A certification should answer one question: can this person actually do the job, or do they just know about it? For a team, that question doesn't stop at hiring, it comes up again at onboarding, at promotion, and whenever leadership asks for evidence the team is still sharp. GIAC, the certification body behind the SANS Institute's training, and TryHackMe's own certifications are two of the most common answers security teams weigh against each other, and both are solid choices.
- TryHackMe's certifications are built around hands-on, job-aligned validation: real tools, real scenarios, and the judgment calls a working analyst or pentester actually has to make, not just knowledge recall.
- GIAC certifications combine SANS Institute training with GIAC's own CyberLive hands-on testing format, and remain a well-established option in the field.
- TryHackMe also lowers the barrier to getting certified, in both cost and how the time is spent: shorter, self-paced, browser-based preparation rather than a proctored exam that needs months of dedicated study first.
How do GIAC and TryHackMe actually test skill differently?
GIAC exams pair scored knowledge questions with CyberLive, GIAC's own hands-on lab component, inside a single proctored sitting. TryHackMe builds its exams as live simulations from the start: SAL1 and SAL2 run inside a real SOC Simulator working through Splunk alerts, PT1 is a live penetration-testing engagement complete with a professional report, and AI1 has candidates attack and defend a real, live large language model (LLM), including retrieval-augmented generation (RAG) systems it can query, rather than a simulated stand-in. In every case, the technical work and the judgment calls around it, like whether to escalate, what goes in a report, or how to shut down a live attack, get graded together rather than as separate boxes to tick.
Which certifications do GIAC and TryHackMe each cover?
GIAC's catalog spans dozens of specialist credentials built on SANS courses, from GSEC (security essentials) through GCIH (incident handling), GPEN (penetration testing), and a growing set of AI security certifications.
TryHackMe's own certifications are narrower and more targeted: Pre Security (SEC0) and Cyber Security 101 (SEC1)build the foundation, SAL1 and SAL2 validate SOC analyst work from Level 1 through senior, PT1 validates junior penetration testing, and AI1 validates offensive and defensive AI security skill.
How does TryHackMe lower the barrier to getting certified?
Mainly on cost and on how study time is spent. GIAC exam registration commonly runs $949 to $999 per attempt, and the SANS training most candidates take alongside it adds several thousand dollars more. For business customers, TryHackMe lists each certification at a single price that bundles training, the exam, and a free retake, SAL1 and PT1 at $299, AI1 at $399, and SAL2 at $750, and teams can purchase that access through certification credits rather than buying individual vouchers one at a time.
Time works the same way. Preparing for a harder GIAC exam often means months of dedicated study on top of a full-time job. TryHackMe builds its preparation into short, self-paced learning paths instead, so candidates fit study into smaller sessions around their schedule rather than blocking out months up front. The exams themselves run on fixed windows rather than that longer study period: 24 hours for SAL1, 48 hours for PT1 and AI1, and 72 hours for SAL2, with AI1 typically needing only around 6 to 8 hours of actual work inside that window.
What do TryHackMe's business customers say about the platform and training content?
Teams already using TryHackMe's training content, separate from the certifications above, tend to make the same two points in their own words: it's hands-on, and it fits around a busy schedule. Tyler Benson, SOC Support Manager at Huntress, said onboarding time dropped from three months to six weeks after adopting the platform, and that it has "given my team the confidence and skills they need" to protect customers. Keith Manville of Google Security called himself "personally a massive fan of TryHackMe." KPMG's team put it in terms that line up directly with the self-paced argument above: "bite-sized content is especially useful for training in between other priorities." And Aleksandra Dubovik at ARAG summed up the value for managers simply: "we know what the learner knows."
What do employers and reviewers say about TryHackMe's SEC1, SAL1, SAL2, PT1, and AI1 certifications?
Real quotes from the people who helped design these exams, the employers who use them to hire, and independent reviewers who've actually sat them back up the hands-on claim certification by certification.
- SEC1. Mike Wright, an IT hiring manager and founder, has said the certification demonstrates "a functional understanding of IT concepts" in candidates from any IT background, not just cyber specialists, which saves his trainers time during onboarding.
- SAL1. Haroon Mahmood, of Salesforce's Detection & Response team and one of the employers who helped design the exam, has called it "an excellent starting point for anyone looking to show their competency in SOC fundamentals."
- SAL2. Three separate voices from NCC Group, an MSSP TryHackMe treats as a model customer for this exam, back the same point. SOC Manager Andrew Wills praised specific scenarios, including "the Phishing the Budget, Detection Gap and Executable Gift scenarios." SOC Analyst Suliman Tadros said working through the SIEM and writing the report made the exercise "felt real." Fellow SOC Analyst Pablo Menendez Cores said it "reflects quite well what we actually do in an MSSP environment." And an independent reviewer who has also earned CRTO and eCPPTv3 confirmed the certification's mid-to-senior positioning, adding plainly that it is "not beginner-friendly."
- PT1. Tinus Green, the TryHackMe content engineer who helped build the exam, said it "reflects what you'll actually face in a real-world penetration test." Independent reviewers have echoed that: one called it "a great entry-level certification to get if you are a beginner," and another, who has also sat CRTP, eJPT, and PJPT, said he "won't knock TryHackMe on SAL1 or PT1's price."
- AI1. Dragkob, a cybersecurity consultant who has also earned CRTO and eCPPTv3, weighed AI1 against several other AI security certifications on the market and concluded "this is currently the strongest starting point for AI cybersecurity," separately praising the exam's interface as modern and immersive enough to feel like a genuine assessment rather than a chore.
For contrast, one account of preparing for GIAC's GSEC describes months of dedicated study on top of a full-time job before even sitting the exam, the same trade-off noted above.
FAQ
What is the difference between a GIAC certification and a TryHackMe certification? A GIAC certification combines scored knowledge questions with GIAC's CyberLive hands-on lab component, built on SANS Institute training. A TryHackMe certification is a live simulation from the start, grading technical skill and the judgment calls around it together.
How much does it cost to get certified on GIAC versus TryHackMe? GIAC exam registration commonly runs $949 to $999 per person, plus several thousand dollars for the SANS training most candidates also take. For business customers, TryHackMe's certifications each list at a single price bundling training and a free retake, SAL1 and PT1 at $299, AI1 at $399, and SAL2 at $750, purchased through certification credits rather than one voucher at a time.
Should a team start with GIAC or TryHackMe? For proving people can do the job under real conditions, quickly and affordably across a team, TryHackMe's certifications are built for that. GIAC and SANS training remain a solid option for deep, individual specialist depth.
Teams weighing where either fits into a training program can start with TryHackMe for Business.
Joanna Duffy