Every number here has a page and a date behind it
This is the method, written down so you can hold us to it: which sources count, what happens when a body publishes nothing, and the things we have decided never to print.
Rule one: the body, or nobody
Exam fees, question counts, time limits, passing scores, domain weightings, experience requirements and renewal rules come from the organisation that issues the certification, on its own website, on a date we record. ISC2 for CISSP, CCSP and Certified in Cybersecurity. CompTIA for Security+. ISACA for CISM. OffSec for OSCP. EC-Council for CEH.
A training provider's summary of an exam is marketing, however accurate it happens to be. It is not a source, and it is never the source cited on a page here.
Rule two: unverified means absent, not hedged
When a body does not publish something, we say so and stop. We do not write “around” or “typically” or “reportedly”, because a hedge still reads as a fact to somebody skimming.
Three live examples from this site. CompTIA's store product pages redirect to a certifications index and its own cost article carries no figure, so no Security+ voucher price appears anywhere here. ISACA does not publish CISM's question count, duration, scaled passing score or domain weightings on the pages we read, so none of those appear. EC-Council does not publish a CEH price on its certification page, so we do not quote one.
Rule three: no pass rates, ever
No pass rate for any exam appears on Hardenstep. ISC2 does not publish one for CISSP, CompTIA does not publish one for Security+, and ISACA does not publish one for CISM. The percentages in circulation come from training companies, and an invented number reads exactly like a cited one once it is on a page.
The same applies to study hours, difficulty scores and “most candidates” claims. If nobody measured it, nobody should be quoting it.
Rule four: one salary figure, from one source
Neither ISC2 nor ISACA publishes salary by credential, so this site carries no CISSP salary, no CISM salary and no Security+ salary. Where a figure about earnings is genuinely useful, we use the US Bureau of Labor Statistics Occupational Outlook Handbook and name the occupation, the amount and the date: a median of $129,180 a year for information security analysts as of May 2025, with 21% growth projected for 2025–35, on a page last modified 27 August 2026.
Rule five: prices are dated, and price changes are news
Every price on this site carries the date it was read, because training prices move constantly and exam fees move without announcement. Where a provider has announced a change, we print both numbers and the date the new one starts — as with Hack The Box, whose Academy plans change on 12 October 2026.
Where a page is served in a currency other than dollars because of where our request came from, we say so rather than convert silently.
Rule six: the charts cannot disagree with the words
Every figure drawn on this site is generated from the same numbers the page prints in its prose, and the build checks that the sentences a chart depends on are still there. Edit a fee in the copy and forget the chart, and the site fails to build rather than shipping a picture that contradicts the paragraph beside it. It is a small mechanism, and it has already caught the kind of drift that otherwise survives for years.
Rule seven: the score out of ten is a judgement, and says so
A few pages carry a box with a number out of ten in it. That number is an editorial judgement about value for money for the specific reader named beside it — not a measurement, not a test result, and not comparable with anybody else's score. There is no formula behind it, and we are not going to invent one to make it look rigorous.
Wherever it appears it sits next to the reader it is about, the things the purchase buys and the things it costs, and those lists are what you should weigh rather than the digit. Nothing here scores a certification itself — we score routes and purchases, because a certification's worth depends on the job you are trying to get and we cannot see that from where we are sitting.
What we get wrong
Dates. A fee read in September is a fee that was true in September, and bodies reprice without notice. If the body's page and this page disagree, the body is right. Every page here carries the source links so you can check in the time it takes to open a tab — and if you find something stale, tell us and we will re-read it.