- The Short Answer: What a GXPN Actually Is
- Who Issues It and Who Runs the Exam
- What the Credential Proves
- How the Exam Is Built: 60 Questions, 3 Hours, CyberLive
- The 14 Domains, Grouped by What They Demand
- The SANS SEC660 Connection
- Fees, Scheduling, and Rules That Matter
- Who Hires GXPN Holders
- Sequencing Your Preparation Around the Domains
- Frequently Asked Questions
- GXPN is the GIAC Exploit Researcher and Advanced Penetration Tester certification, issued by GIAC and focused on exploit development.
- The exam has 60 questions, a 3-hour limit, and a 67% minimum passing score, with CyberLive hands-on tasks included.
- GIAC publishes 14 objective domains for GXPN but no official percentage weights for them.
- A certification attempt costs USD $999, with retakes at USD $899; SANS training tuition is separate.
The Short Answer: What a GXPN Actually Is
A GXPN is a person who holds the GIAC Exploit Researcher and Advanced Penetration Tester certification, and the term is also the name of the credential itself. The acronym stands for that exact title. Where many penetration-testing certifications reward breadth, GXPN sits at the deep, technical end of offensive security: it tests whether you can understand how memory corruption works, defeat the mitigations designed to stop it, write working exploits, and carry out advanced attacks against networks and endpoints.
If you have seen the acronym elsewhere, this page is about one credential only: the GIAC certification. For related phrasing questions, our pages on what GXPN stands for and the meaning of GXPN cover the naming angle, while this article focuses on what the certification contains and who it is for.
Who Issues It and Who Runs the Exam
The certification is issued by GIAC Certifications (formerly Global Information Assurance Certification), administered by GIAC, LLC. The exam is delivered through Pearson VUE at a testing site or through ProctorU remotely, subject to the eligibility of your specific attempt. GIAC is closely associated with SANS Institute training, but the two functions are distinct: SANS teaches courses, and GIAC certifies knowledge. You can sit the exam without taking the course, since training is optional and recommended rather than required.
That separation matters for planning. Your attempt's details, including objectives, format, and passing score, are governed by the assigned attempt on GIAC's exam site, and those details take precedence over any third-party summary, including this one. Always confirm against your own attempt before test day.
What the Credential Proves
GXPN is a practitioner-level credential. Passing it signals that you can reason about low-level execution, build and adapt exploits, and operate against hardened targets where default tooling fails. It does not signal management skill or compliance expertise; it signals hands-on offensive depth.
There are no formal certification prerequisites. That is worth stating plainly, because the technical bar is high even though the paperwork bar is low. Candidates who succeed typically arrive comfortable with penetration testing, Linux and Windows internals at a working level, networking, and some programming. For a fuller breakdown of eligibility, see GXPN requirements and how to qualify.
How the Exam Is Built: 60 Questions, 3 Hours, CyberLive
The exam is a single proctored, web-based sitting with 60 total questions and a 3-hour time limit. It mixes multiple-choice questions with performance-based CyberLive tasks, where you work in a live environment rather than selecting an answer. The time limit covers the entire exam, CyberLive included, so a slow hands-on task costs you time on everything else.
| Exam Element | Detail |
|---|---|
| Total questions | 60 |
| Time limit | 3 hours, covering the complete exam including CyberLive |
| Question types | Multiple-choice plus performance-based CyberLive tasks |
| Minimum passing score | 67% |
| Reference materials | Open book: hardcopy books, notes, and an index only |
| On-screen tools | Calculator and scratch notepad |
| Break time | 15 minutes allowed |
| Changing answers | Submitted answers cannot be changed |
Open book, with real limits
The exam is open book, but only for physical materials: hardcopy books, notes, and an index. Internet access, personal electronic references, and any materials resembling practice or exam questions and answers are prohibited. In practice, a well-built index is a genuine competitive advantage, because the multiple-choice portion rewards fast retrieval of precise details such as offsets, protection behaviors, and tool syntax.
Why the 67% figure is not a pass rate
The 67% number is the minimum score needed to pass; it says nothing about how many candidates succeed. An official GXPN pass-rate statistic has not been verified, so be skeptical of any site quoting a precise percentage. Our piece on what the pass-rate data does and does not show goes deeper, and the passing score guide explains how the threshold applies.
The 14 Domains, Grouped by What They Demand
GIAC lists 14 objective headings for GXPN, in a published order, and does not assign official percentage weights to them. That means you cannot reliably prioritize by weight, so breadth matters. The domains are:
- Bypassing Linux Exploit Mitigations
- Bypassing Windows Memory Protections
- Endpoint Control Evasions and Escalation
- Establishing Network Access
- Infrastructure Manipulation and Exploitation
- Linux Execution, Memory, and Shellcode Foundations
- Practical Cryptography
- Practical Scripting for Offensive Operations
- Product Security Testing and Fuzzing Foundations
- Return Oriented Stack-Based Exploits
- Source Code Based Fuzzing Techniques
- Traffic Interception and Manipulation
- Windows Execution and Memory Foundations
- Windows Overflows and Execution Control
Rather than memorizing them as a flat list, it helps to see how they cluster. For a domain-by-domain walkthrough, read the complete guide to all 14 GXPN content areas.
Cluster 1: Memory and Execution Foundations
These domains are the bedrock that every exploit depends on. If they are weak, the mitigation-bypass domains will not make sense.
- Linux Execution, Memory, and Shellcode Foundations: how Linux processes lay out memory, how execution flows, and how shellcode is constructed and delivered.
- Windows Execution and Memory Foundations: the Windows equivalents, including how processes and memory behave under the platform.
Cluster 2: Exploitation and Mitigation Bypass
This is the signature GXPN territory, where you defeat the protections that make naive exploits fail.
- Bypassing Linux Exploit Mitigations and Bypassing Windows Memory Protections: understanding what each protection prevents and how it can be circumvented.
- Return Oriented Stack-Based Exploits: building control flow from existing code when injected code cannot run.
- Windows Overflows and Execution Control: turning an overflow into reliable control of execution on Windows.
Cluster 3: Discovery and Vulnerability Research
These domains cover finding flaws rather than only exploiting known ones.
- Product Security Testing and Fuzzing Foundations and Source Code Based Fuzzing Techniques: how fuzzing is designed, run, and interpreted to surface crashes worth investigating.
- Practical Cryptography: applying cryptographic knowledge to real attacks and weaknesses, not abstract theory.
Cluster 4: Network, Endpoint, and Infrastructure Operations
Here the focus shifts from single binaries to the environment around them.
- Establishing Network Access and Traffic Interception and Manipulation: gaining a foothold and shaping traffic once you have it.
- Endpoint Control Evasions and Escalation: slipping past endpoint defenses and elevating privilege.
- Infrastructure Manipulation and Exploitation: attacking the surrounding services and systems that tie an environment together.
- Practical Scripting for Offensive Operations: automating attacks and gluing tooling together, which also supports the CyberLive tasks.
Key Takeaway
Because GIAC publishes no weights, treat all 14 domains as fair game. Spend the most effort on the foundation domains and the mitigation-bypass domains, since they underpin nearly everything else on the exam.
The SANS SEC660 Connection
The training most associated with this certification is SANS SEC660: Advanced Penetration Testing, Exploit Writing, and Ethical Hacking. The course is organized into six preparation sections: five subject sections plus a Capture the Flag capstone. The capstone is a training exercise, and the course sections are an unweighted curriculum, so they should not be read as an exhaustive map of exam coverage or as the official domain structure.
SANS has also published a July 2026 update to the course, describing AI-assisted workflows and refreshed Windows and Linux exploitation labs. That date identifies a course update, not a new GXPN exam version, so do not assume the exam changed on the same schedule. SEC660 expects familiarity with penetration testing, Linux and Windows, and networking, and it recommends programming experience. Those are course expectations, separate from GIAC's eligibility rules.
If you are weighing whether to take the class, our GXPN training overview compares preparation routes, and the GXPN study guide shows how to combine course material with independent practice.
Fees, Scheduling, and Rules That Matter
| Item | Detail |
|---|---|
| Certification attempt | USD $999 |
| Retake | USD $899 |
| Official practice exam | USD $399 |
| Renewal fee | USD $499 (standard) |
| SANS training tuition | Separate from all GIAC fees |
| Attempt completion window | 120 days from activation |
| Certification validity | Four years |
Prices exclude applicable sales tax. The 120-day completion window starts at activation, so activating your attempt before you are ready burns calendar time. Plan your preparation first, then activate. For the full money picture, including how the training and exam costs stack, see the GXPN certification cost breakdown, and for timing, the GXPN exam dates and scheduling guide.
Renewal in brief
The certification stays valid for four years. To renew, you either earn 36 approved CPE credits during the active period or take a renewal exam, and you pay the standard USD $499 renewal fee in either case. Because CPE accrual is spread across years, starting early is far easier than scrambling near expiration.
Who Hires GXPN Holders
GXPN maps to roles where offensive depth is the job rather than a side skill. Employers that tend to value it include:
- Security consultancies and red-team practices that sell advanced adversary simulation and need testers who can go beyond scanner output.
- Product security and application security teams that fuzz and attack their own software before release, which aligns with the fuzzing and product-testing domains.
- Vulnerability research groups that analyze software for exploitable flaws.
- Large enterprises with internal red teams that test hardened endpoints and infrastructure.
- Government and defense-oriented organizations that need exploit-capable operators.
Specific compensation depends heavily on role, region, and seniority, and no figure should be treated as guaranteed. Our GXPN jobs overview and salary analysis discuss the market, and the ROI analysis helps you decide whether the investment fits your career path.
Sequencing Your Preparation Around the Domains
The one planning idea worth borrowing is to order your study by dependency rather than by the published list. Foundations first, because every later domain assumes them. A sample progression, which you should stretch or compress to fit your own schedule:
Execution and memory foundations
- Work through Linux Execution, Memory, and Shellcode Foundations and Windows Execution and Memory Foundations side by side.
- Practice reading memory layouts and writing basic shellcode until it is routine.
Overflows, ROP, and mitigation bypass
- Cover Windows Overflows and Execution Control, Return Oriented Stack-Based Exploits, and both bypass domains.
- Build exploits by hand so the mechanics are muscle memory, not memorized trivia.
Fuzzing, crypto, and scripting
- Study both fuzzing domains and Practical Cryptography.
- Use Practical Scripting for Offensive Operations to automate what you have already done manually.
Network, endpoint, and infrastructure
- Review Establishing Network Access, Traffic Interception and Manipulation, Endpoint Control Evasions and Escalation, and Infrastructure Manipulation and Exploitation.
- Build and refine your hardcopy index, then run timed practice that includes hands-on tasks.
Finish by drilling under the real constraints: a 3-hour clock, open-book hardcopy only, and no ability to revise submitted answers. Our GXPN practice tests are designed to help you rehearse that pacing and spot weak domains, and the difficulty guide explains where candidates typically struggle. Once you are close to test day, the one-page GXPN review is a handy final pass, and you can return to the main practice site for additional timed sets.
Frequently Asked Questions
It stands for GIAC Exploit Researcher and Advanced Penetration Tester. It is a certification issued by GIAC and centered on exploit development and advanced offensive security skills.
The exam has 60 questions with a 3-hour time limit covering everything, including the CyberLive hands-on tasks. The minimum passing score is 67%.
No. There are no formal certification prerequisites, and training is optional but recommended. SEC660 has its own recommended background, but that is separate from GIAC eligibility.
Yes, but only hardcopy books, notes, and an index. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.
It is valid for four years. Renew by earning 36 approved CPE credits during that period or by taking a renewal exam, plus the standard USD $499 renewal fee.