- What GRTP Means
- The Acronym Problem: Why Identity Matters
- Who Issues It and What the Name Tells You
- The Ten Objectives Behind the Name
- How the Exam Works
- Fees, Access Windows and Validity
- SEC565 and the Credential
- GRTP Versus CRTP, CRTO and OSEP
- Who the Credential Is For
- Where to Go Next
- Frequently Asked Questions
- GRTP means GIAC Red Team Professional, a credential from GIAC Certifications focused on red team operations and adversary emulation.
- The exam has 82 questions, a three-hour limit and a 76% minimum passing score, using CyberLive virtual-machine testing.
- GIAC publishes ten exam-objective headings but no percentage weights, so never trust a source claiming exact domain weightings.
- The exam fee is USD 999; a failed-exam retake costs USD 899; certification is valid for four years.
What GRTP Means
GRTP stands for GIAC Red Team Professional. It is a cybersecurity certification issued by GIAC Certifications, the credentialing body formerly known as Global Information Assurance Certification. The "GRTP" abbreviation follows GIAC's usual pattern: a G prefix for GIAC, followed by letters that compress the credential's subject. Here, that subject is red team professional work, meaning the planned, adversary-style testing of an organization's defenses.
If you landed here asking "what does GRTP mean," the short answer is a practitioner-level credential that verifies you can plan and carry out red team engagements, from building attack infrastructure through to reporting. For a broader introduction, our explainers What Is GRTP? and What Does GRTP Stand For? cover the same ground from slightly different angles.
The Acronym Problem: Why Identity Matters
Several unrelated credentials and terms share similar letters across different industries. Search results for "GRTP" can therefore mix material about entirely different certifications, with different issuers, fees, exam lengths and syllabi. That is a real hazard for candidates: a fee figure, question count or pass threshold copied from the wrong credential will mislead your planning.
When specifications matter, the authority is GIAC itself. The certification-information page attached to a purchased attempt is the definitive statement of the specs for that attempt.
Who Issues It and What the Name Tells You
GIAC, LLC administers the credential. Exams are delivered through Pearson VUE at a test center or through ProctorU remote proctoring, subject to attempt-specific modality restrictions. The word "Professional" in the title places GRTP among practitioner-level certifications rather than entry-level awareness credentials, and the "Red Team" portion signals the emphasis: not one-off vulnerability scanning, but sustained, objective-driven adversary emulation.
That emphasis explains the topic list. A red team professional is expected to understand the whole lifecycle of an engagement, including the parts that happen before any exploit runs (planning, infrastructure) and after access is gained (privilege abuse, persistence, exfiltration, reporting). For the full credential overview, see GRTP Certification.
The Ten Objectives Behind the Name
GIAC publishes the scope of the exam as ten sequential objective headings. These are issuer-listed headings, not a numbered weighted-domain system, and GIAC has not published percentage weights or a highest-weight objective. Do not assume equal question counts per objective either. The headings are:
- Adversary Emulation Fundamentals
- Attacking Active Directory
- Command and Control infrastructure
- Creating the Attack infrastructure
- Discovery and Enumeration
- Enumerating and Attacking Privileges
- Gaining Access
- Leveraging the Domain
- Persistence and Exfiltration
- Red Team Engagement Planning and Reporting
Adversary Emulation Fundamentals and Engagement Planning
These two headings frame the work as a professional engagement rather than a hacking exercise.
- Know how emulating a specific threat actor differs from generic penetration testing.
- Understand scoping, rules of engagement and how findings are reported to defenders and stakeholders.
Attack and Command and Control Infrastructure
Two headings cover the plumbing behind an operation: how you stand up attack infrastructure and how command and control channels are built and managed.
- Expect to reason about how infrastructure choices affect operational security and resilience.
- Be ready to interpret C2 behavior and configuration, not just recite definitions.
Discovery, Access, Privileges and the Domain
The middle of the list follows the intrusion path: Discovery and Enumeration, Gaining Access, Enumerating and Attacking Privileges, Attacking Active Directory and Leveraging the Domain.
- Active Directory features in two separate headings, which signals how central Windows enterprise environments are to the exam.
- Practice moving from a foothold to broader domain influence, and explain why each step works.
Persistence and Exfiltration
The closing technical objective covers keeping access and moving data out, both of which are central to realistic adversary emulation.
- Understand persistence mechanisms and the trade-offs of each.
- Know how exfiltration is staged and what defenders might observe.
For a heading-by-heading breakdown, read GRTP Exam Domains 2026: Complete Guide to All 10 Content Areas.
How the Exam Works
The GRTP exam is a single proctored, web-based practitioner exam. Published specifications are:
| Item | Published detail |
|---|---|
| Questions | 82 |
| Time limit | 3 hours |
| Minimum passing score | 76% (exam versions released on or after January 20, 2024) |
| Format | Proctored web-based exam with CyberLive virtual-machine testing |
| Delivery | Pearson VUE onsite or ProctorU remote |
| Prerequisites | None mandatory; preparation recommended |
What CyberLive means for you
CyberLive is GIAC's performance-based testing approach, in which you work with virtual machines rather than only choosing from written options. GIAC's exam page describes CyberLive as replacing traditional multiple-choice testing for GRTP, while GIAC's broader article on practitioner exams describes a combination of multiple-choice and practical challenges. The exact item types and the mix of scored versus unscored items are not publicly specified, so avoid any source claiming a precise breakdown.
Rules that shape your preparation
- Paper books, notes and an index are permitted; electronic and internet resources are prohibited, as are exam or practice-question references.
- Answers cannot be revised after submission.
- GIAC provides a limited skip allowance and 15 minutes of break time.
- The three-hour limit covers the single exam; no separate public practical timer has been verified.
For a realistic view of difficulty, see How Hard Is the GRTP Exam? Complete Difficulty Guide 2026, and for threshold details, GRTP Passing Score 2026: Exactly What You Need to Pass. Note that a minimum passing score is not the same thing as a population pass rate, and GIAC has not published the latter; our GRTP Pass Rate 2026: What the Data Shows article explains the distinction.
Fees, Access Windows and Validity
| Item | Amount or rule |
|---|---|
| Exam fee | USD 999 before tax |
| Failed-exam retake | USD 899 |
| 45-day extension | USD 479 |
| Practice test | USD 399 |
| Renewal | USD 499 (USD 249 for additional renewals within 2 years of a full-price renewal) |
| Validity | 4 years |
GIAC does not publish separate member and non-member price tiers. If you take the exam as an add-on to SANS training, the exam add-on is also USD 999, with tuition priced separately.
Attempt windows and retakes
A standalone attempt is available for 120 days from activation. With bundled training, the window runs 120 days from the end of the event or to match the OnDemand course deadline. These are access windows, not exam durations. After a failed exam, a retake normally requires a 30-day wait, three failures trigger a one-year wait, and extensions add 45 days within a 570-day total-access limit.
Renewal
To renew, you either earn 36 qualifying CPEs during the active four-year cycle or pass the renewal exam, with documentation and payment due before expiry. For the complete money picture, read GRTP Certification Cost 2026: Complete Pricing Breakdown, and for eligibility questions, GRTP Requirements 2026: Eligibility, Prerequisites & How to Qualify.
SEC565 and the Credential
The affiliated preparation course is SANS SEC565: Red Team Operations and Adversary Emulation. The course page lists 28 labs, six instructor-led days and 36 self-paced hours, and SANS groups the ten GIAC objectives into six practical course domains. It also includes a capstone Capture the Flag.
Key Takeaway
Treat SEC565 as preparation, not as the definition of the exam. The lab count, course hours and capstone are training features, not exam task counts or exam duration, and the capstone is not a separate certification requirement. SANS also lists newer topics such as AI-assisted intelligence analysis and MCP-based C2 in its curriculum; those do not add objective headings to the GIAC exam. Training is optional: GIAC sets no mandatory training hours.
If you want a structured preparation sequence, our GRTP Study Guide 2026: How to Pass on Your First Attempt and the overview at GRTP Training are the next stops.
GRTP Versus CRTP, CRTO and OSEP
Candidates often search comparisons because the names look alike. They are different credentials from different organizations, and nothing about one's exam applies to another.
| Credential | Issuer | Note |
|---|---|---|
| GRTP: GIAC Red Team Professional | GIAC Certifications | 82 questions, 3 hours, 76% minimum passing score, CyberLive |
| CRTP: Certified Red Team Professional | Altered Security | Separate credential tied to Altered Security's lab offering |
| CRTO (searcher shorthand) | Zero-Point Security | Current course is Red Team Operations; credential is Red Team Operator |
| OSEP | OffSec | Separate credential with its own assessment and documentation window |
The practical takeaway: do not carry a duration, fee, objective list or passing rule from one of these into your GRTP planning. Some candidates report taking GRTP after another red team credential such as CRTO, but those anecdotes do not establish a validated path or any pass-rate advantage.
Who the Credential Is For
GRTP suits practitioners whose work involves offensive operations against enterprise environments: red team operators, adversary emulation specialists, senior penetration testers moving toward red teaming, and purple team practitioners who need to understand the attacker's playbook. Defenders who want to understand how real intrusions unfold, particularly through Active Directory, can also benefit.
On compensation, be cautious. No representative dataset of GRTP-holder salaries and no verified causal salary uplift from the credential were found. General red-team job pay should not be treated as evidence of what the certification itself earns you. Our GRTP Salary Guide 2026: Complete Earnings Analysis, GRTP Jobs and Is the GRTP Certification Worth It? Complete ROI Analysis 2026 discuss how to weigh the cost qualitatively.
Where to Go Next
Now that the meaning is settled, a sensible sequence is to confirm your timing with GRTP Exam Dates 2026: Testing Windows, Deadlines & Scheduling, check the issuer's current objective list, and then measure your readiness against realistic questions. You can test your knowledge with the GRTP practice tests on the main site and keep your weak objectives visible as you build your paper index. For scenario-style review of C2 output, Active Directory attack paths and engagement planning, the GRTP Exam Prep practice question bank is a convenient place to start.
Remember the caveat on any third-party question source: practice material helps you rehearse recall and reasoning, but it is not the live CyberLive environment, and no practice resource can promise a result. Hands-on lab time remains the closest rehearsal for the virtual-machine portion of the real exam.
Frequently Asked Questions
GRTP stands for GIAC Red Team Professional, a certification issued by GIAC Certifications covering red team operations and adversary emulation. It should not be confused with other credentials that happen to use similar letters.
The published specifications are 82 questions in a three-hour limit, with a 76% minimum passing score for exam versions released on or after January 20, 2024. Always confirm on the certification-information page for your purchased attempt.
No. GIAC lists no mandatory education, experience hours, training hours or references, though preparation is recommended. SEC565 is the affiliated SANS course, but it is optional.
No. CRTP is Altered Security's Certified Red Team Professional, and the course people call CRTO is Zero-Point Security's Red Team Operations with a Red Team Operator credential. GRTP is GIAC's own certification with its own exam rules and objectives.
The certification is valid for four years. Renewal requires either 36 qualifying CPEs during the cycle or passing the renewal exam, with a USD 499 renewal fee and documentation due before expiry.