A free, structured cybersecurity roadmap for beginners, career switchers, and IT pros in 2026. Networking and OS fundamentals, hands-on labs, certifications (Security+, CySA+, OSCP+, CISSP, CCSP, and the new SecAI+), specialization tracks (SOC/blue team, pentesting, cloud, GRC, IAM), salary data, and a realistic month-by-month study plan โ all with vetted, working links.
Welcome! ๐ This guide helps you navigate a path into cybersecurity, from foundational knowledge to practical experience and career tips. Whether you're a complete beginner, a career switcher, or an IT professional pivoting into security, this roadmap gives you a clear, structured path. Let's build a secure world together. ๐๐
Keywords: cybersecurity roadmap, learn cybersecurity 2026, how to become a cybersecurity analyst, SOC analyst path, penetration testing roadmap, cloud security career, cybersecurity certifications, CompTIA Security+, OSCP, CISSP, SecAI+, AI security, free cybersecurity resources.
๐ What's new in 2026: AI-driven attacks and defenses (including autonomous "agentic" AI), identity-first and Zero Trust architecture, non-human/machine identity, post-quantum cryptography readiness, deepfake-enabled social engineering, and cloud-native security are reshaping the field. This edition reflects those shifts โ and the certification landscape that changed alongside them.
This roadmap works for three kinds of people:
You don't need a degree. You do need consistency, hands-on practice, and a visible portfolio. Pick a track, follow the plan, and document everything publicly. Skills and a portfolio open more doors than credentials alone.
Before you can defend systems, you need to understand how they work. These foundational skills โ networking, operating systems, and core IT concepts โ are non-negotiable. Hiring managers consistently cite weak fundamentals as the biggest gap in entry-level candidates.
Networking Basics ๐ โ how devices share data and connect through networks.
Operating System Fundamentals ๐ฅ๏ธ โ how Windows and Linux internals work: process management, memory, permissions, the boot process.
Linux Essentials ๐ง โ most security tools (and most servers) run on Linux. Command-line fluency is mandatory.
TCP/IP Networking ๐ โ the protocol stack the entire internet runs on.
Introduction to Cybersecurity ๐ โ start with the why and the big picture.
CompTIA Network+ ๐ โ the industry-recognized credential validating your networking knowledge.
Virtualization Basics ๐ช๏ธ โ you'll spin up virtual labs constantly.
With the basics in place, dive into core security concepts and the tools security teams use every day.
Security Fundamentals
The CIA Triad & Core Principles โ Confidentiality, Integrity, Availability: the bedrock of every security decision.
Common Vulnerabilities โ ๏ธ
Threat Modeling & Attacker Mindset
Cybersecurity Frameworks ๐
Incident Response Fundamentals ๐จ
Introduction to Malware Analysis ๐ฆ
Phishing & Social Engineering Awareness ๐ง
Cryptography Basics ๐
Data Privacy & Compliance ๐
You don't need to be a software engineer, but you do need to read and write code. Automation, tooling, and analysis all live here.
Python ๐ โ the lingua franca of security tooling.
Bash & Shell Scripting ๐
PowerShell ๐ โ essential for Windows / Active Directory work.
Understanding code you'll see in the wild
Regular Expressions โ RegexOne (interactive)
After fundamentals, pick a track. Specialists tend to out-earn generalists, and most 2026 roles expect depth, not just breadth. Below are the major tracks with the certifications that signal expertise in each.
You'll do: monitor SIEM alerts, investigate incidents, respond to threats.
You'll do: simulate attacks to find weaknesses before real adversaries do.
You'll do: investigate breaches, recover evidence, write up what happened.
You'll do: map controls to frameworks, manage audits, translate security to business.
You'll do: design enterprise security, make build-vs-buy calls, run programs.
The fastest-growing specialization. Almost every org runs hybrid/multi-cloud now.
Identity is the new perimeter in 2026 โ and non-human / machine identity (service accounts, API keys, and AI agents) is now one of the fastest-growing attack surfaces.
Securing AI systems โ and using AI safely inside security operations โ is now its own career path.
These aren't fringe topics anymore โ they appear in mainstream job descriptions. Building familiarity here will set you apart.
AI Security & Adversarial ML ๐ง โ how attackers exploit AI systems (prompt injection, training-data poisoning, model extraction, jailbroken LLMs) and how defenders use AI for detection. In 2026, agentic AI โ autonomous agents that reason, plan, and act โ is being used on both sides: to automate parts of the attack kill chain, and to accelerate SOC triage and investigation. "Autonomous agent hijacking" is now a recognized attack category.
Deepfakes & AI-Enabled Social Engineering ๐ญ โ voice- and video-cloning are now routinely used in fraud and business-email-compromise. The defensive shift is toward contextual verification (out-of-band callbacks, code words, verifying intent) rather than trying to spot fakes visually.
Non-Human Identity (NHI) & Machine Identity ๐ค๐ชช โ service accounts, API keys, secrets, and AI-agent credentials now vastly outnumber human identities and are a top lateral-movement vector. Expect to see NHI governance in more job descriptions.
Zero Trust Architecture ๐ง โ "never trust, always verify." The replacement for perimeter-based security, now extended to devices, workloads, APIs, and AI systems.
Post-Quantum Cryptography (PQC) ๐ฎ โ NIST finalized its first three quantum-resistant standards in August 2024: ML-KEM (FIPS 203) for key exchange, ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures. HQC was selected as a backup KEM in March 2025, and a FALCON-based signature standard (FIPS 206) is in progress. "Harvest now, decrypt later" attacks make migration urgent.
Supply Chain & Software Bill of Materials (SBOM)
Container & Kubernetes Security
OT / ICS Security โ๏ธ โ securing industrial control systems and critical infrastructure. A high-paying specialization with a large talent gap.
Certifications open doors; hands-on skills get you hired. Hiring managers consistently say practical experience matters more than credentials alone.
A home lab is one of the best portfolio builders. Common setups:
Cybersecurity changes faster than any other IT discipline. Staying current is part of the job.
r/cybersecurity ยท r/netsec ยท r/AskNetsec ยท r/blueteamsec ยท r/redteamsec
Brian Krebs ยท Bruce Schneier ยท SwiftOnSecurity ยท Marcus Hutchins (MalwareTech) ยท Katie Nickels (threat intel) ยท John Hammond.
The ranges below are 2025โ2026 estimates and vary widely by experience, location, industry, and certifications. Always cross-check with current sources before making decisions.
| Job Role | Avg. Salary (PHP) | Avg. Salary (USD) | Avg. Salary (AUD) |
|---|---|---|---|
| SOC Analyst (Tier 1) | โฑ600,000 | $55,000โ$75,000 | AU$70,000 |
| Security Analyst | โฑ850,000 | $75,000โ$95,000 | AU$95,000 |
| Network Security Engineer | โฑ1,200,000 | $95,000โ$120,000 | AU$110,000 |
| Penetration Tester | โฑ1,100,000 | $90,000โ$130,000 | AU$115,000 |
| Incident Responder | โฑ1,300,000 | $100,000โ$140,000 | AU$125,000 |
| Forensic Analyst | โฑ1,150,000 | $85,000โ$115,000 | AU$105,000 |
| Malware Analyst | โฑ1,400,000 | $100,000โ$140,000 | AU$120,000 |
| Cloud Security Engineer | โฑ1,500,000 | $120,000โ$160,000 | AU$140,000 |
| AI Security Engineer | โฑ1,600,000 | $130,000โ$180,000 | AU$150,000 |
| Security Consultant | โฑ1,600,000 | $110,000โ$160,000 | AU$130,000 |
| GRC Analyst | โฑ1,000,000 | $85,000โ$115,000 | AU$105,000 |
| Security Architect | โฑ2,200,000 | $140,000โ$200,000 | AU$170,000 |
| CISO | โฑ4,000,000+ | $200,000โ$400,000+ | AU$250,000+ |
Market note (2026): the global cybersecurity workforce gap remains large (commonly cited around 4+ million unfilled roles), and AI-security roles are among the fastest-growing. Demand is strong, but entry-level competition has tightened โ hands-on skills and a visible portfolio matter more than ever.
Practice secure online behavior ๐ต๏ธ
Keep everything updated ๐ โ auto-update your OS, browser, and apps; subscribe to vendor security advisories for tools you rely on.
Secure your home network ๐ก๏ธ โ use WPA3 where possible, change default router credentials, segment IoT devices onto a guest network, and consider pfSense/OPNsense for serious labs.
Educate yourself daily ๐ โ 15 minutes of news plus one TryHackMe room a day adds up fast.
Use security tools ๐ง โ a VPN on untrusted networks, reputable EDR/antivirus, a password manager (mandatory), and DNS filtering (NextDNS, Cloudflare 1.1.1.1 for Families).
Practice hands-on ๐ป โ CTFs, home labs, write-ups. Document everything on GitHub โ your portfolio is your proof.
Join communities ๐ โ Discord servers, Reddit, local DEF CON groups, OWASP and ISC2 chapters.
Self-audit regularly ๐ โ review your digital footprint quarterly and run Have I Been Pwned checks.
A resume tells; a portfolio shows. At minimum: a clean GitHub with lab and CTF write-ups, a technical blog (Medium, Hashnode, or self-hosted), and documented home-lab projects.
Use keywords from the job description (ATS systems screen aggressively), quantify wins ("reduced false-positive alerts by 30%"), and put relevant certs up top.
You won't land Senior Pentester first. Realistic entry points: SOC Analyst Tier 1, Junior Security Analyst, IT Support โ Security pivot, Help Desk โ SOC pivot, GRC Analyst (often an easier entry for non-tech backgrounds), and internships/apprenticeships.
LinkedIn ยท Indeed ยท Glassdoor ยท CyberSecJobs ยท InfoSec Jobs ยท JobStreet (PH/SEA) ยท Kalibrr (PH) ยท Wellfound (startups)
Attend conferences (DEF CON, BSides, RSA, ROOTCON in PH), local meetups, and OWASP chapter events. On LinkedIn, comment thoughtfully โ don't just spam connections.
Common technical topics: networking (OSI/TCP), the cyber kill chain, MITRE ATT&CK, common attacks (XSS, SQLi, phishing), and IR basics. Behavioral: "tell me about a time you handled a difficult problem." Practical: many companies use scenario-based interviews or take-home labs.
Track applications in a spreadsheet, ask for feedback on rejections, and keep learning while you apply.
Certifications build credibility, validate knowledge, and unlock job filters โ but they don't replace experience. Be strategic about which ones you pursue.
A practical path for most beginners: Google Cybersecurity Cert โ Security+ โ CySA+ (or PenTest+) โ then a track cert (OSCP+ for offense, CCSP/SC-100 for cloud, CISA/CISM for GRC, SecAI+ for AI) โ CISSP once you have the experience.
A realistic plan. Adjust the pace to your schedule โ full-time learners can compress this; nights/weekends learners may stretch to 9โ12 months.
| Month | Focus Area | Activities | Resources |
|---|---|---|---|
| Month 1 | Networking + Linux | Set up a home lab in VirtualBox; install Ubuntu and Kali; complete networking basics; practice on the Linux CLI | Cisco NetAcad, Linux Journey, OverTheWire Bandit |
| Month 2 | Security fundamentals + CIA triad | Begin Security+ study; learn the CIA triad, AAA, common threats; skim NIST CSF 2.0 | Professor Messer Security+, NIST CSF |
| Month 3 | Threats, vulns & MITRE | Study OWASP Top 10 and MITRE ATT&CK; read recent breach case studies; learn ransomware, phishing, supply-chain, AI threats | OWASP Top 10, MITRE ATT&CK, Krebs on Security |
| Month 4 | Hands-on tools | Wireshark, Nmap, Burp Suite, Metasploit, basic Splunk/ELK; start the TryHackMe beginner path | TryHackMe, Wireshark, PortSwigger Academy |
| Month 5 | Practical skills + projects | Take the Security+ exam; build out your home lab (AD or SOC); complete your first CTFs; document everything on GitHub | Security+, DetectionLab, picoCTF, CTFtime |
| Month 6 | Specialize + network | Pick a track (SOC, pentest, cloud, GRC, AI security); attend a virtual conference or local meetup; polish LinkedIn; start applying | BSides, LinkedIn, r/cybersecurity |
Start with networking and Linux fundamentals, then Security+ concepts. Do one hands-on lab (TryHackMe) per day and document what you learn publicly on GitHub. Aim for a first role like SOC Analyst Tier 1, junior analyst, or a help-desk โ security pivot.
For most people, CompTIA Security+ is the best first cert โ it's widely required and satisfies DoD 8140. If budget is tight, the Google Cybersecurity Certificate is a strong, affordable starting point. Network+ first if you lack networking background.
No. The free "One Million Certified in Cybersecurity" program closed to new enrollments on May 20, 2026. The CC is now a standard paid exam (~$199 + $50 annual maintenance fee), and a refreshed exam outline takes effect September 1, 2026.
Take SY0-701 now if you're ready. It's proven, well-supported, and stays valid for three years regardless of version. Only wait for SY0-801 (expected to preview around late 2026, with new AI/LLM content) if you genuinely won't be ready until then or are targeting an AI-centric role.
You don't need to be a software engineer, but you should be able to read and write scripts. Learn Python first, then Bash, and PowerShell if you'll work with Windows/Active Directory.
No. A degree helps with some employers, but hands-on skills, a portfolio, and relevant certs are what most hiring managers actually screen for.
Cloud security, AI security (securing AI systems and defending against AI-enabled attacks), identity/IAM (including non-human/machine identity), and OT/ICS security โ all with significant talent gaps.
With consistent effort, many people go from zero to a first entry-level role in roughly 6โ12 months โ faster with prior IT experience, slower if studying part-time. The 6-month roadmap above is a realistic backbone.
Contributions are welcome! If you spot a broken link, an outdated fact, or have a resource to add, please open an issue or a pull request. Please keep resources free or clearly labeled, and prefer official/canonical sources.
If this roadmap helped you, please โญ the repo โ it helps others find it. Happy learning, and stay safe online! ๐๐
25 followers ยท starred Jan 2025
30 followers ยท starred Jan 2024
13 followers ยท starred Jan 2026
15 followers ยท starred Aug 2026
A free, structured cybersecurity roadmap for beginners, career switchers, and IT pros in 2026. Networking and OS fundamentals, hands-on labs, certifications (Security+, CySA+, OSCP+, CISSP, CCSP, and the new SecAI+), specialization tracks (SOC/blue team, pentesting, cloud, GRC, IAM), salary data, and a realistic month-by-month study plan โ all with vetted, working links.
Welcome! ๐ This guide helps you navigate a path into cybersecurity, from foundational knowledge to practical experience and career tips. Whether you're a complete beginner, a career switcher, or an IT professional pivoting into security, this roadmap gives you a clear, structured path. Let's build a secure world together. ๐๐
Keywords: cybersecurity roadmap, learn cybersecurity 2026, how to become a cybersecurity analyst, SOC analyst path, penetration testing roadmap, cloud security career, cybersecurity certifications, CompTIA Security+, OSCP, CISSP, SecAI+, AI security, free cybersecurity resources.
๐ What's new in 2026: AI-driven attacks and defenses (including autonomous "agentic" AI), identity-first and Zero Trust architecture, non-human/machine identity, post-quantum cryptography readiness, deepfake-enabled social engineering, and cloud-native security are reshaping the field. This edition reflects those shifts โ and the certification landscape that changed alongside them.
This roadmap works for three kinds of people:
You don't need a degree. You do need consistency, hands-on practice, and a visible portfolio. Pick a track, follow the plan, and document everything publicly. Skills and a portfolio open more doors than credentials alone.
Before you can defend systems, you need to understand how they work. These foundational skills โ networking, operating systems, and core IT concepts โ are non-negotiable. Hiring managers consistently cite weak fundamentals as the biggest gap in entry-level candidates.
Networking Basics ๐ โ how devices share data and connect through networks.
Operating System Fundamentals ๐ฅ๏ธ โ how Windows and Linux internals work: process management, memory, permissions, the boot process.
Linux Essentials ๐ง โ most security tools (and most servers) run on Linux. Command-line fluency is mandatory.
TCP/IP Networking ๐ โ the protocol stack the entire internet runs on.
Introduction to Cybersecurity ๐ โ start with the why and the big picture.
CompTIA Network+ ๐ โ the industry-recognized credential validating your networking knowledge.
Virtualization Basics ๐ช๏ธ โ you'll spin up virtual labs constantly.
With the basics in place, dive into core security concepts and the tools security teams use every day.
Security Fundamentals
The CIA Triad & Core Principles โ Confidentiality, Integrity, Availability: the bedrock of every security decision.
Common Vulnerabilities โ ๏ธ
Threat Modeling & Attacker Mindset
Cybersecurity Frameworks ๐
Incident Response Fundamentals ๐จ
Introduction to Malware Analysis ๐ฆ
Phishing & Social Engineering Awareness ๐ง
Cryptography Basics ๐
Data Privacy & Compliance ๐
You don't need to be a software engineer, but you do need to read and write code. Automation, tooling, and analysis all live here.
Python ๐ โ the lingua franca of security tooling.
Bash & Shell Scripting ๐
PowerShell ๐ โ essential for Windows / Active Directory work.
Understanding code you'll see in the wild
Regular Expressions โ RegexOne (interactive)
After fundamentals, pick a track. Specialists tend to out-earn generalists, and most 2026 roles expect depth, not just breadth. Below are the major tracks with the certifications that signal expertise in each.
You'll do: monitor SIEM alerts, investigate incidents, respond to threats.
You'll do: simulate attacks to find weaknesses before real adversaries do.
You'll do: investigate breaches, recover evidence, write up what happened.
You'll do: map controls to frameworks, manage audits, translate security to business.
You'll do: design enterprise security, make build-vs-buy calls, run programs.
The fastest-growing specialization. Almost every org runs hybrid/multi-cloud now.
Identity is the new perimeter in 2026 โ and non-human / machine identity (service accounts, API keys, and AI agents) is now one of the fastest-growing attack surfaces.
Securing AI systems โ and using AI safely inside security operations โ is now its own career path.
These aren't fringe topics anymore โ they appear in mainstream job descriptions. Building familiarity here will set you apart.
AI Security & Adversarial ML ๐ง โ how attackers exploit AI systems (prompt injection, training-data poisoning, model extraction, jailbroken LLMs) and how defenders use AI for detection. In 2026, agentic AI โ autonomous agents that reason, plan, and act โ is being used on both sides: to automate parts of the attack kill chain, and to accelerate SOC triage and investigation. "Autonomous agent hijacking" is now a recognized attack category.
Deepfakes & AI-Enabled Social Engineering ๐ญ โ voice- and video-cloning are now routinely used in fraud and business-email-compromise. The defensive shift is toward contextual verification (out-of-band callbacks, code words, verifying intent) rather than trying to spot fakes visually.
Non-Human Identity (NHI) & Machine Identity ๐ค๐ชช โ service accounts, API keys, secrets, and AI-agent credentials now vastly outnumber human identities and are a top lateral-movement vector. Expect to see NHI governance in more job descriptions.
Zero Trust Architecture ๐ง โ "never trust, always verify." The replacement for perimeter-based security, now extended to devices, workloads, APIs, and AI systems.
Post-Quantum Cryptography (PQC) ๐ฎ โ NIST finalized its first three quantum-resistant standards in August 2024: ML-KEM (FIPS 203) for key exchange, ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures. HQC was selected as a backup KEM in March 2025, and a FALCON-based signature standard (FIPS 206) is in progress. "Harvest now, decrypt later" attacks make migration urgent.
Supply Chain & Software Bill of Materials (SBOM)
Container & Kubernetes Security
OT / ICS Security โ๏ธ โ securing industrial control systems and critical infrastructure. A high-paying specialization with a large talent gap.
Certifications open doors; hands-on skills get you hired. Hiring managers consistently say practical experience matters more than credentials alone.
A home lab is one of the best portfolio builders. Common setups:
Cybersecurity changes faster than any other IT discipline. Staying current is part of the job.
r/cybersecurity ยท r/netsec ยท r/AskNetsec ยท r/blueteamsec ยท r/redteamsec
Brian Krebs ยท Bruce Schneier ยท SwiftOnSecurity ยท Marcus Hutchins (MalwareTech) ยท Katie Nickels (threat intel) ยท John Hammond.
The ranges below are 2025โ2026 estimates and vary widely by experience, location, industry, and certifications. Always cross-check with current sources before making decisions.
| Job Role | Avg. Salary (PHP) | Avg. Salary (USD) | Avg. Salary (AUD) |
|---|---|---|---|
| SOC Analyst (Tier 1) | โฑ600,000 | $55,000โ$75,000 | AU$70,000 |
| Security Analyst | โฑ850,000 | $75,000โ$95,000 | AU$95,000 |
| Network Security Engineer | โฑ1,200,000 | $95,000โ$120,000 | AU$110,000 |
| Penetration Tester | โฑ1,100,000 | $90,000โ$130,000 | AU$115,000 |
| Incident Responder | โฑ1,300,000 | $100,000โ$140,000 | AU$125,000 |
| Forensic Analyst | โฑ1,150,000 | $85,000โ$115,000 | AU$105,000 |
| Malware Analyst | โฑ1,400,000 | $100,000โ$140,000 | AU$120,000 |
| Cloud Security Engineer | โฑ1,500,000 | $120,000โ$160,000 | AU$140,000 |
| AI Security Engineer | โฑ1,600,000 | $130,000โ$180,000 | AU$150,000 |
| Security Consultant | โฑ1,600,000 | $110,000โ$160,000 | AU$130,000 |
| GRC Analyst | โฑ1,000,000 | $85,000โ$115,000 | AU$105,000 |
| Security Architect | โฑ2,200,000 | $140,000โ$200,000 | AU$170,000 |
| CISO | โฑ4,000,000+ | $200,000โ$400,000+ | AU$250,000+ |
Market note (2026): the global cybersecurity workforce gap remains large (commonly cited around 4+ million unfilled roles), and AI-security roles are among the fastest-growing. Demand is strong, but entry-level competition has tightened โ hands-on skills and a visible portfolio matter more than ever.
Practice secure online behavior ๐ต๏ธ
Keep everything updated ๐ โ auto-update your OS, browser, and apps; subscribe to vendor security advisories for tools you rely on.
Secure your home network ๐ก๏ธ โ use WPA3 where possible, change default router credentials, segment IoT devices onto a guest network, and consider pfSense/OPNsense for serious labs.
Educate yourself daily ๐ โ 15 minutes of news plus one TryHackMe room a day adds up fast.
Use security tools ๐ง โ a VPN on untrusted networks, reputable EDR/antivirus, a password manager (mandatory), and DNS filtering (NextDNS, Cloudflare 1.1.1.1 for Families).
Practice hands-on ๐ป โ CTFs, home labs, write-ups. Document everything on GitHub โ your portfolio is your proof.
Join communities ๐ โ Discord servers, Reddit, local DEF CON groups, OWASP and ISC2 chapters.
Self-audit regularly ๐ โ review your digital footprint quarterly and run Have I Been Pwned checks.
A resume tells; a portfolio shows. At minimum: a clean GitHub with lab and CTF write-ups, a technical blog (Medium, Hashnode, or self-hosted), and documented home-lab projects.
Use keywords from the job description (ATS systems screen aggressively), quantify wins ("reduced false-positive alerts by 30%"), and put relevant certs up top.
You won't land Senior Pentester first. Realistic entry points: SOC Analyst Tier 1, Junior Security Analyst, IT Support โ Security pivot, Help Desk โ SOC pivot, GRC Analyst (often an easier entry for non-tech backgrounds), and internships/apprenticeships.
LinkedIn ยท Indeed ยท Glassdoor ยท CyberSecJobs ยท InfoSec Jobs ยท JobStreet (PH/SEA) ยท Kalibrr (PH) ยท Wellfound (startups)
Attend conferences (DEF CON, BSides, RSA, ROOTCON in PH), local meetups, and OWASP chapter events. On LinkedIn, comment thoughtfully โ don't just spam connections.
Common technical topics: networking (OSI/TCP), the cyber kill chain, MITRE ATT&CK, common attacks (XSS, SQLi, phishing), and IR basics. Behavioral: "tell me about a time you handled a difficult problem." Practical: many companies use scenario-based interviews or take-home labs.
Track applications in a spreadsheet, ask for feedback on rejections, and keep learning while you apply.
Certifications build credibility, validate knowledge, and unlock job filters โ but they don't replace experience. Be strategic about which ones you pursue.
A practical path for most beginners: Google Cybersecurity Cert โ Security+ โ CySA+ (or PenTest+) โ then a track cert (OSCP+ for offense, CCSP/SC-100 for cloud, CISA/CISM for GRC, SecAI+ for AI) โ CISSP once you have the experience.
A realistic plan. Adjust the pace to your schedule โ full-time learners can compress this; nights/weekends learners may stretch to 9โ12 months.
| Month | Focus Area | Activities | Resources |
|---|---|---|---|
| Month 1 | Networking + Linux | Set up a home lab in VirtualBox; install Ubuntu and Kali; complete networking basics; practice on the Linux CLI | Cisco NetAcad, Linux Journey, OverTheWire Bandit |
| Month 2 | Security fundamentals + CIA triad | Begin Security+ study; learn the CIA triad, AAA, common threats; skim NIST CSF 2.0 | Professor Messer Security+, NIST CSF |
| Month 3 | Threats, vulns & MITRE | Study OWASP Top 10 and MITRE ATT&CK; read recent breach case studies; learn ransomware, phishing, supply-chain, AI threats | OWASP Top 10, MITRE ATT&CK, Krebs on Security |
| Month 4 | Hands-on tools | Wireshark, Nmap, Burp Suite, Metasploit, basic Splunk/ELK; start the TryHackMe beginner path | TryHackMe, Wireshark, PortSwigger Academy |
| Month 5 | Practical skills + projects | Take the Security+ exam; build out your home lab (AD or SOC); complete your first CTFs; document everything on GitHub | Security+, DetectionLab, picoCTF, CTFtime |
| Month 6 | Specialize + network | Pick a track (SOC, pentest, cloud, GRC, AI security); attend a virtual conference or local meetup; polish LinkedIn; start applying | BSides, LinkedIn, r/cybersecurity |
Start with networking and Linux fundamentals, then Security+ concepts. Do one hands-on lab (TryHackMe) per day and document what you learn publicly on GitHub. Aim for a first role like SOC Analyst Tier 1, junior analyst, or a help-desk โ security pivot.
For most people, CompTIA Security+ is the best first cert โ it's widely required and satisfies DoD 8140. If budget is tight, the Google Cybersecurity Certificate is a strong, affordable starting point. Network+ first if you lack networking background.
No. The free "One Million Certified in Cybersecurity" program closed to new enrollments on May 20, 2026. The CC is now a standard paid exam (~$199 + $50 annual maintenance fee), and a refreshed exam outline takes effect September 1, 2026.
Take SY0-701 now if you're ready. It's proven, well-supported, and stays valid for three years regardless of version. Only wait for SY0-801 (expected to preview around late 2026, with new AI/LLM content) if you genuinely won't be ready until then or are targeting an AI-centric role.
You don't need to be a software engineer, but you should be able to read and write scripts. Learn Python first, then Bash, and PowerShell if you'll work with Windows/Active Directory.
No. A degree helps with some employers, but hands-on skills, a portfolio, and relevant certs are what most hiring managers actually screen for.
Cloud security, AI security (securing AI systems and defending against AI-enabled attacks), identity/IAM (including non-human/machine identity), and OT/ICS security โ all with significant talent gaps.
With consistent effort, many people go from zero to a first entry-level role in roughly 6โ12 months โ faster with prior IT experience, slower if studying part-time. The 6-month roadmap above is a realistic backbone.
Contributions are welcome! If you spot a broken link, an outdated fact, or have a resource to add, please open an issue or a pull request. Please keep resources free or clearly labeled, and prefer official/canonical sources.
If this roadmap helped you, please โญ the repo โ it helps others find it. Happy learning, and stay safe online! ๐๐
25 followers ยท starred Jan 2025
30 followers ยท starred Jan 2024
13 followers ยท starred Jan 2026
15 followers ยท starred Aug 2026
