GCIH

GIAC's incident-handling cert, aligned with the SANS SEC504 course and built around hands-on detection and response to live attacks. It is one of GIAC's most widely held credentials; its more process-oriented rival is EC-Council's ECIH. SOC and incident-response staff make up most holders.