- What GPEN Actually Costs in 2026
- The $999 Attempt Fee: What's Included
- Retake Costs and When You'll Need One
- Beyond the Exam Fee: Training and Prep Costs
- Renewal Costs: The Four-Year Cycle
- Cost Comparison at a Glance
- Where the Money Goes: The 16 Domains Behind the Price Tag
- Budgeting Your Study Timeline Around the Fee
- Is the GPEN Investment Worth It?
- Frequently Asked Questions
- A single GPEN attempt costs $999; a retake costs $899 if you don't pass.
- You have 120 days from activation to sit the 82-question, three-hour CyberLive exam.
- Passing requires 73% on versions released on or after July 12, 2025.
- Renewal every four years costs $499 plus 36 CPE credits - budget for it early.
What GPEN Actually Costs in 2026
If you're researching the GIAC Penetration Tester (GPEN) credential, the sticker price is usually the first question and the last thing you actually understand. GIAC doesn't run GPEN like a typical vendor-neutral exam with a flat $300-$400 fee. It's a premium, proctored assessment with a single attempt priced at $999, and that number sits at the center of a much larger cost equation that includes retakes, renewal, and how you choose to prepare.
This breakdown walks through every dollar tied to earning and keeping the GPEN, and connects the pricing to what the exam actually tests - because the cost only makes sense once you understand what you're paying for. For a deeper look at exam mechanics and eligibility before you commit funds, see our GPEN requirements guide.
The $999 Attempt Fee: What's Included
The $999 fee covers one attempt at the GPEN exam, delivered as a single web-based, proctored CyberLive assessment. You can take it remotely through ProctorU or in person at a Pearson VUE test center - GIAC doesn't charge differently based on delivery method, so your choice comes down to convenience and comfort with remote proctoring rather than cost.
What that fee actually buys you:
- 82 scored questions delivered over a three-hour window
- CyberLive performance-based challenges - live virtual machines with real tools and real code, not just multiple-choice theory
- 120 days from activation to schedule and complete your attempt, giving you flexibility to prepare on your own timeline
- Access to bring printed books, notes, and indexes into the exam room (open-book, but only for physical materials - no laptops, tablets, or internet lookups)
That CyberLive component is the reason GPEN costs more than many entry-level security certifications. You're not just answering questions about password attacks in the abstract - you're interacting with simulated environments where you actually execute commands and interpret output. GIAC is charging for infrastructure, not just a question bank. Our GPEN exam domains guide breaks down exactly which of the 16 domains show up in these hands-on scenarios.
Why the Exam Costs More Than a Standard Multiple-Choice Test
CyberLive challenges require GIAC to maintain live virtual lab environments for every proctored session, not just a static question database. That infrastructure cost is baked into the $999 fee.
- Real tools like Metasploit and password-cracking utilities run inside the test environment
- Scenarios mirror actual penetration testing workflows, not textbook recall
- Environments must be provisioned and reset for every candidate, every session
Retake Costs and When You'll Need One
If you don't clear the 73% passing threshold on your first try, a retake costs $899 - $100 less than the initial attempt, but still a substantial second expense. Unlike some certifications that offer a free retake voucher, GIAC treats every attempt as a discrete transaction.
This is where preparation quality matters more than most candidates initially assume. Spending an extra few weeks on Kerberos Attacks, Domain Escalation and Persistence Attacks, or Azure Applications and Attack Strategies before your first attempt is far cheaper than paying $899 to retake after discovering gaps in those domains under exam pressure. Our GPEN difficulty guide covers which domains tend to catch candidates off guard, and our GPEN pass rate analysis looks at what the available data actually shows about first-attempt outcomes.
Key Takeaway
Treat your first attempt as your only attempt. A $899 retake fee often costs more than the extra practice exams or study time that would have closed your knowledge gaps in the first place.
Beyond the Exam Fee: Training and Prep Costs
The $999 exam fee is only part of the total investment. Most candidates layer additional spending on top of it, and how much you spend here depends heavily on your starting skill level with tools like Metasploit, password-cracking utilities, and Active Directory attack techniques.
- Formal training courses - many candidates pursue vendor-aligned coursework before attempting GPEN, which can add a significant expense well beyond the exam fee itself. Our GPEN training overview compares different preparation paths.
- Printed reference materials - since electronic materials and internet access are prohibited during the exam, candidates typically invest in printed notes, indexes, or study guides they can physically bring into the test room.
- Practice exams - realistic practice questions modeled on the CyberLive format help candidates gauge readiness without risking the $999 fee on a guess. You can work through scenario-style questions covering all 16 domains at GPEN Exam Prep before you schedule the real thing.
- Lab environments - because the exam includes hands-on CyberLive challenges, many candidates build or rent virtual lab environments to practice password attacks, scanning, and exploitation techniques against live targets.
None of these are mandatory, but skipping them entirely raises your odds of needing that $899 retake. Our GPEN study guide lays out a preparation path that balances cost against readiness.
Renewal Costs: The Four-Year Cycle
Passing GPEN isn't the end of the cost conversation. The certification is valid for four years, after which you must renew it to keep the credential active. Renewal has two components:
- 36 CPE credits earned over the four-year cycle through continuing education activities, conferences, training, or other GIAC-approved methods
- A $499 renewal fee paid to GIAC to process the renewal
Budgeting for renewal early matters because CPE credits accumulate over time - you can't cram 36 credits in the final month before expiration the way you might cram exam material in the final week. Treat the $499 renewal fee as a recurring line item every four years, not a one-time cost you forget about after passing.
Cost Comparison at a Glance
| Cost Item | Amount | When It Applies |
|---|---|---|
| Initial exam attempt | $999 | First sitting, includes 120-day window to test |
| Retake attempt | $899 | Only if you don't reach 73% on the first try |
| Certification validity | 4 years | From date of passing |
| Renewal fee | $499 | Due at end of each 4-year cycle |
| CPE requirement | 36 credits | Accumulated across the 4-year cycle |
Where the Money Goes: The 16 Domains Behind the Price Tag
Understanding the exam's content structure helps explain why the fee is what it is - and helps you avoid wasting money on a retake. GPEN's 82 questions are drawn from 16 domains that span reconnaissance through post-exploitation persistence, and several of them require the kind of hands-on CyberLive interaction that drives up the exam's cost and complexity.
Password Attacks, Attacking Password Hashes, and Password Formats and Hashes
Three separate domains focus on password-based attack vectors, reflecting how central credential attacks are to real-world penetration testing engagements.
- Understand hash formats and how they're generated across different systems
- Practice cracking techniques you'll be expected to execute against live targets in CyberLive scenarios
- Know when password spraying, brute force, or hash relay techniques are appropriate
Kerberos Attacks, Domain Escalation and Persistence Attacks
These domains test Active Directory-specific attack chains, a skill set heavily demanded by employers hiring penetration testers for enterprise environments.
- Understand ticket-based attacks and common Kerberos abuse techniques
- Know how attackers escalate privileges and maintain persistence inside a domain
Azure Overview, Attacks, and AD Integration; Azure Applications and Attack Strategies
Two dedicated domains on Azure reflect the shift toward cloud-integrated penetration testing, an area many older certifications don't cover in depth.
- Understand how on-premises AD integrates with Azure AD and where attack surface expands
- Know attack strategies specific to Azure-hosted applications
The remaining domains - Advanced Password Attacks, Command and Control (C2), Escalation and Exploitation, Exploitation Fundamentals, Metasploit, Penetration Test Planning, Reconnaissance, Scanning and Host Discovery, and Vulnerability Scanning - round out a curriculum that mirrors an actual penetration testing engagement lifecycle, from planning through exploitation to reporting. A full walkthrough of all 16 areas is available in our complete GPEN exam domains guide.
Budgeting Your Study Timeline Around the Fee
Because every retake costs $899, it's worth structuring your preparation so you sit the exam once, confidently, rather than treating the first attempt as a diagnostic run. A short, domain-weighted study schedule helps you avoid that scenario.
Foundations and Reconnaissance
- Cover Penetration Test Planning, Reconnaissance, and Scanning and Host Discovery
- Set up a home lab so CyberLive-style tool usage feels familiar, not new, on exam day
Exploitation Core
- Work through Exploitation Fundamentals, Escalation and Exploitation, and Metasploit
- Practice against live targets rather than only reading tool documentation
Credential Attacks
- Focus heavily on Password Attacks, Attacking Password Hashes, and Password Formats and Hashes since three domains overlap here
- Drill hash-cracking workflows until they're automatic under time pressure
Active Directory and Cloud
- Master Kerberos Attacks and Domain Escalation and Persistence Attacks
- Cover both Azure domains, since cloud attack paths are often underprepared for
Command and Control, Final Review
- Cover Command and Control (C2) concepts and tooling
- Run full-length timed practice exams to simulate the 82-question, three-hour format
This kind of scheduling isn't generic time management for its own sake - it's mapped directly to where GPEN concentrates its questions, so you spend the most hours where the exam spends the most points. For a more detailed week-by-week plan, see our GPEN study guide, and check GPEN exam dates and scheduling windows before locking in your 120-day activation period.
Is the GPEN Investment Worth It?
At $999 for the exam plus $499 every four years for renewal, GPEN sits toward the premium end of security certifications. Whether that's worth it depends on your role and career trajectory. GPEN is specifically valuable for candidates targeting hands-on offensive security roles - penetration testers, red team operators, and security consultants at firms that run client-facing engagements involving Active Directory, Azure environments, and network exploitation.
Employers hiring for these roles often list GIAC certifications explicitly because the exam's CyberLive component demonstrates practical skill, not just memorized theory. If you're weighing GPEN against other credentials or trying to determine whether the cost translates into better job prospects, our GPEN ROI analysis and GPEN salary guide dig into that question in more depth. You can also browse current GPEN jobs to see how the credential is referenced in real postings.
Before committing the $999, it's worth running through practice questions that mirror the exam's structure and passing threshold. You can test your readiness across all 16 domains at GPEN Exam Prep to get a realistic sense of where you stand before paying for an attempt.
Frequently Asked Questions
A single attempt costs $999. If you need a retake, it costs $899. Renewal every four years costs an additional $499, plus you must earn 36 CPE credits during that cycle.
No. The fee covers the proctored exam attempt only - 82 questions delivered over three hours with CyberLive performance-based challenges. Training courses, printed reference materials, and practice exams are separate costs.
The retake fee is $899, which is $100 less than the initial $999 attempt fee, but there is no free retake voucher included with the original purchase.
You have 120 days from activation to complete your attempt, whether you test remotely through ProctorU or onsite through Pearson VUE.
GPEN is valid for four years. If you don't complete 36 CPE credits and pay the $499 renewal fee by the end of that cycle, your certification lapses and you would need to retest to regain it.