GIAC Offensive AI Analyst (GOAA)

Exam Certification Objectives & Outcome Statements

• Artificial Intelligence FundamentalsCandidates will demonstrate an understanding of core AI concepts—natural-language processing (NLP); generative techniques such as generative adversarial networks (GAN) and retrieval-augmented generation (RAG); vector databases; and custom GPTs/assistants. They will distinguish between adversarial and offensive AI and show familiarity with both commercial and open-source AI platforms.
• Audio, Image, and Video DeepfakesCandidates will demonstrate an understanding of tools and techniques for creating audio, image, and video deepfakes for social-engineering attacks, including the key components—e.g., speech elements—needed to produce convincing content.
• Bypassing Defensive ControlsCandidates will explain techniques for evading defensive controls, describe Windows Defender architecture and its exploitable components, and apply AI models to achieve effective defense bypass.
• Creating Malicious Software with AICandidates will demonstrate understanding of how AI models can be used to generate malware samples for ethical penetration-testing use and craft prompts that bypass large-language-model security guardrails.
• Creating Phishing Emails with AICandidates will demonstrate an understanding of tools such as GoPhish and the Social Engineering Toolkit (SET) and apply prompt-engineering techniques to craft high-quality phishing emails.
• Malware FundamentalsCandidates will demonstrate an understanding of malware fundamentals—payloads, exploits, propagation vectors, droppers, and downloaders—and explain common persistence, anti-detection and anti-analysis mechanisms.
• Network Scanning and Vulnerability DetectionCandidates will demonstrate an understanding of network-enumeration and vulnerability-scanning methodologies and tools, and integrate scan outputs into AI-agent workflows to identify and contextualize vulnerabilities.
• Social Engineering FundamentalsCandidates will demonstrate an understanding of social-engineering attack surfaces, objectives, and psychology in penetration testing, and articulate the associated legal and ethical considerations.
• Using AI for OSINTCandidates will demonstrate an understanding of the reconnaissance phase of penetration testing, apply AI safely and ethically during OSINT activities, and identify common OSINT data-gathering tools.
• Using AI for Web ExploitationCandidates will demonstrate an understanding of how AI-powered tools can be leveraged to streamline workflow and execute precise web-application attacks, including SQL-injection and command-injection techniques.