What is the best ethical hacking roadmap for beginners?

The number that changes everything is the role you want at the end. A defender, a penetration tester, and a bug bounty hunter all start with the same three basics: Linux, networking, and Python. After that they split. Lab spending runs from $0 a month on free platforms to about $2,749 a year for one OffSec course with two exam attempts, and exam fees sit on top of that. By the end of this guide you will have a stage by stage ethical hacking roadmap, a real monthly budget, and the written permission rules that keep you out of trouble.

What does an ethical hacking roadmap look like in 2026?

An ethical hacking roadmap is a set of stages, not a pile of videos. Every stage ends with proof that you can do the work. That proof can be a finished lab, a written report, or a certificate a hiring manager recognizes.

Most beginners start in stage one with no target, and that is why they stall. Pick the lane first. A blue team lane teaches monitoring, logging, and incident response. A red team lane teaches exploitation and reporting. A bug bounty lane mixes the two and pays for the findings.

For the wider picture of the field, read What Is Cyber Security in 2026 Threats Frameworks and Basics. It explains the roles and the frameworks that a pentest report has to match. The Cybersecurity Roadmap 2026 From Beginner to Pentester page maps the whole career path, so you can see which credential your target job actually asks for.

The five stages

What should you learn in stage one?

Stage one looks boring and it decides everything else. You need to run Linux without fear, read a network packet, and write a small script that talks to a web server.

Linux comes first because almost every free security tool runs on it. Kali Linux is the usual choice because the tools arrive already installed. Networking comes second, because a scan only means something when you know the answer you should expect. Python comes third so you can automate the boring half of the work.

Here is a concrete example. A short Python script that opens a TCP connection to ten hosts on port 443 turns a weekend of manual checks into one command. That single skill is what turns a checklist into real testing.

You can finish most of stage one without spending a dollar. TryHackMe's free plan includes a one hour daily browser machine called AttackBox, and PortSwigger's Web Security Academy is free from the first lesson to the last. Your own router is also a legal lab, and Home Network Security 2026 20 Steps to Secure Your Wi-Fi shows you how to lock it down so your practice does not put your family at risk.

How much do labs and practice platforms cost in 2026?

Lab prices move, so check the vendor page on the day you buy. As of 2026, TryHackMe lists Premium at $11.19 a month when you pay for the year and $18.11 a month when you pay month to month. The MAX tier costs $18.99 a month billed yearly and adds advanced paths plus cloud labs.

OffSec sells private practice machines on its own. The Proving Grounds Practice plan starts at $19 a month and gives you dedicated machines that nobody else can reach while you work on them.

Start on the free tiers. A full year of TryHackMe Free and PortSwigger costs $0 and covers most of stage one and stage two. Paid plans earn their keep only once you need advanced rooms or a private machine.

Which certifications fit each stage?

One credential never fits every stage. An entry level certificate proves that you know the vocabulary and can follow a process. A practical certificate proves that you can break a machine under time pressure and write it up like a professional.

ISC2 lists its Certified in Cybersecurity exam at $199 in the Americas, which makes it a cheap first credential. For the next step up, our CEH Certification Cost 2026 EC-Council Fee Breakdown shows what the mid tier credential costs and what a retake adds.

For the hands-on tier, OffSec lists a Course and Cert Bundle at $1,749 with 90 days of lab access and one exam attempt. The Learn One plan costs $2,749 a year with 365 days of lab access and two attempts, while the entry level CyberCore plan is $899 with one year of access and two attempts.

EC-Council charges a $100 non-refundable application fee for the Certified Ethical Hacker exam and says the voucher price is set by the market rather than by the vendor. That is why a CEH budget needs a real breakdown, and our CEH cost page gives one for the self study route and the official training route.

Certs cost less than time does. A $199 exam that you fail twice costs more than the exam, so study the free material first and pay only when a practice test says you are ready.

How do bug bounty programs fit into the plan?

Bug bounties are the paid practice stage. A company publishes a scope, a set of rules, and a reward range on a platform such as HackerOne. You test only the targets inside that scope, and you write up what you find so the company can fix it.

Read the scope line by line. If a domain sits outside it, testing that domain can still be a legal problem even when you meant well. Every program page in the HackerOne directory lists its own scope and its own testing rules before you touch anything.

Income from bounties is uneven. Expect a run of reports that earn nothing before your first accepted one, so treat bounty work as paid training rather than as a salary. Teams also reward good writing, so send the report that explains the risk and the fix.

AI now shows up on both sides of the fence. AI Cybersecurity 2026 Defenders vs Attackers in Practice shows where models help a tester find bugs faster and where they help somebody else write a better scam. Knowing which is which is part of the job now.

What legal rules protect you as a beginner ethical hacker?

Three documents protect you: written permission, scope, and rules of engagement. They are not paperwork. They are the difference between a legal engagement and a federal crime.

Written permission means the owner of the system signs or emails a document that names you, the dates, and the systems you may test. Scope lists the exact addresses, domains, and applications you may touch and everything else you may not. Rules of engagement describe how to behave during the test: the hours, the emergency contact, what to do if you crash a server, and whether social engineering is allowed.

The National Institute of Standards and Technology publishes a free guide, SP 800-115, that shows how planning, rules of engagement, and reporting fit together in a real assessment. It is the best free reference for this side of the job.

Testing a system you do not own without permission can be a federal crime under the Computer Fraud and Abuse Act, even when you break nothing. If you want to practice on somebody else's system, pick a place where permission already exists, such as a bug bounty program or a built lab.

One last habit: keep records. Save the permission email, the scope, every command you ran, and every screenshot. If a question comes up months later, your notes are the answer.

Photo: StockSnap, Pixabay Content License, via Pixabay (https://pixabay.com/photos/code-technology-monitor-computer-2588957/)