- The PICERL and DAIR incident handling processes
- Common incident response problems and how teams handle them
GIAC Certification Training Course
GIAC Certified Incident Handler (GCIH) Certification Training Course
Prepare for the GIAC Certified Incident Handler (GCIH) exam by learning how attackers actually work, then how to detect, respond to and clean up after them.
Course focus: Incident handling with PICERL and DAIR, scanning and mapping, password attacks, SMB, Metasploit and netcat, web and API attacks, cloud credential security, post-exploitation, malware triage and LLM threats, aligned with GIAC's published GCIH objectives.
Course Overview
What the GCIH course covers and who it's for.
Accumentum's GCIH prep course is for incident handlers, SOC analysts, system administrators and anyone who gets the call when something goes wrong. GIAC says GCIH validates the ability to detect, respond to and resolve computer security incidents, and that holders understand common attack techniques and tools like Nmap, Metasploit and netcat.
The course follows GIAC's published GCIH objectives. We start with the PICERL and DAIR incident handling processes, then work through scanning, password attacks, SMB, endpoint attacks and pivoting, web application and API attacks, cloud credential attacks, post-exploitation, and LLM attacks. GCIH includes CyberLive hands-on questions, so you'll practice with the real tools in lab.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of GIAC. GIAC sets the exam rules, fees and scoring, so check giac.org before you register for your attempt.
Course Objectives
Get ready for GCIH the way the exam actually tests.
01
Cover Every GCIH Objective
Work through each certification objective GIAC publishes for GCIH, in an order that builds on itself.
02
Practice Hands-On
GCIH includes CyberLive questions that run in real virtual machines, so labs are part of every module.
03
Build an Open-Book Index
GIAC exams are open book. We help you build and test the index you'll bring into the exam.
04
Know the Exam Before You Sit It
GCIH is 106 questions in 4 hours with a minimum passing score of 69%, per GIAC. We pace practice to match.
Who Should Attend
- Incident handlers and incident response team leads.
- SOC analysts who triage alerts and escalate incidents.
- System administrators and security architects who act as first responders.
- CySA+, ECIH or CEH holders who want a deeper hands-on incident handling credential.
Prerequisites
- There are no Accumentum enrollment prerequisites and GIAC doesn't require any to sit GCIH.
- Plan on knowing networking basics, the Windows and Linux command line, and core security concepts before you start. GSEC, Security+ or CySA+ level knowledge helps.
Pathway Map
The GCIH course in 8 modules.
Each module maps to one or more of GIAC's published GCIH certification objectives.
Course Content
- Working through network and log data during an incident
- Basic malware analysis and using AI to speed up investigations
- How attackers discover hosts, services and vulnerabilities
- Spotting scans and defending against them
- Identifying password hashes and weak spots
- Running and defending against password attacks
- Securing credentials and data in the cloud
- SMB features, share discovery and hardening
- Endpoint attacks and pivoting through an environment
- Detecting Metasploit use
- Detecting netcat and other covert channels
- Injection attacks
- Insecure direct references
- Abusing web APIs
- Persistence and hiding techniques and how to find them
- How LLM prompts are processed and attacked, and how to defend against it
Course Features
Built for the hands-on side of GCIH.
On-Demand Format
Self-paced video lessons you can start, pause and replay whenever it fits your schedule.
Hands-On Labs
Lab work in every module so the CyberLive portion of GCIH isn't the first time you've touched the tools.
Objective Mapping
Every lesson is tied to a published GCIH certification objective.
Exam Strategy
Time management, open-book indexing and practice under exam conditions.
Certification Exam
About the GIAC GCIH exam.
GCIH Exam Readiness
Every objective GIAC publishes for GCIH has a lesson and a lab in our course, so you know exactly what you've covered before you book.
Per GIAC, the GCIH exam is one proctored exam with 106 questions, a 4 hours time limit and a minimum passing score of 69%. It's web based and proctored online through ProctorU or onsite at Pearson VUE.
GIAC can update exam specs, so confirm the details for your attempt in your GIAC account. Full details are on GIAC's GCIH page.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of GIAC. GIAC sets the exam rules, fees and scoring, so check giac.org before you register for your attempt.
Certification Objectives
Every GIAC GCIH objective GIAC publishes.
GIAC publishes 15 certification objectives for GCIH. Each one below uses GIAC's own wording, and our course maps a lesson or lab to every one of them.
Attacking Passwords
The candidate will demonstrate a detailed understanding of how to conduct password attacks.
Detecting Evasive and Post-Exploitation Techniques
The candidate will be able to identify and defend against an attacker already in an environment, discover methods used to establish persistence, hide their presence, and achieve actions on objectives.
Detecting Exploitation and Covert Communications Tools
The candidate will demonstrate an understanding of how to identify and defend against the use of exploitation tools such as Metasploit and covert communications tools such as netcat.
Endpoint Attack and Pivoting
The candidate will demonstrate an understanding of how to identify and defend against endpoint specific attacks and pivoting in an environment.
Exploiting Insecure Web Application References
The candidate will demonstrate an understanding of common methods for exploiting insecure web application references.
Incident Response and Cyber Investigation
The candidate will demonstrate an understanding of the PICERL and DAIR incident handling processes and incident response challenges.
Integrating LLMs with Offensive Operations
The candidate will demonstrate an understanding of LLM prompt processing, risks, common attack methods, and defend against AI specific attacks in modern environments.
Malware and AI Assisted Investigations
The candidate will demonstrate an understanding of the steps necessary to perform basic malware analysis and understand how AI can be used to augment investigative efforts.
Network and Log Investigations
The candidate will demonstrate an understanding of the steps necessary to perform effective investigations of network and log data.
Scanning and Mapping
The candidate will demonstrate an understanding of how to discover and map networks and hosts, reveal services and vulnerabilities, and identify and defend against scanning.
Securing Credentials and Data in the Cloud
The candidate will demonstrate an understanding of how to identify, defend against, and mitigate password attacks and insecure storage in cloud-based environments.
SMB Security
The candidate will demonstrate an understanding of SMB features, vulnerabilities, how to discover and access shares, and how to secure the service.
Understanding Passwords
The candidate will be able to identify password hashes, understand password weaknesses, and secure passwords.
Web Application API Attacks
The candidate will demonstrate the basics of interacting with and abusing access to web APIs.
Web Application Injection Attacks
The candidate will demonstrate an understanding of common web application injection attacks.
Study Plan
A practical path to GIAC GCIH.
GIAC lists the GCIH objectives alphabetically, not in study order. We teach them in an order that builds, starting with the fundamentals and working up to the topics that lean on them, and every block ends with labs before you move on.
Keep a running list of the objectives you can teach back without notes. When Attacking Passwords, Web Application Injection Attacks and everything in between are on that list, you are close.
If you are new to GCIH topics, plan on steady weekly study over a couple of months. If you already do this work every day, you may move faster. Either way, the objective list is the checklist we hold you to.
Areas and Audience
Where GIAC GCIH fits.
Areas GIAC says this certification covers
- Incident handling and computer crime investigation
- Computer and network hacker exploits
- Hacker tools (Nmap, Metasploit and Netcat)
Who GIAC says it is for
- Incident handlers
- Incident handling team leads
- System administrators
- Security practitioners
- Security architects
- Any security personnel who are first responders
Exam Format
How the GIAC GCIH exam works.
The GIAC GCIH exam is one proctored exam with 106 questions and a 4 hours time limit. GIAC sets the minimum passing score at 69%.
You can test online with ProctorU or in person at a Pearson VUE center, so you pick the setting that works for you.
GCIH includes CyberLive hands-on questions, which GIAC describes as performance based challenges in realistic lab environments. That is why our course leans so hard on labs.
Plan your weeks around the objectives above. When you can explain each one in your own words and do it in a lab, you are ready to book.
Career Outlook
Where GIAC GCIH can take you.
GCIH lines up with incident handler, SOC analyst and incident response lead roles. Teams look for it when they want someone who understands how attackers actually operate and can contain them without guessing.
For a sense of pay, BLS puts the May 2025 median annual wage for information security analysts at $129,180. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. That figure is a national midpoint. Where you live, how long you have been in the field and who you work for all move the number. Source: BLS Occupational Outlook Handbook.
Funding and PathPay
Ways to pay for GIAC GCIH training.
GIAC GCIH is Air Force COOL Approved. See how Air Force COOL works with us.
Paying on your own? GIAC GCIH prep is eligible for PathPay, our monthly payment plan. Terms of 3, 4 and 6 months carry no added fee. 9, 12 and 18 month terms add 5%, 10% and 15%. Course access opens when your first payment clears.
Our funding page covers every other way to pay, and you can always talk with us before you enroll.
Frequently Asked Questions
Common questions about Accumentum's GCIH prep course.
GIAC Certified Incident Handler (GCIH) is a practitioner certification from GIAC. Per GIAC, the exam is 106 questions, 4 hours, with a minimum passing score of 69%, and it's proctored online through ProctorU or at a Pearson VUE center.
Ask us when you request a quote. GIAC sells certification attempts and practice tests directly, and we'll walk you through what you need to buy from GIAC and when.
GIAC GCIH is Air Force COOL Approved. Contact us about funding options.
There are no Accumentum enrollment prerequisites and GIAC doesn't require any to sit GCIH. Plan on knowing networking basics, the Windows and Linux command line, and core security concepts before you start. GSEC, Security+ or CySA+ level knowledge helps.
Yes. GCIH includes CyberLive hands-on questions, so every module has labs with the same kinds of tools you'll use on the job.
On-demand and self-paced. You get video lessons, hands-on labs and practice questions, and you work through them on your own schedule.
Use the registration page linked below, or email info@accumentum.net and an advisor will follow up with access details and next steps.
GIAC sets the minimum passing score for GCIH at 69%.
The exam has 106 questions and a 4 hours time limit.
GIAC publishes 15 certification objectives for GCIH, and our course covers all of them.
GIAC names these audiences for GCIH:
- Incident handlers
- Incident handling team leads
- System administrators
- Security practitioners
- Security architects
- Any security personnel who are first responders
Yes. GIAC offers remote proctoring through ProctorU, and you can also test in person at a Pearson VUE center.
Yes. GIAC sells official practice tests. GIAC notes the practice question bank is limited, so the same question can show up on more than one test.
Yes. GIAC GCIH prep is eligible for PathPay. Terms of 3, 4 and 6 months add no fee. 9, 12 and 18 month terms add 5%, 10% and 15%.
Enrollment
Enroll in GCIH training with Accumentum.
Enroll in Accumentum's GCIH prep course to get ready for the GIAC Certified Incident Handler (GCIH) exam with on-demand lessons and hands-on labs.
For access details and next steps, use the registration page linked below or email info@accumentum.net.
Ready to start on GCIH?
Start on your own schedule and work toward the test date you pick.