SA-APEX · recognised prior work
You’ve proven the exploitation. Prove the rest.
- One phase waived
- Build phase required
- Voice required
- Development required
- Every AI phase required
Independence notice
Security Arsenal recognises OSEE as evidence for our manual foundation gate. This is our own admissions decision. It is not a partnership, endorsement, affiliation or articulation agreement with OffSec, and it confers nothing on their behalf.
What comes off
Phase A — the manual foundation gate.
Phase A exists to establish that everything measured afterwards is amplification of real skill rather than a substitute for it. An OSEE holder has already established that under exam conditions, against a standard we respect. Repeating it would cost you days and tell us nothing new.
Phase A — Manual foundation
Waived on a verified bridgeManual exploitation, code modification, attack-path notes, live spot checks.
What does not come off
Four things, and each of them is deliberate.
Building the estate
OSEE proves exploitation depth. It does not ask whether you can stand up the cloud, virtualisation, routing, perimeter and endpoint estate that the exploitation happens inside. You can not break what you can not build.
Voice
Telephony is outside the OSEE syllabus and it is consistently one of the softest surfaces in a real estate. You build the platform and you are tested on it.
Software development
Windows exploit development is not the same skill as building, hardening and operating a multi-agent testing application with policy enforcement and evidence handling. Both are required here.
Every AI phase
The whole reason this credential exists is the AI side. None of it is waived — architecture, tooling, data protection, evidence discipline, reporting and the oral defense are all still on the table.
The principle behind all four
You can’t break what you can’t build. Exploit development proves you can take something apart. It does not prove you can stand up the cloud, the hypervisors, the routed core, the perimeter, the directory, the endpoint fleet and the phone system that the thing you are taking apart lives inside — and in a real engagement, that understanding is what tells you where to look.
Your exam
What the bridge route actually looks like.
Phase B: Build the estate
Allowed through the controlled gatewayDesign, build and configure a full enterprise estate from bare metal up.
Phase C: Build the tooling
Approved sandbox onlyA bare Kali server and an AI API token. Nothing else.
Phase D: Attack a different estate
Allowed through the controlled gatewayYou built one. Now break one you have never seen.
Phase E: Reporting
Allowed, fully loggedEvidence-locked reports, plus a full account of what you did with AI.
Phase F: Oral defense
AI disabledExplain it live, with the models off.
Note that the oral defense is not waived and is not softened. The board still samples your code, your commands, your findings and your report language, with the models off.
How to claim it
Verification first, waiver second.
| Step | What happens |
|---|---|
| 1. Apply | Choose the bridge route on the application and give your OSEE certification number and issue date. |
| 2. Verification | The certification number is verified with the issuing body before the waiver is applied. An unverified number is treated as no bridge. |
| 3. Review | The rest of your application is assessed exactly as any other — build experience, development, voice, AI engineering and data governance. |
| 4. Waiver recorded | If verified, the waiver is written to your candidate record with the approver and the date. It cannot be granted retroactively by editing an application afterwards. |
| 5. Everything else | You sit every remaining phase in full. |
If verification fails
An unverified certification number is treated as no bridge at all — you sit Phase A like everyone else. A number submitted that turns out not to belong to you ends the application, and we say so plainly rather than quietly declining.
Other credentials
Why the list has one entry on it.
OSEE is currently the only credential we recognise for this gate, because it is the only one we are confident measures manual exploitation at the depth the gate is set to. If you hold something you believe clears the same bar, tell us in your application and make the case — the list is a judgement, not a fixed law.
We would rather have a short, defensible list than a long one that makes SA-APEX easier to get than it should be. If the list grows, it will be because a specific credential was reviewed against the specific thing Phase A measures — not because it is well known.