The GREM certification is GIAC's reverse engineering and malware analysis credential, and it is one of the few security exams where you are expected to pull apart a real sample under time pressure rather than pick the best answer from four options. A single certification attempt costs $999. You get 66 questions and three hours, and you need 73% to pass.
That 73% is higher than most GIAC exams sit at, and the CyberLive component is why candidates who prepared like it was a multiple-choice paper come out short. This guide covers what GREM actually costs, what the exam format looks like, all 15 published objectives, and an 8-week plan that assumes you have a day job.
What the GREM Certification Costs in 2026
The certification attempt and the training are priced separately, and the gap between them is large. A lot of candidates only budget for one.
| Item | Price (USD) | Source |
|---|---|---|
| GIAC certification attempt | $999 | giac.org/pricing |
| Exam retake | $899 | giac.org/pricing |
| Attempt extension | $479 | giac.org/pricing |
| GIAC practice exam | $399 each | giac.org/pricing |
| Certification renewal (every 4 years) | $499 | giac.org/pricing |
| SANS FOR610 course | $8,780 | sans.org |
FOR610: Reverse-Engineering Malware is the associated SANS course. It runs six days instructor-led or 36 hours self-paced across four months, includes 48 hands-on labs, and awards 36 CPEs.
You are not required to take FOR610 to sit GREM. Self-study candidates buy the $999 attempt on its own. The trade-off is that GIAC exams are open book, and the official courseware is what most successful candidates index against.
Exam Tip: Your attempt expires 120 days from the date of activation. Do not activate it until your index is built and you have sat at least one practice exam. The $479 extension fee is an expensive way to buy back time you gave away.
The GREM Exam Format: 66 Questions, Three Hours, 73%
GREM is a single proctored exam. GIAC publishes the format precisely:
- 66 questions
- 3 hours
- 73% minimum passing score
- CyberLive hands-on items run inside live virtual machines with real tools
- Delivered web-based, proctored remotely through ProctorU or onsite at PearsonVUE
CyberLive is the part that changes how you prepare. Instead of describing what a packer does, you are dropped into a VM with real security tools and authentic code and asked to produce an answer. Reading about unpacking will not get you through it.
Work the maths on the clock. Three hours across 66 questions is roughly two minutes and forty seconds each, and the CyberLive items eat far more than their share. Multiple-choice questions you can answer from memory need to take thirty seconds so the hands-on items have room.
Open Book, With Rules
GIAC exams are open book, but the policy is narrower than people assume:
- Printed books, notes and your own index are allowed
- No electronic devices of any kind
- Printed material that looks like practice questions and answers is prohibited
Practically, that means a stack of hardcopy course books plus one index you wrote yourself.
The 15 GREM Exam Objectives
GIAC publishes the objectives openly. Every one of them is fair game:
- Analyzing Malicious Office Macros
- Analyzing Malicious PDFs
- Analyzing Malicious RTF Files
- Analyzing Obfuscated Malware
- Behavioral Analysis Fundamentals
- Common Malware Patterns
- Core Reverse Engineering Concepts
- Examining .NET Malware
- Identifying and Bypassing Anti-Analysis Techniques
- Malware Analysis Fundamentals
- Malware Flow Control and Structures
- Overcoming Misdirection Techniques
- Reversing Functions in Assembly
- Static Analysis Fundamentals
- Unpacking and Debugging Packed Malware
Three of those (assembly functions, flow control and structures, and anti-analysis) carry the most hands-on weight, because they are the hardest to fake from a printed page. Budget your lab time accordingly.
Building the Index That Gets You Through CyberLive
The index is the single highest-return thing you build, and it is the thing most self-study candidates leave until the last fortnight.
An index that works for GREM looks like this:
- One row per concept, tool or API call, with book number and page
- Sorted alphabetically, not by book order, because you will be searching under pressure
- Tool syntax written out in full, not referenced. If you have to flip to a page to remember the flags for a debugger command, the index has failed
- A separate one-page cheat sheet for the things you will need repeatedly: common x86 instructions, PE header offsets, and the switches for your unpacking workflow
Build it as you study, section by section. An index assembled in a panic at the end is a table of contents with extra steps, and it will not survive a CyberLive question.
The same approach works across the GIAC family. If you have already sat one, the method carries over from our GCFA study plan and GCIH study plan.
An 8-Week GREM Study Plan
This assumes roughly 10 to 12 hours a week and prior comfort with a debugger. If assembly is new to you, add a fortnight at the front.
| Week | Focus | Deliverable |
|---|---|---|
| 1 | Malware analysis fundamentals, lab build (isolated VM, snapshots, network simulation) | Working analysis lab you can revert in seconds |
| 2 | Static analysis fundamentals, common malware patterns | Index rows for every static tool and its flags |
| 3 | Behavioural analysis, core reverse engineering concepts | Full behavioural run on three real samples |
| 4 | Reversing functions in assembly, flow control and structures | Hand-annotated disassembly of two small samples |
| 5 | Unpacking and debugging packed malware | Unpack three packed samples without notes |
| 6 | Obfuscated malware, anti-analysis and misdirection techniques | Index rows for each anti-analysis check and its bypass |
| 7 | Office macros, PDFs, RTF files, .NET malware | Extracted payload from one of each document type |
| 8 | Practice exam, index repair, timed drills | Second practice exam above 80% |
Why the Practice Exams Are Worth the $399
GIAC practice exams cost $399 each and mirror the real question style, including CyberLive items. Sitting one in week eight does two jobs: it gives you a score to calibrate against 73%, and it exposes every gap in the index while you still have a week to fix it.
If you can only afford one, sit it in week eight rather than week four. An index tested early is an index tested before it exists.
Exam Tip: Score below 73% on the practice exam and the fix is almost never more reading. It is nearly always index navigation speed. Time how long it takes you to find five random facts. If any takes over 45 seconds, restructure before you revise.
Is GREM Worth It, and Who Should Skip It
GREM is worth it if you are already doing malware analysis, incident response with a reversing component, or threat research, and you need the credential recognised on a job spec or a government work role.
It is a poor first certification. The exam assumes you can read assembly, drive a debugger and build a safe lab before you start. Someone moving into security from IT support gets far more from the SOC analyst certification path first.
The renewal maths matters too. GIAC certifications are valid for four years, and renewal takes 36 CPEs plus the $499 maintenance fee. Over an eight-year career that is the attempt plus two renewals before any training cost.
Frequently Asked Questions
How much is a GREM cert?
The GIAC certification attempt costs $999. A retake is $899, a practice exam is $399, and renewal every four years is $499. The associated SANS FOR610 course is priced separately at $8,780 and is not required to sit the exam.
How do you prepare for the GREM certification exam?
Build an isolated analysis lab first, then work through the 15 published objectives while writing an alphabetically sorted index as you go. Spend the majority of your hands-on time on assembly, flow control and anti-analysis bypasses, because those carry the CyberLive weight. Sit a GIAC practice exam roughly a week out and use the result to fix your index rather than to add reading.
What is the best certification for malware analysis?
GREM is the most widely recognised dedicated malware analysis certification, largely because CyberLive requires you to work on live samples rather than answer questions about them. It is aimed at practitioners who already reverse engineer code. There is no strong entry-level equivalent, which is why most people arrive at GREM after a broader forensics or incident response credential.
Is GREM harder than GCFA?
They are difficult in different ways. GCFA is broader and rewards a well-built index across forensic artefacts. GREM is narrower and rewards genuine reversing ability, so the index helps less on the hands-on items. Candidates who have not written assembly before consistently find GREM the harder sit.
Does GREM expire?
Yes. GIAC certifications are valid for four years. Renewal requires 36 CPE credits and a $499 maintenance fee, and you can register to renew from two years before expiry.
Ready to Start Practising?
Reading about a packer and unpacking one are different skills, and GREM tests the second. The same is true of every exam with a hands-on component: the candidates who pass are the ones who spent their revision doing rather than reading.
CertCrush builds practice questions and mock exams for the certifications that get people hired, with explanations that tell you why the wrong answers are wrong. Create a free account and start practising, or browse the full course catalogue to see what is covered.