software AM market analysis — 2026-10-30

Coverage of software-security certifications this morning points to a market that is sorting credentials by purpose rather than treating them as interchangeable. Security+, CEH and OSCP are being positioned for distinct career stages: foundational knowledge, recruiter-facing recognition and demonstrated hands-on skill respectively, according to Ciphers Security. Cybersteps reinforces the CEH picture, noting it remains widely recognised among recruiters and compliance-focused employers even as technical hiring managers increasingly question whether its knowledge-heavy exam format proves practical ability.

A second theme running through the sources is that certification value is contextual rather than fixed. ExamCert’s analysis ties CEH’s worth directly to the target role, the employer’s specific requirements and whether the candidate pairs the credential with demonstrable experience. Cybersteps also flags that recent CEH updates have added AI-related attack and defence content, which it frames as a response to growing expectations that security professionals understand AI-enabled threats.

Taken together, the coverage describes a credentialing landscape that is becoming more segmented rather than more standardised. Employers appear to be differentiating between certifications used for compliance and screening purposes and those used as evidence of practical capability, with experience and portfolio work cited repeatedly as the deciding factor over the certificate itself.