Skip to main content
qorionix

Academy

Five credentials, for the four people who actually touch this

Okta certifies people whose job is administering Okta. Our entire product thesis is that our customer employs nobody in that role — so this programme certifies the owner who runs it themselves, the generalist who owns security among five other jobs, the service provider running it across a portfolio, and the person answering the auditor.

Certifications
5
Modules and lessons
24 / 97
Hands-on exercises
40
Weighted exam domains
23

Delivered in the console

  • Courses in the console. Every module and lesson below is readable there, with progress tracked per lesson, at app.qorionix.com/academy (opens in a new tab).
  • The free practice exam (ZQ-100X): scenario items drawn from a published bank, unlimited retakes, scored immediately with the explanation for every item.
  • The four proctored exams, purchased in the console. Timed, one active attempt, scored against the published pass mark, retake wait enforced.
  • Credentials. A pass issues a numbered certificate with a public verification link; anyone can check holder, credential, dates, status and whether the sitting was proctored at /academy/verify.

Not yet

  • Proctoring by a person or a vendor. No proctoring provider is configured, so every proctored exam currently runs in honour mode and issues a credential marked proctored: no. Identity verification and an appeals process arrive with the provider.
  • Every item format and every item count in the blueprints. The exams currently serve single-answer scenario items: each proctored attempt draws forty items from a bank of forty-five, and each practice attempt uses the twenty-item practice bank. The published blueprints describe the full planned assessments; the multiple-response, ordering, case-study and human-scored free-response items the blueprints describe are not yet delivered, and the delivery attestation and design submission for the partner credentials are reviewed by hand.
  • Scaled scoring. Pass marks are raw percentages until an item bank has been through psychometric review, as the blueprint pages explain.
  • A practice tenant. Every lab assumes you have your own Qorionix tenant, because a shared sandbox does not exist.
  • Languages other than English, and any partner tier or discount tied to a credential.

If you are a service provider weighing whether to build a practice on this, the single most useful thing you can do now is tell us which of the five credentials you would put people through first, and how many. That changes the order this gets built in, and nothing else does. Write to [email protected] (opens in a new tab).

Who we designed for, and why each one is here

Every credential in this programme exists for one of these four people. Where a persona would have produced a credential nobody would sit — a developer track, for instance — we left it out and said so rather than filling a matrix.

OperatorOwner, office manager, practice manager — the person who signed up

What they want. Get to a state where they can look at the platform once a day, know whether anything needs them, and answer their insurer or their largest customer when asked what they do about security.

Why we certify them. This person is the reason the product exists. A customer who cannot operate it churns at renewal regardless of how good the detection is, and every question they cannot answer themselves becomes a support ticket. Confidence is the deliverable, not depth.

The constraint. Must be free, must be under two hours, and must never require a command line or a second product. If it cannot be completed in the gaps of a working week, it will not be completed.

IT generalistThe one IT person at a 100–500 person company, who also owns security

What they want. Configure the platform properly once, deploy the sensor to a real fleet, tune what needs tuning, and be able to defend a decision to a manager who read something alarming in the press.

Why we certify them. This is the largest population of people who will touch the console daily, and the one most likely to misconfigure something consequential — an autonomy tier, a network zone, a sign-on policy — because they are competent but not a specialist. Certifying them is the highest-leverage reduction in both risk and support load.

The constraint. Must assume real competence and no security specialism. Do not explain what MFA is; do explain why step-up is the only response action safe to automate.

MSP or MSSP technicianService-desk or security engineer at a managed service provider, running many tenants

What they want. Onboard a new customer to a repeatable standard, run a monthly review across a portfolio, and know which tenant-specific oddities are real problems and which are the product behaving correctly.

Why we certify them. Commercially the most important learner in the set. The go-to-market research identifies MSPs as a real route to the European SMB market, and a channel cannot scale on our own delivery capacity. Certification is how a partner's practice becomes independent of us, and how a customer can tell one partner from another.

The constraint. Must be honest about the multi-tenant gaps rather than teaching around them. A technician who discovers in front of a customer that something we implied works does not is a partner we have lost, and they talk to other partners.

Compliance and auditCompliance officer, DPO, virtual CISO, or the auditor on the other side of the table

What they want. Produce or evaluate evidence that stands up: NIS2 Article 21 measures, a 24-hour early warning, access certification records, a GDPR data-subject response, and an audit trail whose integrity can be demonstrated rather than asserted.

Why we certify them. Compliance is the primary security investment driver for 70% of EU organisations, ahead of any threat, so the evidence path is a genuine buying reason rather than a feature. A credential here also gives the vCISO and small consultancy population — who advise many SMBs but administer none — something to hold.

The constraint. Must not teach that the software makes anybody compliant, and must teach the failure modes of evidence: what a hash-chain verification failure means, and what a skipped check is and is not.

The credentials

Foundation

Free and short. For the person who operates the platform in a company with no security staff.

Professional

The main technical credential, for the generalist who owns security among several other jobs.

Specialist

Parallel to Professional rather than above it. Depth in evidence and audit instead of breadth in configuration.

Partner

For MSPs and consultancies delivering this to other people's businesses. Both carry a delivery requirement alongside the exam.

Prerequisites, and recertification

One entry point, then a fork. The specialist track runs beside the professional one rather than above it, because an auditor and an administrator need different depth, not different amounts of the same thing.

Each credential, what it needs first, how long it lasts and how it renews
CredentialRequiresValid forRenewalPrice
ZQ-100 OperatorNothing24 monthsA free fifteen-item reassessment, unproctored, in your browser, covering what changed in the product since you passed.Free, permanently
ZQ-200 AdministratorZQ-10012 monthsA free twenty-item renewal assessment, unproctored, delta-scoped: it tests what changed in the twelve months since you passed, not the whole blueprint again.€150 for the exam; the course free
ZQ-250 Evidence and Audit AnalystZQ-10012 monthsA free renewal assessment, annually, with a regulatory-delta section.€150 for the exam; the course free
ZQ-300 Multi-Tenant EngineerZQ-20012 monthsA free annual renewal assessment, plus a delivery attestation: two tenants onboarded or maintained in the period, or one incident written up.€250 for the exam
ZQ-400 Delivery ArchitectZQ-30024 monthsTwenty-four months, by submitting a real deployment design — customer details redacted — for review against the same rubric the exam uses, plus a short renewal assessment.€350, including the design review

The courses

Learning is free in every case; only the proctored exams are paid, and there is no paid study guide behind any of them. Microsoft runs that split cleanly and it is the one we copied. Okta runs it only for its self-paced tier — its instructor-led courses reach $2,775 a seat and its all-access learning pass $2,500 a year — and we would rather have more people who can operate the product than a training revenue line.

Why the programme is shaped this way

Published rather than kept in a design document, on the same reasoning as the claims we refuse to make: a programme whose reasoning is visible is one a partner can hold us to.