APEX · open decisions
What we haven’t decided yet.
- Program version 1.3.0
- 9 open items
Why this page exists
Security Arsenal publishes real prices for everything else it sells, while most of the industry hides them. The same instinct applies here. We would rather show you an honest gap than a confident-sounding number we cannot yet support.
Every item below is decided by evidence — a standard-setting panel, pilot data, or a legal review — not by what would convert best on a landing page.
The log
Each item, our starting point, and where it stands.
| Decision | Our starting point | Status |
|---|---|---|
| Final name and mark | APEX, subject to trademark clearance. | In legal review |
| Experience minimum | Three years recommended, with an evidence-based exception route. | Open |
| Language threshold | Three languages across scripting, systems and application categories. Substance over labels. | Open |
| Exam length and scheduling | A multi-block exam over a scheduled window. Exact durations are published once enough exams have run to state them honestly. | Open |
| Pass standard | An overall minimum plus every domain minimum, the manual gate and the critical-miss rule. The numbers are set by a standard-setting panel, not by us. | Open |
| Credential term | Settled at two years. Renewal is evidence of continued work plus a short assessment on what changed — not a repeat of the exam. | Settled and published |
| Proctoring model | Controlled remote environment plus oral defense, pending a recording privacy review. | In legal review |
| Price and refunds | Settled and published. Exam, course, bundle, retakes and cohort rates are on the pricing page, along with the reason the exam costs what it does. | Settled and published |
| Recognized prior credentials | OSEE for the manual foundation gate only. Other credentials considered on evidence. | Open |
| Accreditation | Designed with ISO/IEC 17024 alignment in mind. No conformity claim is made, and none will be until it is formally established. | Open |
| Launch geography | Wherever contracts, privacy, tax, sanctions and accommodations can all be supported. | Open |
What is settled
These are not moving.
The manual gate is non-compensable.
If you cannot do the engagement without AI, no score elsewhere carries you. This is the reason the credential exists and it is not up for negotiation.
You build the infrastructure, and you attack a different one.
The build phase is not an optional module and it is not waived by any prior credential. You cannot break what you cannot build.
A leak of protected data ends the attempt.
There is no score high enough to carry a candidate past a client-data failure, because there is no client who would accept that trade.
Course completion is never certification.
Separate names, separate records, separate badges, separate pages. Anyone presenting one as the other is misrepresenting the credential.
It is open to people who work for our competitors.
When an AI-assisted test is wrong, the client carries the risk. That does not improve if the standard of care lives inside one company.
Tell us we are wrong
This log is open to challenge.
If you are a practitioner and you think one of these starting points is set wrong — the experience baseline, the language threshold, which prior credentials should be recognized, what the build phase should require — write to apex@securityarsenal.com and make the argument. The pilot exists to find out where we are wrong, and it is cheaper to hear it now than after a hundred people have sat the exam.