Cybersecurity is one of the fastest-growing careers in 2026, but the path is scattered. This roadmap gives absolute beginners a concrete 12-month plan: what to learn, in what order, with what certifications, and what portfolio to build.
Months 1–2: Foundations
- Networking fundamentals (TCP/IP, DNS, HTTP, TLS).
- Linux basics + command line.
- How the web works (HTTP, cookies, sessions, CORS).
Months 3–4: Scripting
- Python for security (sockets, requests, scapy basics).
- Bash scripting.
- Version control (Git) + Linux CLI workflow.
Months 5–7: Defensive security
- SIEM basics (Splunk / Elastic).
- Log analysis + correlation.
- Threat modelling + MITRE ATT&CK.
Months 8–10: Offensive security
- OWASP Top 10.
- Burp Suite, Nmap, Metasploit.
- HackTheBox / TryHackMe labs.
Months 11–12: Certifications + portfolio
- CompTIA Security+ — entry-level cert.
- eJPT / PNPT — practical, beginner-friendly.
- TryHackMe CPTS or OSCP — for the pentester path.
- Portfolio: write-ups on HTB/THM boxes, a small CTF challenge, a blog series.
Pre-Month 1: set up your lab
- Hardware — a laptop with 16 GB RAM, an SSD, and VT-x / AMD-V enabled in the BIOS.
- Hypervisor — install VirtualBox or VMware Workstation; both are free for personal use.
- Primary VMs — Kali Linux (attack tools), Ubuntu Server (target), Metasploitable 2 (deliberately vulnerable).
- Cloud lab — a $5/month Hetzner or DigitalOcean box for off-network practice.
Why these tools first
Tools come and go; fundamentals stick. The roadmap invests months 1–4 in networking, Linux, and scripting before any hacking tool. That ordering pays off later: when Burp Suite throws an obscure error or a Python exploit fails on a Python 3.12 system, the foundations are what unblock you.
- Networking — every exploit moves packets; you must read those packets.
- Linux — most attack tools assume a Linux host.
- Python — every CVE PoC is written in Python first; Bash alone is too slow.
Networking deep-dive resources
- Professor Messer's Network+ — free video series, exam-aligned.
- "Computer Networking: A Top-Down Approach" by Kurose & Ross — the standard textbook.
- Wireshark labs — capture your own traffic, decode DNS, TLS, and HTTP/2 by hand.
- TryHackMe's "Pre-Security" path — interactive labs for the absolute beginner.
Python for security — concrete projects
- Port scanner — sockets, argparse, concurrency with `concurrent.futures`.
- Subdomain brute-forcer — DNS over HTTPS, threading, output to JSON.
- Simple keylogger — `pynput`, restricted to your own laptop, used to understand endpoint telemetry.
- Burp extension — write a tiny extension that tags responses containing interesting headers.
HackTheBox vs TryHackMe — which first
Start on TryHackMe. The rooms are guided, walk-through friendly, and aligned to the beginner content in this roadmap. Move to HackTheBox once you can comfortably retire a THM room without hints. HackTheBox is closer to real-world targets and closer to the OSCP exam style.
- TryHackMe — best for the first 6 months; structured learning paths, gamified XP.
- HackTheBox Academy — modular courses, deeper than THM on a few topics.
- HackTheBox Labs — full machines; tougher; OSCP-like.
- PentesterLab — web app security specific; great complement to the above.
Beyond OSCP — next steps
- CRTP — Active Directory attacks; high value for red team interviews.
- OSWE — web app code review; for senior web app pentester roles.
- OSEP — evasion and advanced exploitation; senior pentester track.
- SANS SEC560 / SEC660 — premium training, expensive, recognised globally.
FAQ
- Do I need a degree? No. Certs + portfolio + GitHub write-ups beat most CS degrees for this career.
- Can I skip the certs? You can, but certs are how you get past HR filters. CompTIA Security+ is the cheapest first signal.
- What's a realistic entry salary? Junior SOC analyst: $55–75k in the US. Junior pentester: $70–95k with OSCP. Senior pentester: $130k+.
- Is AI changing the roadmap? Slightly. AI tools accelerate recon and code review, but fundamentals still matter — and "AI-assisted" is a real interview topic in 2026.
Day in the life and specialisation paths
A junior SOC analyst spends most of the day in a SIEM — Splunk, Elastic, or Sentinel — triaging alerts. A junior pentester runs scans against scope targets, manually probes the findings, and writes reports for clients. Both roles spend significant time in writing: reports, runbooks, and write-ups are how you communicate findings to non-technical stakeholders.
- Specialisation paths — offensive (web app, network, cloud, mobile, red team), defensive (SOC, DFIR, threat intel, malware analysis), GRC (compliance, risk, audit), product security (AppSec, secure code review).
- How to pick — try a THM room in each style; pick the one where you lose track of time.
- Burnout — common. Set boundaries, rotate projects, and use PTO. SOC work especially burns analysts out from alert fatigue.
Tools to install on day one
Beyond Kali Linux, install these tools to get productive faster. They cover 80% of what you will touch in the first six months.
- Reconnaissance — Nmap, masscan, subfinder, httpx, nuclei.
- Web application — Burp Suite Community, OWASP ZAP, ffuf, gobuster.
- Exploitation — Metasploit, searchsploit, CrackStation, hashcat, john.
- Scripting — Python 3 with pwntools, requests, scapy. Bash for quick recon.
- Reporting — Obsidian (notes), CherryTree (pentest engagement logs), a markdown report template you build over time.
