Skip to main content
All observations
Observation

Cert Stacking

Candidates keep adding the next cert in a vendor ladder instead of doing the work the previous cert implied, then walk into interviews where the gap between paper progression and operational evidence is the first thing the panel tests.

Also called: paper ladder, the next-cert reflex, studied not worked.

The same shape keeps turning up in cert verdicts and on CVs. Somebody adds the next cert in a vendor ladder instead of doing the work the previous cert implied, then walks into an interview where the gap between paper progression and operational evidence is the first thing the panel tests. The CV reads like a study plan. The interview reads like a confession.

What we keep noticing

Network+ then Security+ then A+ from a candidate who has not touched real kit. Security+ then CySA+ from a candidate who has not sat in front of a SIEM. AZ-104 straight into AZ-305 from a candidate who has not designed a Landing Zone. Terraform Associate stacked on AWS SAA with no public module repo. Four different domains, the same structural move. The next cert was the cheapest legible action the candidate had, so they took it.

Recruiters see the pattern before the interview starts. The CV header sequences three or four certs from the same vendor family with no production artefacts between them. The covering note explains that the candidate is “working towards” the role. The interview loop is built around the question the certs were a substitute for.

Why it keeps happening

Certs are the most legible thing a candidate can do in a week. The exam books, the syllabus is finite, the badge appears on Credly the next morning. Building a public artefact, running a home lab properly, or negotiating adjacent wedge work inside the current role are all slower, less ordered, and harder to tick off. When somebody is locked into a current role that will not give them the exposure they need, the cert plan is the only plan they can actually start on a Tuesday evening.

The first cert in a new direction earns its place. It clears the keyword filter and forces the vocabulary. The second one earns its place if it goes a layer deeper into the same lane. By the third and fourth, the return collapses. The CV already says “serious about this domain, no production yet” and another exam does not change what the hiring manager reads.

What this observation predicts

A CV with four or more certs from one vendor family and no public artefacts will get fewer first-round invites than the same CV with two certs and one repo. In the rounds it does land, it loses on the first scenario question that asks the candidate to describe a real incident, a real design tradeoff, or a real production failure. The candidate is then surprised, because each cert felt like progress when they passed it.

On the cert side, the stack itself becomes the rejection signal. The Sec+-plus-CySA+-without-a-SIEM pattern is the most common rejection on UK SOC shortlists. The AZ-104-straight-to-AZ-305 leap is the most common reason Microsoft-stack architect candidates fail the second-round interview. These are not edge cases. They are what the cert market verdicts at /certifications are tracking in aggregate.

What it doesn't predict

Stacks that are paid for by a current employer and stacked alongside the work the certs describe are a different thing. The cert is documenting work that already happened. Some government and defence pathways genuinely gate on the stack, where the cert is doing clearance work rather than signalling work, and the candidate has to clear it. And a candidate using a cert as a forcing function to learn something they would have studied anyway, like CKA when they have never touched Kubernetes, is using the exam as scaffolding for learning, not as a substitute for it.

The pattern this observation names is the one where the next cert is bought instead of the work the previous cert implied, not every CV with several certs on it.

Where this connects on POST

The companion essay, when you can't earn experience, cert stacking becomes the trap, is the prescriptive version for candidates who are locked into a current role and can see themselves doing it. The wider argument for why one or two certs is leverage and five isn't lives in certifications don't prove competence, they prove direction. The verdict-side instances are visible on the individual cert pages, most clearly on CySA+, AZ-305 and Terraform Associate.

The live surfaces where this pattern is doing real work. Watching it land in different places is how you start recognising it yourself.