2026 guide
The cybersecurity roadmap to learn from scratch
A clear path — fundamentals, practice, specialization — and how to prove your progress in a verifiable way so it leads you to a job.
1 · Fundamentals
Networks and protocols, Linux and Windows, scripting (Python/Bash) and security concepts (OWASP, basic crypto).
2 · Practice
Machines and CTFs on HackTheBox, web labs, home lab. Document writeups and publish your scripts on GitHub.
3 · Specialization
Pick a direction — pentesting, bug bounty, blue team/SOC, AppSec, cloud — and earn 1-2 hands-on certifications.
Phase 1 — Build a solid foundation
Before specializing, master the cross-cutting basics: how networks work (TCP/IP, HTTP, DNS), operating systems (Linux and Windows), some programming and scripting, and the security concepts (the OWASP Top 10, authentication, encryption). This foundation makes everything else fit together.
Phase 2 — Practice and generate evidence
- Solve machines and CTFs on HackTheBox and lab platforms.
- Set up a home lab and break things in a controlled environment.
- Document writeups: explaining how you think is worth gold.
- Publish your tools and scripts on GitHub.
- Start in bug bounty for public, verifiable results.
Phase 3 — Specialize and get certified
Pick where you are aiming — pentesting, red team, bug bounty, blue team/SOC, AppSec, cloud or GRC — and go deep. Earn one or two hands-on certifications that back your focus (eJPT, OSCP, Security+, CySA+, BTL1…). Do not collect acronyms: prioritize the ones that prove real skill.
The whole roadmap: prove your progress
The roadmap does not end at learning: you have to prove it. A verified profile turns every step — every machine, every certification, every project — into verifiable evidence. CyberProfile builds it for you as you progress, so when you look for work you will already have a page that proves your entire journey.
Your progress, verified
Make every step of the roadmap count
Connect your platforms once and your progress is reflected automatically: machines, certifications, projects. When it's time to look for a job, you'll have proof of your entire journey in a single link.
- Updates itself as you learn
- Everything verified at the source, impossible to fake
- One link for applications and LinkedIn
Start your roadmap and prove it
Free. Verified at the source. No card.
Frequently asked questions
Where do I start learning cybersecurity?
With the fundamentals: networking, systems (Linux/Windows), some programming and the core security concepts (OWASP Top 10, basic cryptography). With that foundation, start practicing in legal environments like HackTheBox and web labs, and document what you learn as you go.
How long does it take to learn cybersecurity?
With consistency, in 6-12 months you can have a solid foundation and practical evidence for junior roles. It is not a destination but a continuous process: the key is practicing regularly and accumulating verifiable achievements.
Do I need a degree to work in cybersecurity?
It is not essential. It helps, but many people get in by showing practical evidence (machines, bug bounty, certifications). What matters most is being able to prove what you can do, whether or not you have a degree.
How do I prove my progress while I learn?
With a verified profile that brings your evolution together. CyberProfile imports your machines, certifications and projects onto a public page that grows with you, ideal for showing your progress throughout the roadmap.
Build your cybersecurity profile for free
Make every step of your roadmap proven.
- Free forever
- No credit card
- Ready in 60s
- Verified at the source