GOAA knowledge map
GOAA tests AI-driven offensive technique — reconnaissance, web exploitation, AI-assisted phishing and deepfakes, AI-generated malware, control evasion. The guidebook teaches these topics the way it teaches all offensive material: the concepts, what a defender sees, and how to detect and stop it — no working malware, no phishing kits, no evasion tooling. Each objective points to the lessons that teach its defensive side; three objectives have no lesson yet, and they are marked honestly. Objective titles are GIAC’s; everything else is the guidebook’s own words.
Published 2026-10-09 · generated from the lesson data · 7 of 10 domains have a lesson
SANS’s SEC535: Offensive AI – Attack Tools and Techniques is the course GIAC pairs with this exam, confirmed at sans.org on 2026-10-10. The course is paid; this map teaches the objectives’ defensive side from free lessons.
How the guidebook handles offensive AI: the linked lessons teach each attack’s concepts, the telemetry a defender sees, and the fix. Three objectives have no lesson — deepfakes, AI-written phishing email, social-engineering fundamentals — and they stay unmapped rather than taught badly; the guidebook does not write phishing kits or working malware, so those gaps do not get closed with how-to content.
The domains
| Domain | Title | Lessons |
|---|---|---|
| 1 | Artificial Intelligence Fundamentals | How LLM applications are built and where they are attacked |
| 2 | Audio, Image, and Video Deepfakes | No lesson yet — logged as a gap. |
| 3 | Bypassing Defensive Controls | Exploit development and reverse engineering: concepts |
| 4 | Creating Malicious Software with AI | Malware analysis: concepts |
| 5 | Creating Phishing Emails with AI | No lesson yet — logged as a gap. |
| 6 | Malware Fundamentals | Malware analysis: concepts |
| 7 | Network Scanning and Vulnerability Detection | The toolbench: fifteen phases, one question each, Engagement methodology: WSTG, PTES, and NIST SP 800-115 |
| 8 | Social Engineering Fundamentals | No lesson yet — logged as a gap. |
| 9 | Using AI for OSINT | OSINT and research discipline |
| 10 | Using AI for Web Exploitation | SQL injection: when your input becomes the query, OS command injection: when your input reaches a shell |