- The Short Answer: What GRTP Stands For
- Who Issues GIAC Red Team Professional
- Why the Acronym Causes Confusion
- What the Credential Validates
- The Ten Objective Areas, Explained
- Exam Mechanics at a Glance
- What CyberLive Means for Candidates
- How SEC565 Relates to the Exam
- GRTP Compared With Similar Names
- Who Should Pursue It and Who Hires
- Sequencing Your Preparation Around GRTP's Domains
- Frequently Asked Questions
- GRTP means GIAC Red Team Professional, a red team operations and adversary emulation certification from GIAC.
- The exam has 82 questions, a 3-hour limit, a 76% minimum passing score, and CyberLive virtual-machine testing.
- GRTP covers ten objective areas, from Adversary Emulation Fundamentals to Red Team Engagement Planning and Reporting.
- The exam fee is USD 999; a failed-exam retake is USD 899, and the credential is valid for four years.
The Short Answer: What GRTP Stands For
In this article, and across this site, GRTP means GIAC Red Team Professional. It is a certification for practitioners who plan, execute, and report on red team engagements and adversary emulation. The credential is issued by GIAC Certifications, the body formerly known as Global Information Assurance Certification, and administered by GIAC, LLC.
The name tells you what the credential is about. "Red Team" signals offensive security performed as a structured, objective-driven simulation of a real adversary rather than a one-off vulnerability scan. "Professional" signals a practitioner-level credential aimed at people who do this work, not a beginner awareness badge. If you want more variations on this same question, our pages on what GRTP is and what GRTP stands for approach it from slightly different angles.
Who Issues GIAC Red Team Professional
GIAC is a certification body widely associated with hands-on, practitioner-focused security credentials. The GRTP exam is proctored, delivered either onsite through Pearson VUE or remotely through ProctorU, subject to restrictions that can apply to a specific attempt. The certification-information page attached to your purchased attempt is the authority on that attempt's exact specifications, so always check it after purchase rather than relying on a third-party summary.
GIAC is closely affiliated with the SANS Institute, whose course SEC565: Red Team Operations and Adversary Emulation is the associated training path. Training is optional for sitting the exam, which we cover below and in more depth on our GRTP requirements page.
Why the Acronym Causes Confusion
"GRTP" is a short, reusable string, and more than one credential or program in the wider professional world has used the same four letters. A search for the acronym can surface unrelated material with different certifying bodies, different fees, different exam lengths, and different content. That matters because a number copied from the wrong source can derail your planning.
The same caution applies to near-miss names. CRTP, CRTO, and OSEP are separate credentials from separate organizations, and none of their specifications apply to GRTP. We compare them directly in a later section.
What the Credential Validates
GRTP validates a practitioner's ability to run an adversary emulation engagement end to end. That means more than exploiting a single host. A candidate is expected to reason about how an attacker builds infrastructure, gains an initial foothold, enumerates an environment, escalates privileges, moves through an Active Directory domain, persists, and extracts data, while also planning the engagement and communicating results.
The emphasis on planning and reporting is a meaningful differentiator. Many offensive credentials concentrate on technique. GRTP also treats engagement scoping, rules, and reporting as examinable content, reflecting how professional red teams actually operate. For a view of how the credential fits into job roles, see our notes on GRTP jobs.
The Ten Objective Areas, Explained
GIAC publishes ten exam objective headings for GRTP. These are issuer headings in sequence, not a numbered, weighted domain system. GIAC's public sources do not publish percentage weights for them, so you should not assume the exam allocates questions equally across the ten. Our complete guide to all 10 GRTP content areas goes deeper on each; here is an orientation.
Adversary Emulation Fundamentals
The conceptual foundation: what emulating a specific adversary means and how it differs from generic penetration testing.
- Threat-informed, objective-driven engagement thinking
- Mapping adversary behavior to testable actions
- Understanding what a red team is trying to demonstrate
Red Team Engagement Planning and Reporting
The operational wrapper around the technical work.
- Scoping, objectives, and engagement rules
- Capturing evidence as you operate
- Communicating findings in a form defenders can act on
Creating the Attack infrastructure and Command and Control infrastructure
Two related objectives about the tooling an operator relies on. Note that GIAC's headings use a lowercase "infrastructure" in these titles.
- How operators stand up and organize attack-side resources
- How command-and-control channels work and how their output is interpreted
- Operational considerations for keeping a long-running engagement stable
Gaining Access, Discovery and Enumeration
The early and middle stages of an intrusion.
- Establishing an initial foothold in a target environment
- Systematically enumerating hosts, users, and services
- Turning enumeration data into the next move
Enumerating and Attacking Privileges, Attacking Active Directory, Leveraging the Domain
The core of many enterprise red team scenarios.
- Identifying and abusing privilege relationships
- Attacking Active Directory components and trust relationships
- Using domain-level position to reach objectives
Persistence and Exfiltration
The late-stage objectives that mirror a real adversary's goals.
- Maintaining access across an engagement
- Moving target data out in a controlled, scoped way
One caution: because GIAC does not publish weights, any blog or seller claiming "Domain X is 20% of the exam" is stating something GIAC has not verified publicly. Prepare for all ten.
Exam Mechanics at a Glance
The table below summarizes the verified, current specifications. Always confirm against the certification-information page for your own attempt, since that page is authoritative for the attempt you purchase.
| Item | GIAC Red Team Professional (GRTP) |
|---|---|
| Issuer | GIAC Certifications (administered by GIAC, LLC) |
| Questions | 82 |
| Time limit | 3 hours |
| Minimum passing score | 76% (exam versions released on or after January 20, 2024) |
| Format | Proctored, web-based, with CyberLive virtual-machine testing |
| Proctoring | Pearson VUE onsite or ProctorU remote |
| Exam fee | USD 999 before tax |
| Failed-exam retake | USD 899 |
| Validity | 4 years |
| Renewal | 36 CPEs in the cycle or the renewal exam; USD 499 fee |
For a full pricing view, including the practice test and extension options, see our GRTP certification cost breakdown. To understand the threshold itself, our GRTP passing score page explains what 76% does and does not tell you.
Rules that affect how you prepare
- Reference materials: Paper books, notes, and an index are permitted. Electronic and internet resources are prohibited, as are exam or practice-question references.
- No revising after submission: Answers cannot be changed once submitted. GIAC provides a limited skip allowance and 15 minutes of break time.
- Attempt window: A standalone attempt is active for 120 days from activation. That is an access window, not an exam duration.
- Retakes: A retake normally requires a 30-day wait, and three failures trigger a one-year wait.
What CyberLive Means for Candidates
CyberLive is GIAC's performance-based testing format, in which candidates work against live virtual machines rather than only choosing answers from a list. GIAC identifies CyberLive as part of the GRTP exam, and its GRTP page describes it as replacing traditional multiple-choice testing. GIAC's broader category explanation, however, describes practitioner exams as combining multiple-choice and practical challenges.
That wording difference is worth taking seriously. It does not establish that GRTP is entirely practical, and it does not establish an exact mix of item types. GIAC does not publicly specify the number of scored versus unscored items or a numeric split. The practical takeaway: prepare to perform tasks hands-on, and also to recall concepts and interpret output, rather than betting on one style.
Candidate discussion in online forums has shown confusion about how CyberLive changes affected GRTP. Those threads are anecdotes, and they do not verify when any change took effect. Rely on the certification-information page for your attempt, not forum recollections.
Key Takeaway
Because paper notes are allowed but electronic resources are not, build your index around commands, tool behaviors, and concept lookups you can find quickly on paper, and then practice using it under time pressure inside a lab environment. Our GRTP cheat sheet is a good starting point for what belongs on a single page.
How SEC565 Relates to the Exam
SEC565: Red Team Operations and Adversary Emulation is the SANS course affiliated with GRTP preparation. SANS groups the ten GIAC objectives into six practical course domains, and the current course page lists 28 labs, six instructor-led days, and 36 self-paced hours. Those are training features. They are not exam task counts and not exam durations.
The course also includes a capstone Capture the Flag. That capstone is preparation, not a separate requirement for the certification. Likewise, newer curriculum topics highlighted in course marketing, such as AI-assisted intelligence analysis or MCP-based command and control, are part of the training offering and do not by themselves establish additional GIAC exam objectives or a separately versioned exam outline.
Training is not mandatory. GIAC lists no required education, experience hours, training hours, or references to sit the exam, though preparation is recommended. If you add the exam to a SANS course purchase, the exam add-on is also USD 999, with tuition separate. For a plan that works whether or not you take the course, see our GRTP study guide and our overview of GRTP training.
GRTP Compared With Similar Names
Searchers often land on GRTP while looking for other red team credentials. These are distinct credentials from different organizations, and their formats do not transfer to GRTP.
| Credential | Issuer | Relationship to GRTP |
|---|---|---|
| GRTP (GIAC Red Team Professional) | GIAC | The subject of this site |
| CRTP (Certified Red Team Professional) | Altered Security | Separate credential with its own lab and exam |
| CRTO (Red Team Operator) | Zero-Point Security | Separate credential; the course is called Red Team Operations |
| OSEP | OffSec | Separate credential with its own multi-hour assessment and reporting window |
Candidate conversations sometimes treat GRTP as a follow-on to CRTO, but that is community experience rather than an official pathway. None of the other credentials' timings, objectives, or fees apply to GRTP. If you are weighing the options, our GRTP difficulty guide discusses how candidates describe the challenge.
Who Should Pursue It and Who Hires
GRTP suits practitioners whose work involves, or is heading toward, adversary emulation, red team operations, and offensive security consulting. Typical settings include internal red teams at larger organizations, security consultancies that sell red team engagements, and defensive teams, such as purple teams, that want to understand attacker tradecraft in depth.
On compensation, be careful. We found no representative dataset of GRTP-holder salaries and no verified causal salary uplift from holding the credential. Red team job salaries reflect many factors beyond one certification, and figures published for adjacent roles should not be read as GRTP evidence. Our GRTP salary guide and the ROI analysis treat this limitation openly, and we encourage you to weigh the USD 999 fee against your own career goals rather than a promised pay bump.
Sequencing Your Preparation Around GRTP's Domains
Since GIAC has not published weights, a sensible approach is to follow the natural flow of an engagement, which mirrors how the objectives build on one another. This is one possible sequence, not an official plan.
Foundations and infrastructure
- Adversary Emulation Fundamentals and Red Team Engagement Planning and Reporting, so the framing is clear first
- Creating the Attack infrastructure and Command and Control infrastructure, since later labs depend on them
Access, discovery, and privileges
- Gaining Access and Discovery and Enumeration
- Enumerating and Attacking Privileges, building the habit of turning enumeration output into decisions
Active Directory and endgame
- Attacking Active Directory and Leveraging the Domain, which tend to be dense and reward repetition
- Persistence and Exfiltration, then build and time-test your paper index
Spend your final days using your index against timed practice, because the allowed paper references only help if you can find entries quickly. For structured question practice, visit our GRTP practice test platform, and read the full study guide for a more detailed plan. Scheduling logistics, including attempt windows, are covered in our GRTP exam dates article.
Frequently Asked Questions
GRTP stands for GIAC Red Team Professional. It is a certification from GIAC covering red team operations and adversary emulation. See also our page on GRTP certification for more detail.
No. Other programs share the letters, but they have different certifying bodies, fees, and content. This site covers only GIAC Red Team Professional, so verify the issuer before trusting any quoted cost, question count, or passing score.
GIAC lists 82 questions, a three-hour limit, and a 76% minimum passing score for exam versions released on or after January 20, 2024. Some third-party sites list older or different numbers, so rely on GIAC's current published values.
No. GIAC lists no mandatory education, experience, or training requirement. SEC565 is the affiliated preparation course, and it is recommended preparation rather than a prerequisite.
GRTP is valid for four years. You can renew by earning 36 qualifying CPEs during the cycle or by passing the renewal exam, with a USD 499 renewal fee. Documentation and payment are due before expiry.