- GMLE in One Paragraph: What the Credential Actually Is
- Who Issues It and How the Attempt Works
- Inside the Exam: 82 Questions, 3 Hours, CyberLive
- The Ten Published Exam Domains
- Where SANS SEC595 Fits
- Fees, Validity, and Renewal Mechanics
- Who Should Pursue GMLE
- Sequencing Your Preparation by Domain
- Frequently Asked Questions
- GMLE is GIAC's Machine Learning Engineer credential, focused on applying data science and ML to cybersecurity problems.
- The exam has 82 questions in 3 hours, mixing multiple-choice items with hands-on CyberLive tasks; 65% is passing.
- GIAC publishes 10 unweighted exam domains, from Anomaly Detection and Optimization to Supervised Learning.
- The certification attempt costs USD $999 and the credential stays valid for four years.
GMLE in One Paragraph: What the Credential Actually Is
GMLE stands for GIAC Machine Learning Engineer. It is a cybersecurity-focused certification that validates a practitioner's ability to apply data science and machine learning techniques to security problems: detecting anomalies in telemetry, clustering behavior, building classifiers, working with neural networks, and handling the data and Python skills that hold those pieces together. It is not a general-purpose ML credential, and it is not a cloud vendor's machine learning badge. The emphasis is on practical, security-oriented application.
If you have landed here because you saw the acronym and were unsure which credential it refers to, this site covers only the GIAC credential. For other angles on the same question, see our short explainers on what GMLE stands for and GMLE meaning, or the broader GMLE certification overview.
Who Issues It and How the Attempt Works
The certification is issued by GIAC Certifications (formerly Global Information Assurance Certification), administered by GIAC, LLC. Exams are delivered through Pearson VUE, either onsite at a testing center or remotely via ProctorU, subject to the eligibility attached to your specific attempt. GIAC states that the objectives, format, and passing score on your assigned attempt page take precedence over any third-party summary, including this one, so always confirm details there before test day.
Eligibility and Timing
There are no formal certification prerequisites. SANS training is optional and recommended, not required. Once your attempt is activated, you have a 120-day completion window to sit the exam. That window is short enough that you should plan your preparation before activating, not after. Our guide to GMLE requirements covers eligibility in more depth, and GMLE exam dates explains scheduling and deadlines.
Inside the Exam: 82 Questions, 3 Hours, CyberLive
The GMLE is a single proctored, web-based exam with 82 total questions and a 3-hour time limit. The questions include multiple-choice items and performance-based CyberLive tasks, where you work in a live technical environment rather than selecting from answer options. The time limit covers the complete exam, CyberLive included, so a hands-on task that runs long comes out of the same clock as everything else. The minimum passing score is 65%.
| Exam Attribute | GMLE Detail |
|---|---|
| Total questions | 82 |
| Time limit | 3 hours, including CyberLive |
| Question types | Multiple-choice plus CyberLive performance-based tasks |
| Passing score | 65% |
| Delivery | Pearson VUE onsite or ProctorU remote |
| Reference policy | Open book (hardcopy books, notes, index) |
| Breaks | 15 minutes of break time allowed |
| Answer changes | Submitted answers cannot be changed |
Open Book Does Not Mean Easy
The exam is open book, but only for hardcopy books, notes, and an index. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited. The exam engine supplies an on-screen calculator and a scratch notepad. Because submitted answers cannot be changed, you cannot loop back and revise, so commit deliberately and move on.
For machine learning topics specifically, the open-book format rewards a different skill than memorization. You are unlikely to need to recite a formula from memory, but you do need to know where the relevant explanation lives and how to apply it quickly. Our GMLE difficulty guide unpacks what makes the exam demanding, and the passing score breakdown explains how the 65% threshold plays out in practice.
Key Takeaway
Treat CyberLive as a separate skill, not a bonus. Reading about a technique and executing it in a live environment under a shared 3-hour clock are different abilities, and you should rehearse both.
The Ten Published Exam Domains
GIAC publishes ten exam-objective headings for GMLE. GIAC does not publish percentage weights for them, so no domain should be assumed to carry more points than another. Here they are in GIAC's published order, with what each tends to demand of a security-minded practitioner. For a fuller treatment, read the complete guide to all 10 GMLE content areas.
Domain 1: Anomaly Detection and Optimization
Finding the unusual in security data, and tuning models and parameters so detection is both sensitive and usable.
- Distinguishing outliers from normal variation in log and network-style data
- Understanding how optimization shapes a model's behavior
Domain 2: Clustering
Grouping unlabeled observations, a common approach when you lack labeled attack data.
- When unsupervised grouping is appropriate
- Interpreting cluster results rather than just producing them
Domain 3: Convolutional Neural Networks
Architectures built for grid-like data, relevant wherever a security problem can be framed as image-like or spatial input.
- How convolution and pooling extract features
- Where CNNs are and are not a sensible choice
Domain 4: Data Acquisition
Getting usable data in the first place. In security work, collection and preparation frequently decide whether a model is worth building.
- Sourcing, structuring, and preparing data for modeling
Domain 5: Leveraging Python
The working language of the field. Python fluency underpins the hands-on portion of the exam.
- Manipulating data and applying ML libraries in code
- Reading and adapting code under time pressure
Domain 6: Neural Networks
The foundations of feed-forward networks and how they learn.
- Layers, activations, and training behavior
Domain 7: Probability and Frequency
The mathematical grounding behind many detection and classification approaches.
- Reasoning about likelihood and event frequency
Domain 8: Regressions
Modeling relationships between variables and predicting continuous values.
- Fitting, interpreting, and evaluating regression models
Domain 9: Statistics Fundamentals
The descriptive and inferential basics that make every other domain interpretable.
- Summarizing data and understanding what results actually imply
Domain 10: Supervised Learning
Training models on labeled examples, central to classification tasks such as malware or phishing detection.
- Choosing, training, and evaluating supervised models
Notice how the list blends mathematics (probability, statistics, regressions), modeling families (clustering, supervised learning, neural networks, CNNs), and practical enablers (data acquisition, Python). A candidate who is strong in one cluster and weak in another will feel it, especially on hands-on tasks where concepts must be implemented, not merely recognized.
Where SANS SEC595 Fits
The official preparation course associated with GMLE is SANS SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals. It is organized into six preparation sections. Per the course materials, Section 1 onward builds up from foundations, and the later sections are labeled "Essentials of Machine Learning" Parts I through IV in the brochure, while the live course page uses descriptive titles for Sections 3 through 6.
A Note on Python Readiness
The live SEC595 page asks for intermediate Python, while the linked brochure describes a fundamental understanding. That discrepancy concerns course readiness only, separate from GIAC certification eligibility, which has no formal prerequisites. In practice, if you are shaky on Python, plan extra time for Domain 5 before you lean on any other material. More on training options is in our GMLE training overview.
Fees, Validity, and Renewal Mechanics
The published prices (excluding applicable sales tax) are:
| Item | Price (USD) |
|---|---|
| Certification attempt | $999 |
| Retake | $899 |
| Official practice exam | $399 |
| Renewal fee | $499 |
SANS training tuition is separate and is not included in the attempt fee. For a full picture of budgeting, see the GMLE certification cost breakdown.
Four Years, Then Renew
The certification is valid for four years. To renew, you earn 36 approved CPE credits during the active four-year period or pass a renewal exam, in either case paying the standard $499 renewal fee. Since renewal can be satisfied through continuing education, a practitioner who stays active in the field has a natural path to keep the credential current.
Who Should Pursue GMLE
GMLE is aimed at security professionals who want to apply machine learning, and at data-oriented practitioners moving into security. Plausible fits include security analysts building detection logic, threat hunters who want to cluster and score behavior, detection engineers, and engineers on teams that operationalize models against security telemetry. It is less natural for someone who wants a general ML engineering credential unconnected to security.
Whether it is worth the investment depends on your role and goals. We examine the economics in the salary analysis, the career side in GMLE jobs, and the decision framework in is GMLE worth it. If you are curious about outcomes data, the pass rate article explains what is and is not publicly known.
Sequencing Your Preparation by Domain
This is the one place where a structured plan earns its keep, because the ten domains build on each other. A sensible order moves from foundations to applications to hands-on practice. Adjust the pacing to your 120-day window and your background.
Foundations First
- Statistics Fundamentals and Probability and Frequency, since everything later leans on them
- Leveraging Python and Data Acquisition so code and data handling are second nature
Core Modeling
- Regressions and Supervised Learning
- Clustering, then Anomaly Detection and Optimization
Neural Approaches
- Neural Networks before Convolutional Neural Networks
- Build your index as you go, not at the end
Integration and Rehearsal
- Timed practice under the 3-hour constraint
- Hands-on drills for the CyberLive portion
Why this order? The mathematics domains are cheap to learn first and expensive to be weak in later. Neural networks should precede CNNs because convolutional architectures extend the same ideas. Building your open-book index incrementally prevents the common failure of a rushed, unusable index in the final days. For a fuller plan, follow our GMLE study guide, keep the GMLE cheat sheet handy for quick review, and test yourself with the practice questions on the main practice test site.
Key Takeaway
Because GIAC publishes no domain weights, do not skip any of the ten. Spread your effort sensibly, then use practice results to find the specific domains where you are leaking points.
Frequently Asked Questions
On this site, GMLE means GIAC Machine Learning Engineer, a GIAC certification focused on applying machine learning and data science to cybersecurity problems.
The exam has 82 questions with a 3-hour limit. It includes multiple-choice questions and performance-based CyberLive tasks, and the time limit covers the complete exam. The minimum passing score is 65%.
Yes, for hardcopy books, notes, and an index. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited. An on-screen calculator and scratch notepad are provided.
No. There are no formal certification prerequisites, and training is optional and recommended. SEC595 is the associated course, though it carries its own Python readiness expectations separate from certification eligibility.
It is valid for four years. Renew with 36 approved CPE credits earned during that period or a renewal exam, plus the standard $499 renewal fee.
GMLE is a focused, hands-on credential for people who want to demonstrate real machine learning capability in a security context. Learn the ten domains, rehearse the CyberLive format, build your index early, and confirm your attempt's specifics on GIAC's attempt page before you sit. When you are ready to test your readiness, head to the GMLE Exam Prep practice tests.