My Review of SANS SEC535 - Offensive AI - GOAA

In cybersecurity, there are always more vulnerabilities and always more certifications. This year I wanted to improve my AI skills, since AI is becoming a bigger part of cybersecurity and integrating into every aspect of the job. I chose SEC535: Offensive AI: Attack Tools and Techniques by the SANS Institute. This course, if you do it in person, is 3 days of content, and if you do it self-paced, it's about 11 hours of videos going over the content. It is paired with an optional exam, the GIAC Offensive AI Analyst (GOAA). I’m going to tell you about how I studied, what it was like going to take the exam, the GIAC Advisory Board, and my overall thoughts on the course. 

Going into this course, I already had 5 years of experience as a penetration tester, along with several certifications, including the OSCP, CISSP, and Security+. I also have a background as a developer, which helped with the scripting and programming-related content. While most of the course focuses on AI, it’s beneficial to have that background to understand the core concepts that AI is enhancing. 

This is my second SANS course, the first being SEC660, which is the course for the GXPN. I took this one in person and quickly realized in-person training is not for me. That many hours of coursework packed into a few days back to back made it very difficult for me to retain. So this time I chose the self-paced option, allowing me to spread out the content over weeks and months, and allowing me to rewatch the content and review specific sections. I’m blessed that my employer paid for the course and exam, because they are very expensive for someone to pay for themselves. At the time of this writing, the course costs around $5,000 dollars and the exam is an extra $1,000 dollars.

Studying:

If you have read my other articles on studying for certifications, you’ll know that I work through the content very meticulously, and this time was no different. I started by watching the course videos, about an hour or two a day, which kept me focused instead of zoning out. Because the self-paced format gives you 120 days to take the exam, I only watched when I actually wanted to rather than sticking to a structured schedule. At my pace, it took me about 2 weeks to get through all the videos. 

After finishing the videos, I read through the course books highlighting as I read, marking definitions and key concepts. It’s easy to want to end up highlighting most of a page, but keep it down to just the most important concepts, a few words max. This allows you to flip through the pages during the exam and spot the exact concept you’re looking for, you’re not going to want to read multiple sentences per page to find an answer.

Once I’d highlighted every book, I went back through the videos with the books open to make sure I hadn’t missed anything. Since this was a review, I watched at 1.5x speed and got through about one section a day. Along the way, I wrote notes from the videos into the margins of the books. 

I saved the labs until after I went through all the video content. Each day’s labs took me a few hours to complete. Most of them include video walkthroughs that explain each step. I found the walkthroughs more useful than the labs themselves for exam prep. That said, if you’ve never done some of the tasks covered in the labs, it’s important to actually do the labs.

Similar to when I took the GXPN, I made a cheat sheet listing the page numbers, titles, and key definitions and concepts for each page. I keep making these even though I barely touch them during the exams. Building these forces me to learn where each concept lives in the books, and that turns out to be worth far more than the cheat sheets themselves.

At this point, I took my first practice exam. I hadn’t finished the third book yet, but I was planning to schedule my exam soon. I figured it couldn't hurt to see how I would do so far. I scored an 87%, which I felt good about, especially since I had definitely misread at least one of the questions and got it wrong.

I scheduled my exam for the following week. The exam, like other SANS exams, is open book, and you’re given 2 practice tests to take before the actual exam. While an open-book exam sounds like a blessing, it can be a curse because you find yourself needing to double-check all your work and wasting time. 

After the first practice exam, I bought 4 packs of 24 highlighting tabs to mark key pages. With each book being around 100 pages, that’s a manageable amount. Using one pack per book, I found 20-24 major concepts and wrote a single word on each tab. For the lab workbook, I just put a tab with the name of each lab. Once that was done, I was finally ready. 

The night before my exam, after doing some last-minute review, I took my second practice test at around midnight. I scored an 80%, which was lower than my first attempt, but since you only need a 67% to pass and I was taking this when I was tired, I wasn’t too worried. 

Exam Day:

My exam was scheduled for 2 p.m., so I took the day off work and had an easy morning. When I arrived at the testing center, the lights were off, the door was locked, and UPS notices were on the door. That was not a good sign. For some reason I never found out, the testing center was closed. I called SANS, and they were extremely helpful. They had me contact the testing center’s support line to see if they were able to get the center open, but ultimately I had to reschedule. SANS called me back, apologized, and gave me a 2-week extension in case I needed the extra time to reschedule. 

I was able to take my exam the following week at a different location. Unlike the practice exams, which I finished with about 45 minutes to spare, I took the whole time on the exam. It’s just too easy to second-guess yourself and check every answer in the book. I ended up getting a 94%, which was far better than any practice exam I took.

GIAC Advisory Board:

Something I didn’t know before the exam, scoring 90% or better earns you an invitation to the GIAC Advisory Board. It’s an invite-only, email-based forum where fellow cybersecurity professionals exchange ideas and advice on GIAC content. I could see it being useful if I take another SANS course in the next few years. 

Members also receive a digital badge for the Advisory Board, which makes a great addition to your LinkedIn profile and resume. Anyone familiar with SANS exams will know it means you crushed your exam.

Membership in the Advisory Board lines up with the expiry of your GOAA certification. The GOAA is good for 4 years, and to renew it, you’ll need to earn and submit 36 CPE credits and pay a maintenance fee. 

My Thoughts on the Course:

The course does a great job of covering the core ways offensive security professionals are employing AI. The labs are very interactive, and the course authors clearly put in the effort to make the social engineering section feel realistic. Each section is also distinct, which makes it easier to look things up during the exam.

Probably the most obvious drawback to an AI course is that the technology is progressing so fast the content quickly goes out of date. Even in the few months I spent on the course, AI advanced noticeably, which makes it hard for the course writers to keep up with the latest developments. They would practically need to update the course within the window you have to take the exam, which just isn’t realistic. 

The course covered some things I already do at work, along with concepts I haven’t had the opportunity to explore yet. I’d recommend this course to red teamers, social engineers, or anyone who wants a more well-rounded understanding of offensive AI threats. 

If you’re considering taking SEC535, I hope this article gave you some useful insight, and if you’re currently preparing for the exam, best of luck. As a follow-up, I’ll be checking out HackTheBox’s AI coursework, which I hope will complement what I learned here.