GMOB Requirements 2026: Eligibility, Prerequisites & How to Qualify

What GIAC Actually Requires: No Formal Prerequisites

The short answer for anyone searching for GMOB requirements: there are none in the traditional sense. The GIAC Mobile Device Security Analyst (GMOB) certification, issued by GIAC Certifications and administered by GIAC, LLC, does not demand a prior certification, a minimum number of years in the field, a degree, or a verified work history. You do not need to submit a resume or an employer attestation to sit the exam.

That puts GMOB in a different category from credentials that gate entry behind documented experience. If you can register, pay the fee, and meet the proctoring conditions for your attempt, you qualify to take it. Training is described as optional and recommended, which matters because many candidates assume the associated SANS course is mandatory. It is not.

If you are still orienting yourself on what the credential covers, our primer on what GMOB certification is explains the scope in plain terms, and the broader GMOB requirements overview ties the pieces together.

The Gap Between Eligibility and Readiness

The absence of a formal gate does not mean the exam is gentle. GMOB's objectives sit squarely in hands-on territory: analyzing apps, intercepting and manipulating traffic, reverse engineering, and rooting or unlocking devices. A candidate with no exposure to those activities can legally register, but will struggle to answer scenario questions in 75 questions and 2 hours.

Think of readiness as the real prerequisite. GIAC does not enforce it; the exam does. If you want an honest read on how demanding the test is, see how hard the GMOB exam is, and for what the data does and does not show on outcomes, the GMOB pass rate article is the place to start.

Why "no prerequisites" is a double-edged sword

Because there is no screening, the candidate pool varies widely: seasoned penetration testers, mobile developers moving into security, and defenders who manage fleets of devices. Each of these starts with a different gap. A pen tester usually has traffic interception down but may be thin on mobile device management and stolen-device mitigation. A mobile administrator may know policy controls well but never have decompiled an APK. Your self-assessment should be domain by domain, not one global confidence score.

Technical Skills the GMOB Objectives Assume

The published objective list has 11 domain headings, presented in the issuer's order and without official percentage weights. Because no weights are published, you should not assume any domain is a minor topic. Here is what each heading implies about the background you should bring.

For a deeper walk through each heading, the GMOB exam domains guide covers all 11 content areas in detail.

Training Is Optional: SEC575 and Self-Study Paths

The preparation source most associated with this certification is SANS SEC575, "iOS and Android Application Security Analysis and Penetration Testing." Its recommended background is programming experience, basic Linux and terminal familiarity, and penetration-testing knowledge. Those are course recommendations, not GIAC eligibility rules. The distinction is easy to blur, so keep it clear: SANS suggests a background to get the most from the class; GIAC does not require it to sit the exam.

Choosing between course-led and self-directed prep

Course-led preparation gives you structured labs and, importantly for an open-book exam, a set of course books you can index. Self-directed preparation is cheaper in tuition but demands that you build your own lab, your own notes, and your own index. Tuition for SANS training is separate from every GIAC fee discussed below. If you are weighing the spend, the GMOB training overview and the GMOB study guide lay out the options and a path to a first-attempt pass.

Fees, Activation, and the 120-Day Window

Registration mechanics are part of qualifying in practice. Here are the numbers GIAC publishes, all excluding applicable sales tax:

Once your attempt is activated, you have a 120-day completion window. That window is a hard planning constraint. Activating early "to lock in a price" without a study plan can burn days you need. For a full breakdown of what the total spend looks like, see the GMOB certification cost guide, and for scheduling specifics read GMOB exam dates and scheduling.

Exam-Day Rules That Affect Who Qualifies to Pass

The exam is a single proctored, web-based test of 75 questions with a 2-hour time limit. The minimum passing score is 71%. That passing standard applies to exam versions released on or after December 24, 2016, so it covers current versions; again, your assigned attempt's page is authoritative. Our GMOB passing score article digs into what 71% means in practice.

Open book, with strict limits

The test is open book, but only with hardcopy books, notes, and an index. The restrictions are firm:

• Internet access is prohibited.
• Personal electronic references are prohibited.
• Materials resembling practice or exam questions and answers are prohibited.
• Submitted answers cannot be changed once submitted.
• Fifteen minutes of break time are allowed.

Two of these deserve extra attention. First, the ban on materials resembling practice or exam questions and answers means your index and notes should be conceptual references, not dumps of question-and-answer pairs. Second, because answers cannot be changed, you cannot "bank" a guess and circle back to revise it after seeing a later question. Pace yourself so that your first answer is your considered answer. Roughly 1.6 minutes per question is the average budget across 75 questions in 2 hours, and the break time is separate from that arithmetic.

If you want a compact reference to rehearse from before test day, the GMOB cheat sheet distills the must-know facts, and the practice questions on the main practice test site help you test recall under timed conditions.

Who Benefits From GMOB and Where It Gets Used

Because there are no gatekeeping prerequisites, GMOB attracts professionals from several adjacent roles. The objectives point to the kinds of work the credential speaks to:

• Penetration testers and application security analysts who assess Android and iOS apps, using static and dynamic analysis and MASVS-aligned methods.
• Mobile security engineers and device administrators responsible for managing Android and iOS fleets and mitigating stolen-device risk.
• Malware and reverse engineering analysts who dissect mobile applications and respond to mobile malware.
• Security consultants and red-team members who need to demonstrate mobile coverage alongside network and web skills.

Employers in these areas tend to be security consultancies, enterprises with large managed mobile fleets, and organizations that ship their own mobile apps. For the career picture, the GMOB jobs article maps roles to the credential, the GMOB salary guide addresses earnings, and the GMOB ROI analysis weighs cost against benefit. This article does not quote salary figures because none are part of the verified fact base here.

Sequencing Your Preparation by Domain

Generic scheduling advice is not very useful for this exam, so here is one short plan keyed to the actual domain list. The logic: build lab foundations first, then layer the offensive techniques, then finish on the defensive and management domains where recall and indexing pay off most.

Keep the whole plan inside your 120-day window with margin to spare. Since no domain weights are published, resist the temptation to skip any heading because it "seems minor."

Keeping the Credential: Four-Year Validity and Renewal

Qualifying is not a one-time event. The certification is valid for four years. To renew, you earn 36 approved CPE credits during the active four-year period, or take a renewal exam, and in either case pay the standard $499 renewal fee. Planning CPE activity from the start, rather than scrambling in year four, keeps renewal inexpensive in effort terms. Attending conferences, completing relevant training, and similar activities are the typical sources, though the approved list lives on GIAC's CPE information page, which you should check directly.

If you are new to the acronym and want to be sure you are reading about the right credential, our explainers on what GMOB stands for and the GMOB certification hub confirm that this is the GIAC Mobile Device Security Analyst credential.

Frequently Asked Questions

Qualifying for GMOB is straightforward on paper and demanding in practice: no gatekeeping, but 11 domains of hands-on mobile security knowledge. Build your lab, index your materials, and test yourself under timed conditions with the resources on our GMOB practice test site.