How to Learn Cybersecurity: A Beginner Roadmap
To learn cybersecurity, build the base first (networks, one operating system, logs), learn the core security ideas, then practise on hands-on labs before you pick a specialism and a certification. The order matters: people who start with tools and skip the base tend to memorise commands they cannot explain.
This roadmap has six stages. Each says what to learn, how to practise it and how to know you are done. It is a plan for an absolute beginner; if you already work in IT, skip to stage 3.
Updated 3 November 2026
The six-stage roadmap
| Stage | Learn | You are done when |
|---|---|---|
| 1. Computing base | How a computer boots, files and permissions, processes, one command line. | You can explain where an operating system writes its logs. |
| 2. Networking base | IP addressing, DNS, TCP vs UDP, ports, HTTP, what a firewall does. | You can explain what happens when you open a web page. |
| 3. Security core | Confidentiality, integrity, availability; authentication and MFA; least privilege; encryption basics; common attacks such as phishing and malware. | You can describe a phishing attack and three controls against it. |
| 4. Hands-on practice | Labs and capture-the-flag challenges; reading logs; triaging alerts. | You have written up three exercises: what you saw, what you decided, what you would do next. |
| 5. Pick a direction | Defence (SOC, incident response), offence (penetration testing), or governance, risk and compliance. | You have tried one lab of each and know which you want more of. |
| 6. Proof | One recognised entry certification, a short portfolio, a tidy CV. | You can describe your practice in an interview without notes. |
What are the prerequisites for cyber security?
None are formal. Three habits do most of the work: reading documentation, reading logs, and writing down what you did so someone else can follow it. Programming is useful for detection engineering, application security and automation (see Python for cybersecurity) but not required for SOC, GRC or many entry roles.
Stages 1 to 3: the base
Install a Linux virtual machine and a Windows machine you can break. Learn to find the logon events, see which ports are listening, and look up a DNS record. Then learn the vocabulary the field uses: the NIST glossary is the plain reference, and the MITRE ATT&CK matrix shows how attackers actually behave, tactic by tactic. The learning library collects free courses for this stage.
Stage 4: practise, and write it up
Practice is what separates readers from candidates. Start with the beginner CTF challenges, then triage alerts in the SOC Log Triage Trainer and try the detection lab. After each exercise write three lines: what happened, how you decided, what you would do next. Those notes become interview answers. More options are on the hands-on training guide and the labs page.
Stage 5: which cyber security path?
- Defend and respond: SOC analyst, incident response, threat hunting. Read the SOC analyst career guide.
- Attack to improve defence: penetration testing and red teaming; mostly a second job, not a first. See penetration testing explained and red team vs blue team.
- Govern and assure: GRC, audit, privacy, risk. Suits people who like writing and process.
- Build securely: security engineering, cloud and application security. Usually needs programming or systems experience first.
The NIST NICE Workforce Framework lists the work roles and the knowledge and skills each expects, which is a useful check on what a job title really involves.
Stage 6: proof, and how to start with no experience
With no experience, plan for a stepping-stone role (IT support, SOC Tier 1, junior GRC) rather than a perfect first title. Pick one entry certification named in the job ads you want, using the certification roadmap and the certifications guide, and pair it with your written lab notes. The entry level jobs guide has the 90-day plan. For where you stand today, the scorecard takes two minutes.
Frequently asked questions
How do I start learning cyber security?
Start with how computers and networks work (IP addresses, DNS, ports, an operating system you can read logs from), then learn the core security ideas (confidentiality, integrity, availability, least privilege, authentication), then practise on hands-on labs. Do not start with hacking tools; they make little sense without the foundation.
What are the prerequisites for cyber security?
There is no formal prerequisite for most entry paths. Practical ones are comfort with basic networking, one operating system (Windows or Linux), and the habit of reading documentation and logs. Programming helps for some roles, such as detection engineering and application security, but is not required for governance, risk and compliance or SOC work.
Can I get into cyber security with no experience?
Yes, but usually through an adjacent step. Most people combine a technical base, one recognised entry certification and written proof of hands-on practice, and often apply to IT support, SOC Tier 1 or junior GRC roles first. See the entry level jobs guide for the roles and a 90-day plan.
How long does it take to learn cybersecurity?
It depends on your starting point, time per week and target role. We found no reliable single figure, so plan in stages instead: base skills, practice, then proof. Expect the first stage alone to take longer if networking is new to you.
Do I need a degree to learn cyber security?
No degree is needed to learn it. For hiring, the US Bureau of Labor Statistics lists a bachelor's degree as the typical entry-level education for information security analysts, while noting that some people enter with other training and certifications.
Is there a free cybersecurity roadmap?
This page is one. The learning library lists free courses and certifications, and the certification roadmap tool recommends exams by target role. None of these replace hands-on practice, which is the part employers ask about.
Which cyber security path should I choose?
Choose by the work you enjoy. Investigating alerts leads to SOC and incident response; reading systems for weaknesses leads to penetration testing and application security; policy, evidence and risk lead to governance, risk and compliance (GRC); building systems securely leads to security engineering. Try a lab from each before you commit.
Sources
- NIST NICE Workforce Framework for Cybersecurity (work roles and skills), accessed 3 Nov 2026
- BLS Occupational Outlook Handbook: Information Security Analysts, accessed 3 Nov 2026
- NIST Computer Security Resource Center glossary (definitions of core terms), accessed 3 Nov 2026
- MITRE ATT&CK knowledge base (how attackers behave), accessed 3 Nov 2026