Start with GSCP, the intermediate exam, and step up to GSCE, the full expert-level certification. Both are hands-on — you exploit real vulnerabilities on live AI targets, graded on the evidence you capture, not a multiple-choice quiz. An examiner reviews every sitting before a credential is issued.
Launch price until 27 November, then $499.
One ladder, the same hands-on format. GSCP proves the core skills; GSCE proves you can do the whole job. Both are reviewed by an examiner and graded on a demonstrated exploit, never a quiz.
Launch price until 27 November, then $249.
The intermediate, hands-on credential. You exploit real vulnerabilities in a live AI application drawn at random for your attempt: 80% OWASP LLM Top 10, including prompt injection, disclosure, retrieval and output handling, and 20% web. For each finding you write a few lines on how you found it. One month of lab access to prepare is included.
Launch price until 27 November, then $499.
The full expert-level exam. You exploit a live AI application across the OWASP LLM, Agentic and MCP Top 10s, the web layer and the cloud workload, and write a few lines on how you found each issue. Three months of lab access to prepare are included.
Pre-order now — both exams are running as a closed pilot for invited candidates today and open to everyone on 27 October 2026. Once an exam is open to you there is no slot to book: start when you are ready. One free retake on each; further attempts $99.
The exploit has to work: the platform checks the evidence you capture against the live target. For each issue you also write a few lines on how you found it, and an examiner reviews the sitting before any credential is issued. This is the same for GSCP and GSCE.
You work against running, deliberately vulnerable AI applications — real models, real tool calls, randomized per-candidate secrets. Nothing is simulated and nothing is multiple choice.
Each objective is graded on the evidence you capture. The harness checks what your payload actually did to the target, so a pass is a demonstrated exploit — not a claim about one.
For each issue you land, you write a few lines in your own words on how you found it. An examiner reads them when reviewing your sitting. You are not graded on building a fix.
Pass, and a named examiner reviews the sitting. Once they release it, you receive a dated credential with a unique ID, publicly verifiable at its own URL.
Before any of that: work the labs. There is no slot to book. You agree to the exam rules, set up the sitting, and the clock starts when you press Begin.
This weighting is GSCE. Real AI systems get breached through the web app and the cloud account around them, so the exam tests those too — the web and cloud slices are the stack the AI feature runs on, not padding to look broad. GSCP is scoped to the core OWASP LLM Top 10 only.
We only make claims about our own exam. Here is exactly what it is — and what it deliberately is not.
Counts are live from the catalogue. A lab can cover more than one category, so the columns overlap and sum above the distinct total shown above.
Issued once an examiner releases your passing result, scoped to the domains you were assessed against, and verifiable by anyone at its public URL.
GSCE assumes you can already test; GSCP is the first step. Answer three things and we'll tell you whether to start with the intermediate exam, go straight to the expert-level exam, or spend time on the labs first.
We'll point you at GSCP, GSCE, or the training path based on your testing, reporting, and LLM experience.
GSCP (GenAI Security Certified Professional, $199) is the intermediate, hands-on exam: 4 hours against a live application, weighted 80% OWASP LLM Top 10 and 20% web. It includes one month of labs to prepare. GSCE (GenAI Security Certified Expert, $399) is the full expert-level exam: 10 hours across the OWASP LLM, Agentic and MCP Top 10s plus web and cloud, with three months of labs to prepare. In both, you write a few lines on how you found each issue. Take GSCP if your AI-specific technique is still building or you want to prove the core skills first; go straight to GSCE if you can already land an exploit unaided.
GSCE is proctored through your webcam for the whole sitting. GSCP is not proctored: your screen is recorded from before you press Begin until you submit, and the sitting goes through integrity checks. For both, a named examiner reviews your work before a passing result becomes a credential. If the review finds the exam rules were broken, the attempt is voided and no credential is issued.
You agree to them before the clock starts. While your exam clock is running you may not use AI assistants, copilots, chatbots or autonomous agents of any kind — including AI built into your browser, editor or terminal — and you may not get help from anyone else. The exam targets are the only AI you interact with. Ordinary tools are fine: a browser, a text editor, a terminal, your own notes, and public references you read yourself.
No. There is nothing to book. Once you own an attempt, you start whenever you are ready. The clock starts when you press Begin, not when you open the exam, and it cannot be paused.
The platform checks the evidence you capture against the live target, so a pass means the attack worked. For each issue you also write a few lines, in your own words, on how you found it, and an examiner reads them when reviewing your sitting. No part of either exam grades a fix you build.
Your score is shown when you submit. A passing sitting then waits for a named examiner, who reviews your submission and the sitting. The credential is issued when the examiner releases the result.
In practice, yes. The exam grades what you can do against a running target, and the labs are where that skill is built. That is why GSCE includes three months of lab access and GSCP one month — so you can build the skill before you sit it.
You get a domain-level breakdown showing where you fell short — never the answers or the exploit paths. One free retake is included, on freshly randomized targets. Further attempts are $99 each.
Your credential is dated and carries no expiry date. It stays verifiable at its public URL unless it is revoked. Because this field moves quickly, we recommend recertifying every 24 months.
Every credential carries a unique ID and resolves to a public verification page showing the holder, the credential, its status and its issue date. Scores stay private.
You cannot pass this by recognizing the right answer. You have to compromise a running AI application, capture the evidence, and explain in your own words how you found each issue.
A standard web or API pentest scope walks straight past prompt injection, agent and MCP tool abuse, and retrieval boundaries — so the gap stays open. GSCP and GSCE are a dated, public record that you found and exploited those flaws on running systems — and, for GSCE, reported them.
Two credentials, one ladder: start with GSCP, the intermediate exam with one month of labs, or go straight to GSCE — the expert-level credential, with three months of labs to prepare and one free retake included.