- What GRTP Certification Actually Is
- Who Issues It and How It Is Delivered
- The Exam at a Glance
- What CyberLive Means for Your Preparation
- The Ten Objective Areas
- How SEC565 Fits In
- Fees, Attempt Windows and Retakes
- Open-Book Rules and Why Your Index Matters
- Who Benefits and What Employers See
- GRTP Compared With CRTP, CRTO and OSEP
- Validity and Renewal
- Frequently Asked Questions
- GRTP is GIAC Red Team Professional: an 82-question, three-hour proctored exam with a 76% minimum passing score.
- CyberLive virtual-machine testing is part of the exam, so you must operate in live environments, not just recall theory.
- Ten official objective headings cover everything from engagement planning to Active Directory attacks; GIAC publishes no percentage weights.
- Paper books and notes are allowed; electronic references and practice-question material are prohibited, which makes a well-built index essential.
What GRTP Certification Actually Is
GRTP stands for GIAC Red Team Professional. It is a practitioner-level credential issued by GIAC Certifications that validates your ability to plan and run red team operations and adversary emulation engagements. In plain terms, it tests whether you can think and work like a real adversary within an authorized engagement: build attack infrastructure, gain access, move through an Active Directory environment, persist, exfiltrate, and then document what you did in a way a client can act on.
That identity matters because the acronym is shared by other, unrelated credentials. On this site, GRTP always means the GIAC credential. If you are comparing sources, check that any exam fee, question count or passing score you find is attributed to GIAC. Several third-party pages carry stale or conflicting numbers, which we cover below. For a shorter definitional overview, see What Is GRTP? and What Does GRTP Stand For?
Who Issues It and How It Is Delivered
GIAC Certifications (formerly Global Information Assurance Certification) is administered by GIAC, LLC. The exam is delivered as a proctored, web-based test through Pearson VUE at a test center or through ProctorU remotely, subject to the restrictions that apply to your particular attempt. The certification-information page attached to a purchased attempt is the authority for that attempt's specifications, so check it after you register rather than relying on a blog post, including this one.
There is no mandatory education requirement, experience-hours threshold, training requirement or reference check to sit the exam. GIAC recommends preparation, but it does not gate entry. Our GRTP requirements guide walks through what that means in practice.
The Exam at a Glance
| Attribute | GIAC Red Team Professional (GRTP) |
|---|---|
| Number of questions | 82 |
| Time limit | 3 hours |
| Minimum passing score | 76% (exam versions released on or after January 20, 2024) |
| Format | Proctored, web-based practitioner exam with CyberLive virtual-machine testing |
| Exam fee | USD 999 before tax |
| Retake fee | USD 899 |
| Validity | 4 years |
| Reference materials | Paper books, notes and index permitted; electronics and practice-question material prohibited |
Be careful with third-party listings. Some sites still show 75 questions, 120 minutes, a USD 979 fee, or passing thresholds around 70% or 67%. These conflict with GIAC's current published figures and should not be used for planning. For a deeper look at the threshold itself, read our GRTP passing score guide.
What CyberLive Means for Your Preparation
GIAC identifies the GRTP exam as using CyberLive, its performance-based testing approach in which candidates work in virtual machines rather than only answering conventional items. GIAC's GRTP page describes CyberLive as replacing traditional multiple-choice testing, while its broader article on practitioner exams describes a combination of multiple-choice and practical challenges. The exact item-type mix and the number of scored versus unscored items are not publicly specified, and we will not guess at a ratio.
This is why pure memorization strategies underperform for a credential like this one. Practice questions can help you test recall and scenario reasoning, but they are not a substitute for lab time. You can try question-style practice on the main GRTP practice test site, and then validate those skills hands-on in a lab. For a realistic view of effort, see How Hard Is the GRTP Exam?
The Ten Objective Areas
GIAC publishes ten exam-objective headings for GRTP. They are sequential headings, not an issuer-numbered weighted-domain system, and no official percentage weights or highest-weight area have been published. That means you should not assume equal question counts per area. Treat all ten as fair game. Our complete guide to all 10 GRTP content areas expands on each.
Domain 1: Adversary Emulation Fundamentals
The conceptual foundation: what adversary emulation is, how it differs from a standard penetration test, and how threat intelligence shapes an engagement.
- Emulating a specific threat actor's behavior rather than running generic exploits
- Mapping techniques to a recognized adversary-behavior framework
- Defining objectives that test detection and response, not just access
Domain 2: Attacking Active Directory
Active Directory is the center of gravity in most enterprise red team work.
- Authentication mechanisms and how attackers abuse them
- Credential theft, ticket-based attacks and delegation weaknesses
- Understanding trust relationships between domains and forests
Domain 3: Command and Control infrastructure
How operators communicate with implants and manage sessions at scale.
- Operating a C2 framework and interpreting its output
- Choosing communication channels and managing callback behavior
- Operational security considerations when running long engagements
Domain 4: Creating the Attack infrastructure
Standing up the redirectors, servers and supporting services an engagement depends on.
- Separating long-haul and short-haul infrastructure
- Redirection and filtering to protect the team server
- Building resilient, disposable infrastructure
Domain 5: Discovery and Enumeration
Learning the environment before acting in it.
- Host, network, domain and share enumeration
- Balancing thoroughness against detection risk
- Turning raw enumeration into an attack path
Domain 6: Enumerating and Attacking Privileges
Finding and abusing the permissions, misconfigurations and trust paths that lead to elevated access.
- Local and domain privilege escalation paths
- Access control weaknesses and misconfigured services
- Identifying high-value accounts and targets
Domain 7: Gaining Access
Establishing an initial foothold.
- Initial access techniques and payload delivery considerations
- Evading common defensive controls at the point of entry
- Setting up a stable first session
Domain 8: Leveraging the Domain
Using an established foothold to move laterally and advance toward the engagement objective.
- Lateral movement techniques and their trade-offs
- Pivoting through segmented networks
- Reaching objective systems with minimal noise
Domain 9: Persistence and Exfiltration
Maintaining access and demonstrating impact by moving data out.
- Persistence mechanisms and how defenders find them
- Controlled, authorized data exfiltration methods
- Cleanup and minimizing residual artifacts
Domain 10: Red Team Engagement Planning and Reporting
The professional wrapper around the technical work.
- Rules of engagement, scoping and deconfliction
- Tracking activity so findings can be reproduced and defended
- Writing reports that communicate risk and recommendations to both technical and executive readers
How SEC565 Fits In
The affiliated preparation course is SANS SEC565: Red Team Operations and Adversary Emulation. SANS groups the ten GIAC objectives into six practical course domains. The current course page lists 28 labs, six instructor-led days and 36 self-paced hours, and it includes a capstone Capture the Flag. Those are features of the training, not the exam: they do not describe exam task counts or exam duration, and the capstone is preparation rather than a certification requirement.
Newer SEC565 topics, such as AI-assisted intelligence analysis and modern C2 tooling, appear in the course material. They do not establish additional GIAC objective headings or a separate 2026 exam version. The public objective list has no edition identifier, so rely on the live GIAC page for the current scope.
Fees, Attempt Windows and Retakes
The published GIAC figures are straightforward, and they are all before tax:
- Exam attempt: USD 999 (no member or non-member tiers are published)
- Failed-exam retake: USD 899
- 45-day extension: USD 479
- Practice test: USD 399
An attempt must be used within a window: 120 days from activation for a standalone purchase, or 120 days from the end of a bundled training event (matching the OnDemand deadline where relevant). These are access windows, not exam durations. Extensions add 45 days each, within a 570-day total-access limit.
After a failed attempt, a 30-day waiting period normally applies before a retake. A 60-day extension includes that wait. Three failures trigger a one-year wait. Build these rules into your plan, especially if you are scheduling around a work project or a training class. See GRTP Certification Cost for a full pricing breakdown and GRTP exam dates and scheduling for timing details.
Open-Book Rules and Why Your Index Matters
GRTP permits paper books, notes and an index. Electronic devices, internet access, and exam or practice-question references are prohibited. Answers cannot be revised after submission, GIAC provides a limited skip allowance, and you get 15 minutes of break time. The calculator and adaptive-testing status for this specific exam is unverified, so check your attempt's information page.
With 82 questions in three hours, you have roughly two minutes per question on average, though practical items may consume far more than their share. That leaves little room for paging through binders. A good index turns an open-book exam into a real advantage.
Key Takeaway
Build your index as three layers: theory (concepts and definitions), commands (syntax you will actually type), and labs (the exact steps you followed in practice). Sort entries by the ten objective headings so you can jump straight to the relevant area. Rebuild it from your own lab notes rather than copying someone else's; the act of writing it is half the learning.
For a compact review aid to pair with your index, see the GRTP cheat sheet.
Who Benefits and What Employers See
GRTP is aimed at professionals who perform or support offensive security work: red team operators, penetration testers moving toward adversary emulation, purple team practitioners, and security engineers who need to understand attacker tradecraft so they can build better detections. Employers who hire for these roles include consultancies and security vendors that sell red team services, large enterprises with internal offensive security teams, and organizations that run purple team programs. For the role landscape, see GRTP jobs.
On compensation, we want to be careful. No representative dataset of GRTP holders' salaries and no verified causal salary uplift from the certification were found. Red team job-market figures describe the role, not this credential, and some published salary pages are mislabeled or unrelated. Treat any precise "GRTP salary" number with skepticism and read our salary analysis and ROI discussion for a more careful framing.
The same caution applies to pass rates. A minimum passing score (76%) is the cutoff on your exam, not the share of candidates who pass. A seller's claimed customer success is a third, unverifiable thing. See what the pass-rate data does and does not show.
GRTP Compared With CRTP, CRTO and OSEP
Searchers often compare GRTP with other red team credentials. They are separate credentials from separate issuers, and facts from one never apply to another.
| Credential | Issuer | Notes |
|---|---|---|
| GRTP (GIAC Red Team Professional) | GIAC | 82 questions in 3 hours, CyberLive virtual-machine testing, open-book with paper materials |
| CRTP (Certified Red Team Professional) | Altered Security | Separate credential with its own lab-based format |
| CRTO (Red Team Operator) | Zero-Point Security | Based on the Red Team Operations course; people commonly search it as CRTO |
| OSEP | OffSec | Distinct assessment with its own long exam window and a separate documentation-upload period |
Practically, GRTP's distinguishing features are its time-boxed three-hour format, its broad ten-heading scope that includes engagement planning and reporting, and its open-book index strategy. Some candidates discuss pursuing GRTP after a hands-on credential such as CRTO, but these anecdotes do not establish a validated path or a pass rate. Choose based on the skills you need to demonstrate and the employers you are targeting.
Validity and Renewal
GRTP is valid for four years. To renew, you can either earn 36 qualifying CPEs during the active four-year cycle or pass the renewal exam. The renewal fee is USD 499, and additional renewals within two years of a full-price renewal cost USD 249. CPE documentation and payment are due before expiry. If your work already involves red team operations, reporting and conference or training activity, accumulating CPEs may be straightforward, but track them as you go.
Frequently Asked Questions
GRTP stands for GIAC Red Team Professional, a certification from GIAC Certifications that validates red team operations and adversary emulation skills. See also What Is GRTP Certification? and What Does GRTP Mean?
The current GIAC specification is 82 questions in three hours with a 76% minimum passing score for exam versions released on or after January 20, 2024. Older figures such as 75 questions or 120 minutes appear on some third-party sites but conflict with GIAC's published details.
Partly. Paper books, notes and an index are allowed. Electronic devices, internet access, and exam or practice-question references are prohibited, so a well-organized paper index is one of your most valuable assets.
No. GIAC does not require specific education, experience hours or training to sit the exam. SEC565 is the affiliated preparation course, and its tuition is separate from the exam fee, but it is recommended preparation rather than a requirement. Our GRTP study guide covers how to plan your preparation.
The exam is USD 999 before tax, with a USD 899 retake. The certification is valid for four years and renews through 36 CPEs or the renewal exam, with a USD 499 renewal fee. You can find more practice material on the main practice test site.