Skip to content
Free planner · Learning library

Cyber Certification Roadmap

Which certification next, and in what order? Choose where you are, the role you want, what you can spend on exams and how many hours a week you have. You get a foundation, core and advanced step, each with the exam, its current price, free preparation and a PlayCISO lab to practise the skill the exam tests.

No download, no card
Where you are now
Where you want to be
Exam budget
Hours per week

Runs in your browser. Prices are US list prices checked in October 2026; they change, so confirm with the issuer before paying.

Help desk / IT support → SOC analyst
~57 weeksabout 13.2 months at 5 h/week

Exam spend in this plan: about US$878

  1. 1. Foundation

    ~13 weeks
    Certification
    CompTIA Security+
    CompTIA · US$439 voucher (V7 SY0-701; V8 SY0-801 expected ~17 Nov 2026)
    Up to 90 questions incl. performance-based, 90 min

    The entry certification most often named in job ads and accepted for US DoD 8140 roles.

    Free preparation

    Practise on PlayCISO

    Alternatives: ISC2 Certified in Cybersecurity (CC) (US$199 exam + US$50/yr maintenance) · Cisco CCST Cybersecurity (100-160) (US$125 exam) · Google Cybersecurity Certificate (US$49/month on Coursera)

  2. 2. Core role certification

    ~21 weeks
    Certification
    CompTIA CySA+
    CompTIA · US$439 voucher (V4 current; V3 English exam retires 22 Dec 2026)
    Multiple-choice + performance-based

    The analyst-level follow-on to Security+: detection, vulnerability management, incident response.

    Free preparation

    Practise on PlayCISO

    Alternatives: Cisco CyberOps Associate (200-201 CBROPS) (US$300 exam) · Blue Team Level 1 (BTL1) (£399 training + exam) · Microsoft SC-200 Security Operations Analyst (Exam fee varies by country; the learning paths are free)

  3. 3. Advanced / senior

    ~23 weeks
    When funded
    GIAC Certified Incident Handler (GCIH)
    GIAC · US$999 attempt (SANS SEC504 sold separately)

    GIAC Certified Incident Handler (GCIH) is above this budget; ask an employer to fund it or save for it after the free preparation.

    Free preparation

    Practise on PlayCISO

    Alternatives: GIAC Certified Intrusion Analyst (GCIA) (US$999 attempt)

A planning aid, not career advice. PlayCISO is not a certification body and is not affiliated with any issuer listed. More free courses are in the learning library.

TL;DR

What this planner does

  • Pick where you are, where you want to be, your exam budget and hours per week; get a three-stage certification sequence (foundation, core, advanced) with a time estimate.
  • 22 certifications across SOC, incident response, pentesting, cloud, GRC and management, with US list prices checked in October 2026 (ISC2 CC now costs US$199: its free programme closed on 20 May 2026).
  • Every stage pairs the exam with free preparation from the PlayCISO learning library and hands-on PlayCISO labs to practise the skill, not just the theory.
  • A $0 budget gives a free-only plan and names the exam to sit when it is funded. Copy the plan as text for a manager or a development review.

Frequently asked questions

What certification should I get first in cybersecurity?

For most beginners heading into a SOC or general security role, CompTIA Security+ (US$439 as of October 2026) is the safest first exam because it is the entry certification most often named in US job ads. ISC2 CC (US$199) is cheaper and gentler; Cisco CCST Cybersecurity (US$125) pairs with a free Cisco course. Pick by budget and target role; the roadmap does this for you.

Is the ISC2 Certified in Cybersecurity (CC) still free?

No. ISC2 closed its One Million Certified in Cybersecurity programme to new participants on 20 May 2026. People who already hold an unexpired exam code can sit the exam until 31 December 2026. Otherwise the exam is US$199 in the Americas, plus a US$50 annual maintenance fee once certified.

How long does it take to get a cybersecurity certification?

At 5 hours a week, a foundation exam such as Security+ typically takes 4 to 5 months for a newcomer and closer to 3 for someone already in IT. Role certifications like CySA+ or BTL1 take a similar time again. The roadmap estimates time from your weekly hours and adds lab practice to every stage.

Can I build a cybersecurity career with free certifications only?

You can build the skills for free and earn free badges (Cisco Networking Academy, IBM SkillsBuild, Fortinet NSE 1), but most job ads ask for a paid exam-based certification. A sensible plan is free learning and labs first, then one paid exam once you can pass it first time.

Is a PlayCISO certificate an industry certification?

No. PlayCISO is not a certification body. Its Projects tracks award a Certificate of Completion for finishing hands-on labs, which shows practical work but does not replace Security+, CySA+, GIAC or ISC2 credentials.

More free security tools

The tools people use most on PlayCISO.

All tools
Prompt Scan

Catch injected instructions hiding in content your AI agent should only read.

ISO/IEC 27090 Readiness

Score your readiness against the first international standard for AI security threats.

CVE Trends

Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.

Firewall Lab

Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.

NIST CSF 2.0 Assessment

Self-assess all six Functions, from Govern to Recover, and see your weakest one.

APT Naming Rosetta Stone

Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.

🎉 New here? Use code WELCOME10 for 10% off any plan at checkout
Cyber Certification Roadmap — Which Cert Next, by Role and Budget · PlayCISO