Cybersecurity Roadmap 2026: Beginner to Pro

Cybersecurity is one of the fastest-growing careers in 2026, but the path is scattered. This roadmap gives absolute beginners a concrete 12-month plan: what to learn, in what order, with what certifications, and what portfolio to build.

Months 1–2: Foundations

Networking fundamentals (TCP/IP, DNS, HTTP, TLS).
Linux basics + command line.
How the web works (HTTP, cookies, sessions, CORS).

Months 3–4: Scripting

Python for security (sockets, requests, scapy basics).
Bash scripting.
Version control (Git) + Linux CLI workflow.

Months 5–7: Defensive security

SIEM basics (Splunk / Elastic).
Log analysis + correlation.
Threat modelling + MITRE ATT&CK.

Months 8–10: Offensive security

OWASP Top 10.
Burp Suite, Nmap, Metasploit.
HackTheBox / TryHackMe labs.

Months 11–12: Certifications + portfolio

CompTIA Security+ — entry-level cert.
eJPT / PNPT — practical, beginner-friendly.
TryHackMe CPTS or OSCP — for the pentester path.
Portfolio: write-ups on HTB/THM boxes, a small CTF challenge, a blog series.

Pre-Month 1: set up your lab

Hardware — a laptop with 16 GB RAM, an SSD, and VT-x / AMD-V enabled in the BIOS.
Hypervisor — install VirtualBox or VMware Workstation; both are free for personal use.
Primary VMs — Kali Linux (attack tools), Ubuntu Server (target), Metasploitable 2 (deliberately vulnerable).
Cloud lab — a $5/month Hetzner or DigitalOcean box for off-network practice.

Why these tools first

Tools come and go; fundamentals stick. The roadmap invests months 1–4 in networking, Linux, and scripting before any hacking tool. That ordering pays off later: when Burp Suite throws an obscure error or a Python exploit fails on a Python 3.12 system, the foundations are what unblock you.

Networking — every exploit moves packets; you must read those packets.
Linux — most attack tools assume a Linux host.
Python — every CVE PoC is written in Python first; Bash alone is too slow.

Networking deep-dive resources

Professor Messer's Network+ — free video series, exam-aligned.
"Computer Networking: A Top-Down Approach" by Kurose & Ross — the standard textbook.
Wireshark labs — capture your own traffic, decode DNS, TLS, and HTTP/2 by hand.
TryHackMe's "Pre-Security" path — interactive labs for the absolute beginner.

Python for security — concrete projects

Port scanner — sockets, argparse, concurrency with `concurrent.futures`.
Subdomain brute-forcer — DNS over HTTPS, threading, output to JSON.
Simple keylogger — `pynput`, restricted to your own laptop, used to understand endpoint telemetry.
Burp extension — write a tiny extension that tags responses containing interesting headers.

HackTheBox vs TryHackMe — which first

Start on TryHackMe. The rooms are guided, walk-through friendly, and aligned to the beginner content in this roadmap. Move to HackTheBox once you can comfortably retire a THM room without hints. HackTheBox is closer to real-world targets and closer to the OSCP exam style.

TryHackMe — best for the first 6 months; structured learning paths, gamified XP.
HackTheBox Academy — modular courses, deeper than THM on a few topics.
HackTheBox Labs — full machines; tougher; OSCP-like.
PentesterLab — web app security specific; great complement to the above.

Beyond OSCP — next steps

CRTP — Active Directory attacks; high value for red team interviews.
OSWE — web app code review; for senior web app pentester roles.
OSEP — evasion and advanced exploitation; senior pentester track.
SANS SEC560 / SEC660 — premium training, expensive, recognised globally.

FAQ

Do I need a degree? No. Certs + portfolio + GitHub write-ups beat most CS degrees for this career.
Can I skip the certs? You can, but certs are how you get past HR filters. CompTIA Security+ is the cheapest first signal.
What's a realistic entry salary? Junior SOC analyst: $55–75k in the US. Junior pentester: $70–95k with OSCP. Senior pentester: $130k+.
Is AI changing the roadmap? Slightly. AI tools accelerate recon and code review, but fundamentals still matter — and "AI-assisted" is a real interview topic in 2026.

Day in the life and specialisation paths

A junior SOC analyst spends most of the day in a SIEM — Splunk, Elastic, or Sentinel — triaging alerts. A junior pentester runs scans against scope targets, manually probes the findings, and writes reports for clients. Both roles spend significant time in writing: reports, runbooks, and write-ups are how you communicate findings to non-technical stakeholders.

Specialisation paths — offensive (web app, network, cloud, mobile, red team), defensive (SOC, DFIR, threat intel, malware analysis), GRC (compliance, risk, audit), product security (AppSec, secure code review).
How to pick — try a THM room in each style; pick the one where you lose track of time.
Burnout — common. Set boundaries, rotate projects, and use PTO. SOC work especially burns analysts out from alert fatigue.

Tools to install on day one

Beyond Kali Linux, install these tools to get productive faster. They cover 80% of what you will touch in the first six months.

Reconnaissance — Nmap, masscan, subfinder, httpx, nuclei.
Web application — Burp Suite Community, OWASP ZAP, ffuf, gobuster.
Exploitation — Metasploit, searchsploit, CrackStation, hashcat, john.
Scripting — Python 3 with pwntools, requests, scapy. Bash for quick recon.
Reporting — Obsidian (notes), CherryTree (pentest engagement logs), a markdown report template you build over time.

Cybersecurity Roadmap 2026: From Beginner to Pentester

Months 1–2: Foundations

Months 3–4: Scripting

Months 5–7: Defensive security

Months 8–10: Offensive security

Months 11–12: Certifications + portfolio

Pre-Month 1: set up your lab

Why these tools first

Related Articles

CompTIA Security+ Exam Cost 2026: Full Breakdown

Reciprocity Pricing 2026: GRC Software Cost

AuditBoard Pricing 2026: GRC Platform Cost

OpenAI Daybreak vs Anthropic Glasswing: AI Cyber Coalitions

Related Training Programmes

Cyber Security Training

Cybersecurity Training

Try It in the Browser