What Is GMOB?

What GMOB Actually Means

GMOB is the short name for the GIAC Mobile Device Security Analyst certification. It validates that a practitioner can assess, attack, and defend smartphones and tablets, with a strong emphasis on the Android and iOS platforms and the applications that run on them. If you have seen the acronym elsewhere, set those associations aside: on this site and in this article, GMOB refers only to the GIAC credential.

The certification sits in the hands-on, practitioner tier of information security credentials. It is not a management overview of mobile policy. Candidates are expected to understand how mobile operating systems enforce security, how applications can be inspected and manipulated, how encrypted traffic can be intercepted for analysis, and how organizations reduce the damage when a device is lost or stolen.

For related explainers on the name itself, see our short pieces on what GMOB stands for and the meaning of GMOB. For the credential overview from a different angle, read What Is GMOB Certification?

Who Issues It and How the Exam Is Delivered

The credential is issued by GIAC Certifications (formerly Global Information Assurance Certification), administered by GIAC, LLC. Candidates sit a single proctored, web-based exam either onsite through Pearson VUE or remotely through ProctorU, subject to the eligibility attached to the specific attempt.

Rules that shape how you test

Two policies deserve attention before you ever open a practice question. First, submitted answers cannot be changed, so you cannot circle back and revise a response after you have committed to it. Second, 15 minutes of break time are allowed. Because the clock is two hours for 75 questions, you have well under two minutes per item on average, and your index must be fast enough to avoid burning time on lookups.

The open-book allowance is narrow. Hardcopy books, notes, and an index are permitted. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited. The authoritative rules for your specific attempt live in your GIAC account and the attempt page, which take precedence over any summary, including this one.

For a deeper look at the cut score, see GMOB Passing Score 2026. For the scheduling mechanics, GMOB Exam Dates 2026 covers testing windows and deadlines.

The 11 Exam Domains at a Glance

GIAC publishes its objectives as eleven headings. GIAC does not publish percentage weights for them in this objective list, so no domain should be treated as officially heavier than another. The headings, in published order, are:

1. Analyzing Mobile Applications
2. Attacking Encrypted Traffic
3. Managing Android Devices and Applications
4. Managing iOS Devices and Applications
5. Manipulating Mobile Application Behavior
6. Manipulating Network Traffic
7. Mitigating Against Mobile Malware
8. Mitigating Against Stolen Mobile Devices
9. Mobile Application Security Assessments
10. Reverse Engineering Mobile Applications
11. Unlocking and Rooting Mobile Devices

The headings fall naturally into a few clusters: platform management (Android and iOS), offensive analysis (static and dynamic analysis, reverse engineering, behavior and traffic manipulation, encrypted traffic), defensive mitigation (malware and stolen devices), and assessment methodology. A complete walkthrough of each heading is in our GMOB Exam Domains guide.

What You Must Actually Master

Rather than restating the headings, it helps to translate them into the concrete skills they imply. The following blocks group the domains by the work a mobile security analyst does day to day.

Question style

Expect scenario-flavored multiple-choice questions that test whether you can apply a concept, not just define it. A question might describe an assessment situation and ask which technique, tool category, or control is appropriate. Because the exam is open book, memorization of trivia matters less than knowing precisely where to find an answer and understanding the concept well enough to interpret it. For a sense of difficulty, see How Hard Is the GMOB Exam?

The Preparation Path: SEC575 and Open-Book Strategy

GIAC states that training is optional and recommended. The preparation source most closely associated with this certification is the SANS Institute course SEC575: iOS and Android Application Security Analysis and Penetration Testing. SEC575 recommends programming experience, basic Linux and terminal familiarity, and penetration-testing knowledge. Those are course recommendations, not GIAC eligibility requirements, and the distinction matters: you can register for the exam without them, but you will find the material far easier if you have them.

Building a useful index

An open-book exam rewards the candidate with the best index, not the thickest stack of books. Because answers cannot be changed after submission and time is tight, build your index around the eleven published domain headings, then add entries for tools, platform-specific terms, and the concepts you found hardest during practice. Create it yourself: the act of building the index is itself a learning exercise, and your own wording will be faster to scan under pressure than someone else's.

Be cautious with practice material. The exam rules prohibit materials resembling practice or exam questions and answers in the testing room, so keep your reference set to conceptual notes and book content. For a structured plan, see the GMOB Study Guide 2026, the GMOB Cheat Sheet, and our overview of GMOB training options. You can also pressure-test your recall with the GMOB practice tests.

Fees, Scheduling Window, and Renewal

All prices exclude applicable sales tax, and SANS training tuition is separate from these GIAC fees. The 120-day clock starts when your attempt is activated, so activate it only when your preparation is close to complete. Once the window closes, the attempt ends, which makes realistic scheduling more important than optimistic scheduling.

Staying certified

The certification is valid for four years. To renew, you earn 36 approved CPE credits during that active period or take a renewal exam, and in either case pay the standard USD $499 renewal fee. Renewal for a mobile security credential is more meaningful than it sounds: Android and iOS change quickly, and the CPE route rewards ongoing work in the field.

A complete breakdown of spending, including what is and is not included, is in GMOB Certification Cost 2026, and the eligibility details are in GMOB Requirements 2026.

Who Should Take It and Where It Fits

GMOB suits professionals who spend real time on mobile risk. Typical profiles include penetration testers extending into mobile application assessments, application security engineers reviewing Android and iOS builds, security analysts responsible for mobile fleets, and incident responders who encounter compromised or stolen devices. Anyone expected to assess an app against a verification standard such as MASVS will find the objectives directly relevant.

Employers that build, ship, or manage mobile applications and devices have an obvious need for this skill set. That includes organizations with mobile-first products, consultancies that perform application security testing for clients, and teams managing large device deployments. We deliberately avoid quoting specific earnings or hiring numbers here, since no verified figures are attached to this credential in the source material we use. For discussion of careers and value, see GMOB jobs, the GMOB salary guide, and whether GMOB is worth it. For observations on outcomes, GMOB pass rate discusses what can and cannot be said from available data.

Sequencing the Domains in a Study Plan

Generic study scheduling advice is everywhere; what is useful is ordering the GMOB domains so each builds on the last. One reasonable sequence follows, adjusted to your background.

Leave your final days for index refinement and timed practice, remembering that you will have under two minutes per question and no ability to change a submitted answer. Compress or stretch the weeks to fit the 120-day attempt window, and use the practice test site to find the domains where your recall is weakest.

Frequently Asked Questions