Learning guide

Python for Cybersecurity: Where to Start

Python is the most common first language for security work because it is quick for the daily jobs: parsing logs, calling APIs, checking files and automating repeat tasks. You do not need it for every role, but a few hundred lines of working scripts set you apart.

This guide gives a learning order and defensive starter projects. It does not teach attack tooling; use any security script only on systems you own or are authorised to test.

Updated 3 November 2026

A learning order that works

Core syntax: variables, strings, lists, dictionaries, loops, functions.
Files and text: reading files line by line, splitting, and regular expressions.
Data formats: JSON and CSV, since most security tools export them.
Web APIs: HTTP requests and handling errors and rate limits.
Hashing and basic crypto utilities from the standard library.
Packaging your script: command-line arguments, a README, and tests for the awkward bits.

Defensive projects to build

Failed-login counter for a log you own (example below).
File integrity checker: store hashes of important files, compare later, report changes.
Vulnerability list checker: read CISA's KEV data and flag the CVEs in your own inventory. Compare against the KEV checker.
Indicator enrichment: take a list of domains or hashes and look each up through a free API; see free threat intelligence APIs.
Password-policy checker that tests candidate policies against basic rules.

import re
from collections import Counter

# Count failed SSH logins per source address in a log you own.
pattern = re.compile(r"Failed password for .* from (\d+\.\d+\.\d+\.\d+)")
counts = Counter()
with open("auth.log", encoding="utf-8", errors="replace") as f:
    for line in f:
        m = pattern.search(line)
        if m:
            counts[m.group(1)] += 1

for ip, n in counts.most_common(10):
    print(f"{n:5d}  {ip}")

This uses only the standard library. Try changing it to count failures per user name, then print the hour with the most failures.

Libraries worth knowing first

Stay in the standard library until a task demands more: re, json, csv, hashlib, argparse and pathlib cover most beginner projects. Add an HTTP client such as requests for APIs. Specialised packages for packets, binaries or data analysis come later, once you know what you need them for.

Where to practise

Capture-the-flag challenges reward small scripts: try the beginner CTF challenges. Read the wider plan in how to learn cybersecurity and find labs on the hands-on training guide. Keep each script in a repository with a short README; it doubles as portfolio evidence.

Frequently asked questions

Why is Python used in cybersecurity?

It is readable, has a large standard library and many security-related packages, and is quick for glue work: parsing logs, calling APIs, automating repetitive checks and prototyping analysis. It is rarely the only language a team uses.

Do I need Python to work in cyber security?

Not for every role. SOC, GRC and many entry roles can be done without programming, but scripting helps with automation, detection engineering, threat intelligence and application security, and it sets candidates apart.

How long does it take to learn Python for security?

It depends on your starting point and time per week, so we give no single figure. A practical target is being able to read a file, loop over lines, use a dictionary and call a web API; that unlocks most beginner security scripts.

What Python projects should a security beginner build?

Defensive ones: a log parser that counts failed logins per source, a file-integrity checker that compares hashes, a script that queries a public threat-intelligence or vulnerability API for a list of indicators, and a password-policy checker. Each produces output you can show.

Is Python enough for penetration testing?

It is helpful for scripting and tooling, but penetration testing also depends on networking, operating systems and web knowledge. Only run tools against systems you own or are authorised to test.

Which Python libraries matter for security work?

Start with the standard library (re, json, csv, hashlib, socket, subprocess, argparse), then requests or httpx for APIs. Specialised packages exist for packet handling, parsing binaries and dataframes; learn them when a task needs them.