SA-APEX · open decisions

What we haven’t decided yet.

Certification bodies do not usually publish this. We are publishing it because a design target presented as a settled number is the first dishonest thing a trust program can do — and because you deserve to know which parts of this are firm and which are still moving.

Program version 1.0.0-pilot
11 open items

Why this page exists

Security Arsenal publishes real prices for everything else it sells, while most of the industry hides them. The same instinct applies here. We would rather show you an honest gap than a confident-sounding number we cannot yet support.

Every item below is decided by evidence — a standard-setting panel, pilot data, or a legal review — not by what would convert best on a landing page.

The log

Each item, our starting point, and where it stands.

Open program decisions
Decision	Our starting point	Status
Final name and mark	SA-APEX, subject to trademark clearance.	In legal review
Experience minimum	Three years recommended, with an evidence-based exception route.	Open
Language threshold	Three languages across scripting, systems and application categories. Substance over labels.	Open
Exam length and scheduling	A multi-block exam over a scheduled window. Exact durations come from pilot data, not from a marketing page.	Set by pilot data
Pass standard	An overall minimum plus every domain minimum, the manual gate and the critical-miss rule. The numbers are set by a standard-setting panel, not by us.	Set by pilot data
Credential term	Three years with a practical renewal requirement.	Open
Proctoring model	Controlled remote environment plus oral defense, pending a recording privacy review.	In legal review
Price and refunds	Not set until delivery cost, eligibility review, retest and support models are known. We publish prices for everything else we sell and we will publish this one — when it is real.	Open
Recognised prior credentials	OSEE for the manual foundation gate only. Other credentials considered on evidence.	Open
Accreditation	Designed with ISO/IEC 17024 alignment in mind. No conformity claim is made, and none will be until it is formally established.	Open
Launch geography	Wherever contracts, privacy, tax, sanctions and accommodations can all be supported.	Open

What is settled

These are not moving.

The manual gate is non-compensable.

If you cannot do the engagement without AI, no score elsewhere carries you. This is the reason the credential exists and it is not up for negotiation.

You build the estate, and you attack a different one.

The build phase is not an optional module and it is not waived by any prior credential. You cannot break what you cannot build.

A leak of protected data ends the attempt.

There is no score high enough to carry a candidate past a client-data failure, because there is no client who would accept that trade.

Course completion is never certification.

Separate names, separate records, separate badges, separate pages. Anyone presenting one as the other is misrepresenting the credential.

It is open to people who work for our competitors.

When an AI-assisted test is wrong, the client carries the risk. That does not improve if the standard of care lives inside one company.

Tell us we are wrong

This log is open to challenge.

If you are a practitioner and you think one of these starting points is set wrong — the experience baseline, the language threshold, which prior credentials should be recognised, what the build phase should require — write to apex@securityarsenal.com and make the argument. The pilot exists to find out where we are wrong, and it is cheaper to hear it now than after a hundred people have sat the exam.