- What the GIAC Machine Learning Engineer Credential Is
- Exam Mechanics: Format, Timing, and Open-Book Rules
- The Ten Published Exam Objectives
- How SEC595 Maps to Preparation
- Registration, Fees, and the 120-Day Window
- Scheduling Your Prep by Domain
- Validity and Renewal
- Who Should Pursue It
- Frequently Asked Questions
- The exam has 82 questions in 3 hours, mixing multiple-choice items with hands-on CyberLive tasks; passing requires 65%.
- GIAC publishes 10 objective headings for GMLE, from Anomaly Detection and Optimization to Supervised Learning, without percentage weights.
- The attempt costs USD $999, retakes cost $899, and you have 120 days from activation to finish.
- The exam is open book with hardcopy materials only; internet access and personal electronic references are prohibited.
What the GIAC Machine Learning Engineer Credential Is
GMLE stands for GIAC Machine Learning Engineer, a certification issued by GIAC Certifications and administered by GIAC, LLC. It sits in a cybersecurity-focused portfolio, so the emphasis is on applying data science and machine learning to security problems rather than on general-purpose AI research. If you are still orienting yourself, our explainers on what GMLE certification is and what GMLE stands for cover the basics, and this article goes deeper into the exam itself.
One note on naming: the acronym is used by other, unrelated credentials. Everything on this page refers only to the GIAC credential. If you are comparing sources, check that the certifying body is GIAC before trusting any fee, date, or format detail you find.
Exam Mechanics: Format, Timing, and Open-Book Rules
GMLE is one proctored, web-based exam with 82 total questions and a 3-hour time limit. The questions include multiple-choice items and performance-based CyberLive tasks. According to GIAC's CyberLive demo write-up, the multiple-choice items come first and the hands-on CyberLive portion follows. The 3-hour limit covers the entire exam, CyberLive included, so you cannot treat the practical section as extra time.
What the interface gives you
- An on-screen calculator and a scratch notepad inside the exam engine.
- Up to 15 minutes of total break time.
- No ability to change an answer once it is submitted, so commit deliberately.
The open-book policy, precisely
GMLE is open book, but only for hardcopy books, notes, and an index. Internet access and personal electronic references are prohibited. Materials resembling practice or exam questions and answers are also prohibited, so be careful about what you bring into the room or camera frame. The proctoring format is Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility.
The index is the skill that separates organized candidates from stressed ones. A good index for this exam maps terms like regularization, convolution, and clustering metrics to specific page numbers, so a lookup costs seconds rather than minutes. Our GMLE cheat sheet lists the facts worth knowing cold so you do not spend your index budget on them.
Key Takeaway
With 82 questions in 180 minutes, you have roughly two minutes per item on average, but CyberLive tasks will not be evenly paced. Practice working hands-on problems in Python under a timer so the practical section does not drain time you need for the early multiple-choice items.
The Ten Published Exam Objectives
GIAC lists ten exam-objective headings for GMLE. GIAC does not publish percentage weights for them in this objective list, so no domain should be assumed to be larger or smaller than another. For a longer treatment of each area, see our complete guide to all 10 GMLE content areas. Here is how the headings group in practice.
Foundations: Statistics Fundamentals, Probability and Frequency
These two headings underpin everything else. Expect to reason about distributions, likelihood, and how frequency-based thinking applies to security data such as event counts.
- Descriptive statistics and what they reveal about a dataset
- Probability concepts used to quantify how unusual an observation is
- Frequency reasoning as a bridge to detection logic
Tooling and Data: Leveraging Python, Data Acquisition
The CyberLive tasks make Python fluency a practical necessity, not a nice-to-have. Data Acquisition covers getting data into a usable state before any modeling happens.
- Working with data structures and libraries in Python
- Collecting and preparing data from security-relevant sources
- Recognizing how data quality limits model quality
Modeling Core: Regressions, Supervised Learning
These headings cover predicting outcomes from labeled data. Knowing when a regression approach fits and how to evaluate a supervised model is central.
- Regression concepts and interpreting their outputs
- Training and evaluating supervised models
- Understanding overfitting and how to detect it
Unlabeled and Unusual Data: Clustering, Anomaly Detection and Optimization
Security data is frequently unlabeled, which is why these headings matter for the credential. Anomaly detection is the natural home for finding the rare event among the routine.
- Grouping similar observations without labels
- Identifying outliers and what makes a point anomalous
- Optimization ideas that drive how models learn
Deep Learning: Neural Networks, Convolutional Neural Networks
The last pair covers neural architectures. Convolutional networks get their own heading, so do not assume general neural network knowledge is sufficient.
- How layers, activations, and training fit together
- What convolution adds for structured inputs
- Practical limits and failure modes of deep models
Because the headings are unweighted, a sensible strategy is breadth first. Make sure you can answer basic questions in all ten areas before you specialize, then use practice results from our GMLE practice tests to find where you are thinnest.
How SEC595 Maps to Preparation
GIAC's preparation pointer for this credential is the SANS course SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals. The course has six preparation sections. Training is optional and recommended, not required, and the course sections are an unweighted curriculum: they do not establish exhaustive exam coverage or define the ten exam domains.
There is one discrepancy worth knowing. The live SEC595 page says intermediate Python is required, while the linked brochure describes a fundamental understanding of Python. Those statements concern course readiness only and are separate from GIAC certification eligibility. In practice, lean toward the stricter reading: since CyberLive tasks are hands-on, comfortable Python is the safer baseline. Similarly, the live page gives descriptive titles to Sections 3 through 6, while the brochure labels them "Essentials of Machine Learning" Parts I through IV, so do not be surprised if two sources name the same material differently.
| Item | What it is | Role in your plan |
|---|---|---|
| GMLE exam objectives | 10 headings published by GIAC | Defines what can be tested |
| SEC595 course | Six preparation sections from SANS | Optional, recommended training |
| Practice exam (official) | USD $399 from GIAC | Gauges readiness against the real format |
| Your hardcopy index | Personal reference you build | Speeds lookups on an open-book exam |
For a structured approach that blends these resources, read our GMLE study guide and the page on GMLE training options.
Registration, Fees, and the 120-Day Window
There are no formal certification prerequisites for GMLE, which our GMLE requirements article explores in more detail. Cost is a different matter, so budget carefully.
| Item | Amount (USD) |
|---|---|
| Certification attempt | $999 |
| Retake | $899 |
| Official practice exam | $399 |
| Renewal fee | $499 |
These prices exclude applicable sales tax, and SANS training tuition is separate. Once your attempt is activated, you have 120 days to complete it. That window is a real constraint: do not activate until your index is built and your practice scores are stable. The full financial picture, including how the numbers compare to alternatives, is in our GMLE certification cost breakdown, and scheduling specifics are in the GMLE exam dates guide.
Scheduling Your Prep by Domain
Because the ten domains build on each other, order matters more than total hours. Statistics and probability come first because later topics assume them. Python comes early because every hands-on task depends on it. Here is one sequencing that respects those dependencies.
Foundations
- Statistics Fundamentals and Probability and Frequency
- Start Python drills in parallel
- Begin your hardcopy index with core definitions
Data and Core Models
- Data Acquisition and Leveraging Python
- Regressions and Supervised Learning
- Practice evaluating models, not just building them
Unlabeled Data and Deep Learning
- Clustering and Anomaly Detection and Optimization
- Neural Networks, then Convolutional Neural Networks
- Finalize the index and take timed practice runs
Adjust the length to your background. A working data scientist may compress the first two blocks, while a security analyst new to modeling may stretch them. Difficulty varies by background, as discussed in how hard the GMLE exam is.
Validity and Renewal
The certification is valid for four years. To renew, you can earn 36 approved CPE credits during the active four-year period or take a renewal exam, and either route carries the standard $499 renewal fee. Planning for CPE from the start is easier than scrambling in year four, since conference attendance, courses, and other approved activities can accumulate gradually.
Who Should Pursue It
GMLE fits professionals who sit between security operations and data work: detection engineers building analytics, analysts moving toward model-driven detection, and data practitioners entering security teams. The credential signals that you can apply machine learning to security data, which matters most where teams are adopting analytics for detection and triage. Browse typical roles on our GMLE jobs page, weigh the earnings picture in the GMLE salary guide, and decide whether it justifies the spend with the ROI analysis.
When you are ready to test yourself against the real format, start a GMLE practice test and treat your first score as a map of which domains need attention rather than a verdict.
Frequently Asked Questions
The exam has 82 questions and a 3-hour time limit. Questions include multiple-choice items and hands-on CyberLive tasks, and the time limit covers the whole exam including CyberLive.
The minimum passing score is 65%. GIAC notes this standard applies to exam versions released on or after September 18, 2023, and your assigned attempt's page takes precedence. See our GMLE passing score article for more.
Yes. The exam is open book with hardcopy books, notes, and an index. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.
No. There are no formal certification prerequisites, and training is optional but recommended. SEC595 is GIAC's linked preparation course, with its own Python readiness expectations separate from certification eligibility.
Four years. Renew with 36 approved CPE credits earned during that period or a renewal exam, plus the $499 renewal fee.