalence to the real environment. For a realistic sense of the challenge level, see How Hard Is the GRTP Exam?

The Ten Objective Areas, Explained

GIAC publishes ten sequential exam objective headings for GRTP. They are not a numbered, weighted domain system, and GIAC's retrieved pages do not provide percentage weights or identify a highest-weight objective. Do not allocate study time based on invented percentages; the full breakdown lives in our GRTP Exam Domains guide. Here is what each area asks of you in practice.

Where SEC565 Fits (and Where It Doesn't)

The affiliated training course is SANS SEC565: Red Team Operations and Adversary Emulation. SANS organizes its preparation material into six practical course domains that map onto the ten GIAC objective headings. The current course page lists 28 labs, six instructor-led days and 36 self-paced hours, and the course ends with a capstone Capture the Flag.

Training is optional. GIAC mandates no courses, experience hours or references, so candidates who already have strong operational backgrounds can attempt the exam on preparation alone. Details on eligibility are in GRTP Requirements 2026, and an overview of course options appears under GRTP Training.

Fees, Retakes and Attempt Windows

GIAC's published pricing, before tax, as of our research date:

• Exam attempt: USD 999, with no member or non-member tiers published
• Failed-exam retake: USD 899
• 45-day extension: USD 479
• Practice test: USD 399
• SANS-associated exam add-on: USD 999, with course tuition separate

The attempt window is not the exam length. A standalone attempt is valid for 120 days from activation, while a bundled attempt runs 120 days from the end of the training event or matching the OnDemand course deadline. Extensions add 45 days each within a 570-day total-access limit.

Retake rules are worth knowing before you book. A failed exam normally requires a 30-day wait, and the 60-day extension includes that waiting period. Three failures trigger a one-year wait. Scheduling logistics are covered in GRTP Exam Dates 2026, and a fuller pricing walkthrough is in GRTP Certification Cost 2026.

Building a Paper Index That Works Under Time Pressure

Because paper books, notes and an index are permitted, your index is a genuine competitive advantage, but only if it is built from your own practice rather than copied. Electronic devices and practice-question references are prohibited, so everything must be on paper.

A GRTP-appropriate index typically has three layers:

1. Theory layer. Engagement planning terms, rules-of-engagement concepts, emulation methodology and reporting structure, indexed by objective heading.
2. Command layer. Syntax you used in labs for enumeration, privilege checks, Active Directory interaction and C2 operations, with a note on what the output looks like.
3. Lab layer. A short entry per lab you completed: what the scenario was, what worked, what failed and what surprised you.

Sequencing the Ten Objectives Across Your Prep

Generic study advice is less useful here than a sequence that follows how an engagement actually unfolds. Since GIAC does not publish objective weights, avoid over-investing in any one area on the strength of a rumor. A reasonable ordering builds dependencies first. For a complete plan, see the GRTP Study Guide.

Adjust the pace to your background. A working operator may compress the early weeks, while someone new to Active Directory attack paths should lengthen weeks four and five. If you want to test retention, our practice tests can help you find which objective areas need another pass, though no practice material replaces live-environment repetition.

GRTP Next to CRTP, CRTO and OSEP

Searchers often compare GRTP with other red team credentials. These are separate credentials from different issuers, and their formats, objectives and timings never carry over to GRTP.

Candidate discussion suggests some people pursue GRTP after CRTO, treating the lab-driven credential as groundwork and GRTP as a broader, framework-aware follow-on. That is anecdote, not a validated pathway, so choose based on what each exam actually tests and what your employer or target roles value.

Career Value, Salary Claims and Renewal

Be careful with salary figures. We found no representative dataset of GRTP holders' earnings and no verified causal uplift from holding the credential, so we will not quote one. Red team job salaries describe roles, not the effect of a certification, and some published "red teamer" salary FAQs are mislabeled for other job families. Read GRTP Salary Guide and Is the GRTP Certification Worth It? for a more careful treatment, and browse GRTP Jobs for the kinds of roles where red team skills matter, such as internal red teams, offensive security consultancies and adversary-emulation functions.

The credential is valid for four years. To renew, you need 36 qualifying CPEs during the active cycle or a pass on the renewal exam, with a USD 499 renewal fee. CPE documentation and payment are due before expiry, and a later renewal within two years of a full-price renewal costs USD 249.

Frequently Asked Questions

For further reading, start with our GRTP certification overview and, when you are ready to assess your readiness, try the questions on the main practice test site.