GSCP and GSCE overview
Learn what GSCP and GSCE test, how they differ, how a sitting is scored, and how to prepare.
GenAI Security Lab offers two certifications. GSCP, the GenAI Security Certified Professional, is the intermediate exam. GSCE, the GenAI Security Certified Expert, is the expert-level flagship. Both are hands-on exams against a live, deliberately vulnerable application. GSCE is proctored through your webcam; GSCP is screen-recorded and goes through integrity checks.
The two certifications
Each exam has a syllabus and a candidate handbook, as PDFs: GSCP syllabus, GSCP handbook, GSCE syllabus and GSCE handbook.
| GSCP | GSCE | |
|---|---|---|
| Level | Intermediate | Expert, the flagship |
| Exam length | 4 hours | 10 hours |
| Covers | 80% OWASP LLM Top 10 (2026), 20% web | 75% OWASP LLM, Agentic and MCP Top 10s (2026), 20% web, 5% cloud |
| Pass mark | 75% | 75% |
| Write-up | Brief notes on each finding, in your own words | Brief notes on each finding, in your own words |
| Proctoring | Not proctored. Screen-recorded, with integrity checks; reviewed by examiners | Webcam proctoring; reviewed by examiners |
| AI agents | Not allowed | Not allowed |
| Price | $199, tax inclusive. Launch price until 27 November, then $249. | $399, tax inclusive. Launch price until 27 November, then $499. |
| Retakes | 1 free retake, then $99 per attempt | 1 free retake, then $99 per attempt |
| Validity | Does not expire | Does not expire |
These are the standard prices. GSCP and GSCE cost less in Tier 2 and Tier 3 countries; see Regional pricing tiers. Retakes are $99 everywhere.
GSCP is the recommended step before GSCE. It is not required. GSCP includes 1 month of lab access and GSCE includes 3 months; beyond that, labs and learning paths come with a plan. Both exams open on 27 October 2026. Until then they run as a closed pilot and you can join the waitlist from the certification page in the app.
The rest of this page describes GSCE. GSCP follows the same format, rules and scoring with the shorter length and narrower scope shown above.
What GSCE proves
GSCE is a practical exam with no multiple-choice questions.
Every objective is graded on evidence captured against a live target, as in a lab. In the ShopBot lab's VIP-coupon objective, for example, you receive a goal without a script. An extracted value proves you met it; a description of your approach alone does not.
Unlike training labs, the exam requires a few basic notes in your own words after each completed challenge. Briefly explain how you found the issue, its impact, its root cause, and your recommended remediation. Neither exam requires a long, detailed report. You describe the fix without implementing it; implementation is not graded. The write-up is graded against a rubric rather than checked for keywords.
A private exam bankYour live targets come from a bank you won't have trained on. Every target is seeded uniquely for your sitting.
Exam format
GSCE is time-boxed and proctored through your webcam for the whole sitting. GSCP is not proctored: your screen is recorded and the sitting goes through integrity checks. A named examiner reviews every sitting before any credential is issued.
There is no slot to book. Once you own an attempt, you accept the exam rules, set up the sitting (webcam proctoring for GSCE, screen sharing for GSCP), and press Begin to start the clock. You then work through objective-based tasks against live targets in the same format as the labs, under exam conditions. Your set is randomized and locked when you begin. You cannot regenerate it, and no hints are available.
GSCP uses the same format, including brief notes in your own words about how you found each issue. Neither exam requires a long report.
See Sitting the exam for the exam rules, screen recording, and submission process.
How it's scored
Each objective is graded as it would be in a lab: your evidence is checked against the target and scored. GSCE combines the objective results into one overall proficiency rating for your sitting. This scale differs from the labs' three bands.
| Rating | What it means |
|---|---|
| Insufficient | Well below the passing threshold, with most objectives unmet. |
| Developing | Progress, but performance is not yet consistent across categories. |
| Job-ready | Meets the passing threshold with solid coverage. |
| Strong | Consistently high performance across almost every category. |
Passing requires both an overall score that meets the threshold shown before you start and a full solution for every required category. A high score elsewhere cannot compensate for a skipped required category.
Prepare before you start
You should be able to find and exploit issues unaided before starting. GSCE has no hints or walkthroughs, so familiarity with the format matters.
- Practice in the lab catalogue builds familiarity with the OWASP LLM Top 10 categories.
- Advanced or Expert on the difficulty ladder is the preparation target. GSCE covers the same OWASP LLM, MCP, and agentic categories as the labs.
- Completing a lab end to end, including evidence collection, helps you learn the exam mechanics.
After you pass
Your score appears as soon as you submit. A named examiner reviews every sitting, including your submission and the screen and webcam recordings. After a passing result is released, your credential is issued with its own serial number, and your certificate appears in your certifications area. If the review finds that exam rules were broken, the attempt is voided. No credential is issued, and the attempt counts as used.
The serial number links to a public page anyone can check without an account or login. See Verifying a credential for what it shows and how to share it.
Your credential can be verified by its serial number.