Executive Summary

Cybersecurity requires building from foundational IT and network basics up through

specialized security skills. The Developer Roadmap ([Link]) breaks cybersecurity into
domains like basic hardware/OS knowledge, networking, system security, offensive/defensive
skills, cloud, and governance. We reframe this into a structured learning plan: start with core
concepts (CIA triad, threats, system architecture, basic scripting), move to hands-on security tools
and intermediate topics (vulnerability assessment, network and host defense), and progress to
advanced topics (penetration testing, incident response, forensics, and cloud security). Each stage
has clear milestones (e.g. completing key courses or certifications) and hands-on projects. We
recommend mixing study and practice (e.g. guided labs, CTFs) and adjusting pacing to your
schedule (5, 15, or 30 hours/week). In 6–12 months you can cover all stages: for example, at
~15 h/week, plan about 2–3 months on fundamentals, 3–4 months intermediate, and the
remainder on advanced topics. Below we detail the roadmap structure, a staged learning
sequence with topics/tools and estimated hours, hands-on projects per stage, sample weekly
schedules (for 5h/15h/30h per week), assessment checkpoints (quizzes, projects, certs), key
resources (including free options), and common pitfalls/tips for effective learning. The plan
integrates authoritative sources and best practices for comprehensive, disciplined learning.

Roadmap Structure and Key Domains

The [Link] Cybersecurity Expert guide (2026) outlines broad domains for a security career.
These include Fundamental IT Skills (hardware, OS, troubleshooting, common
software), Networking (OSI model, TCP/IP, common protocols), System and Network
Security (firewalls, encryption, VPN, identity), Security Operations (incident response, forensics,
SIEM), Offensive Security (pentesting, exploitation), Cloud Security,
and Governance/Compliance (risk management, standards like ISO 27001). In practice, these
domains align roughly with tiers:
 Foundational skills – understanding computers, operating systems (Linux/Windows/macOS),
basic networking (TCP/IP, DNS, HTTP), and core security concepts (CIA triad, threats vs.
vulnerabilities, authentication/authorization, malware basics).
 Intermediate skills – using security tools and frameworks: e.g. network scanners (Nmap), packet
sniffers (Wireshark), vulnerability scanners, web-app security (OWASP Top 10), system
hardening, patch management, secure coding awareness, and basic incident response
procedures.
 Advanced skills – specialized topics like penetration testing and exploit development, digital
forensics/malware analysis, threat hunting, advanced cryptography (PKI, TLS), Zero Trust and
secure architectures, cloud (AWS/Azure security models), and GRC frameworks (NIST CSF, ISO
27001).
These stages mirror SANS’s roadmap categories (“Foundations”, “Crucial Skills”, etc.) and ensure
no major gap. We will transform this into a step-by-step learning sequence.
 Learning Pathway: Foundations → Intermediate → Advanced
Foundations (Basics) – ~50–100 hours (4–8 weeks @ 12–15 h/wk, or
longer if less time)
Goal: Learn essential IT literacy and core security concepts. Topics include:
 Computer Hardware & OS basics: PC components, BIOS/UEFI, installing and configuring OS
(Windows, Linux, macOS). Work with both GUIs and command-line interfaces (CLI). Understand
file systems, users/permissions, and software installation.
 Linux fundamentals: Use a Linux distro (Ubuntu/Kali/etc.) in a virtual machine. Practice CLI skills
(bash shell, file navigation, file permissions, process management). Linux Foundation offers
a free “Introduction to Linux” course.
 Networking fundamentals: OSI model, IPv4 addressing (private/public, subnetting, DHCP,
DNS), common protocols (HTTP/S, SSH, FTP, SMTP). Use Cisco Networking Academy’s free
“Networking Basics” course to build core knowledge. Experiment with home network setup or
Packet Tracer simulation.
 Programming/scripting basics: Learn a scripting language (e.g. Python, Bash). Writing simple
scripts automates tasks (e.g. parsing logs). Use official Python tutorials or free interactive sites
(Codecademy, W3Schools). Cisco NetAcad also has a free “Python Essentials” course.
 Security fundamentals: Study the CIA triad, common threat types (malware, phishing, DoS) vs.
vulnerabilities. Learn basic cryptography (hashes, symmetric/asymmetric encryption).
Understand authentication vs. authorization (AAA), firewalls and NAT basics, and the concept of
least privilege. Many of these are covered in entry certs like CompTIA Security+.
Prerequisites: No prior knowledge assumed, but comfort with computer use is helpful. (e.g.
familiarity with using an OS; if not, spend extra time on OS basics first.)
Time Estimate: For a beginner, spend several weeks solidly. For example, ~20 hours on OS and
Linux basics, ~15h on networking fundamentals, ~10h on scripting basics, and ~10h on security
concepts. That totals roughly 60–70 hours; at 10–15h/week that is 5–7 weeks. (At only 5h/week,
this could extend 12+ weeks.)
Hands-on Projects & Tools:
 Lab setup: Install virtualization (Oracle VirtualBox or VMware Workstation Player, both free). Set
up two VMs (e.g. Ubuntu and Windows). Practice configuring networks between them (NAT,
host-only). Use the Linux Foundation course’s labs for guidance.
 Wireshark capture: Launch Wireshark (free) on your network. Observe local traffic. Practice
filtering and identifying protocols.
 Basic Pentest CTF: Join a beginner CTF or platform. For instance, TryHackMe’s “Linux
Fundamentals” or “Introductory” rooms, or PicoCTF. These provide guided exercises in a
sandbox. (As Coursera notes: “Attempt a beginner-level CTF challenge to apply your new skills”.)
 Mini-Projects: Build a simple script (e.g. in Python) to log system info or scan local network IPs.
Set up firewall rules on Linux (iptables) and test.

Intermediate (Applied Skills) – ~100–150 hours (6–12 weeks @ 12–

15 h/wk)
 Goal: Deepen practical security skills and tools. Topics include:
 Secure OS & network configuration: Learn user/group management, permissions, patch
management. Harden Linux and Windows (disable unused services, configure firewalls). Begin
using tools like Nmap (port scanning) and Wireshark in depth. Study SSL/TLS and PKI basics
(OpenSSL commands, certificates).
 Web & Application Security: Study OWASP Top 10 web vulnerabilities. Practice by installing a
vulnerable web app (e.g. OWASP Juice Shop, DVWA) in your lab. Use OWASP ZAP (free)
or Burp Suite Community to scan it.
 Network Security Tools: Learn IDS/IPS basics (e.g. Snort, Suricata) and set up simple alerts.
Explore VPN setup (OpenVPN).
 Penetration Testing basics: Use Metasploit (Kali Linux) for simple exploits. Practice local
privilege escalation.
 Security Operations Fundamentals: Introduction to logs and monitoring. Familiarize with SIEM
concepts (even if using free tools like Elastic Stack or Security Onion on a VM). Understand
incident response steps. Basic cryptography (symmetric/asymmetric, digital signatures) and
hashing.
 Cloud Basics: Create free-tier accounts on AWS/Azure/GCP. Understand IaaS vs. SaaS vs. PaaS,
IAM roles, and basic cloud networking (VPC, security groups).
Prerequisites: Completion of Foundation stage. Comfort with Linux CLI and basic programming.
Time Estimate: About 100–150 hours. E.g. ~20h on Nmap/Wireshark labs, ~20h on
Linux/Windows hardening, ~20h on web app vulnerabilities and practice, ~15h on cryptography,
~15h on cloud fundamentals, ~15h on scripting more complex tasks (e.g. automating scans). (At
15h/wk: ~2–3 months; at 5h/wk: ~6+ months.)
Hands-on Projects & Tools:
 Guided CTFs: Complete intermediate challenges on TryHackMe/HackTheBox. For example,
network scanning and exploitation rooms. Focus on one at a time (e.g. “Basic Pentesting” labs).
Guided platforms help step through tools.
 Wireshark Analysis: Use Coursera’s example project “Network Traffic Monitoring with
Wireshark”. For ~2–3 hours, capture traffic and identify anomalies.
 Vulnerability Assessment: Scan a lab network with Nmap, then a web app with OWASP ZAP.
Analyze results (as in “Web App Vulnerability Assessment” in Coursera roadmaps).
 Configure a VPN/Firewall: Stand up an OpenVPN server or set Windows Firewall rules. Test
connectivity and security.
 Practice with Linux Hardening: Follow tutorials for Lynis or CIS Linux Benchmark. Perform a
simple security audit. Use auditd.
 Intermediate Projects: Write a Python script that uses Nmap’s library (python-nmap) to scan a
target. Document findings in a short report.

Advanced (Specialized Skills) – ~100+ hours (8+ weeks @ 12–15 h/wk)

Goal: Master complex domains. Topics include:
 Offensive Security & Exploits: Advanced pentesting (buffer overflows, exploit development,
web and network attack chains, Active Directory attacks). Learn tools like Metasploit thoroughly;
 practice manual exploits in a controlled lab. Study Metasploit Unleashed or Offensive Security’s
free resources.
 Digital Forensics & Malware Analysis: Use Autopsy/The Sleuth Kit and Volatility to analyze
forensic images and memory dumps. Understand forensic methodology.
 Security Operations & Threat Hunting: Build basic SIEM skills. Set
up Elastic+Kibana or Splunk (free), ingest logs (syslog, Windows Event Logs), write simple
detection rules. Learn about MITRE ATT&CK framework to map threat tactics.
 Cloud Security (Advanced): Deep dive into AWS/Azure security best practices: use IAM roles,
configure VPC firewalls (security groups), encryption-at-rest, container security
(Docker/Kubernetes basics).
 Governance & Compliance: Study NIST Cybersecurity Framework or ISO 27001 concepts (free
summaries online). Understand risk management processes, Business Continuity/Disaster
Recovery planning, and roles of policies and audits.
 Professional Skills: Project management, communication, etc. (Optional but helpful for senior
roles.)
Prerequisites: Completion of Intermediate stage. Should have tried an initial pentest and be
comfortable with Linux, Windows, and network fundamentals.
Time Estimate: Another 100+ hours. Advanced topics are broad; focus on areas aligned with your
goals (e.g. red team vs. blue team). For example: 20h on exploit development, 15h on forensic
tools, 15h on cloud security labs, 20h on SIEM/hunting labs, 20h on reading frameworks and
standards. (At 15h/wk: ~2–3 months; at 5h/wk: ~6 months.)
Hands-on Projects & Tools:
 Penetration Testing Capstone: Attempt a full pentest on a vulnerable VM or network. For
example, use Kali Linux to hack a Metasploitable VM or a HackTheBox machine (including
privilege escalation). Document vulnerabilities and write a report (findings, exploit steps, fixes).
 Incident Response Simulation: Use Splunk Free or OSSIM to simulate a breach. Run the Mitre
ATT&CK adversary simulation on a VM, then use logs to identify and respond.
 Cloud Lab: Secure a cloud environment (e.g. AWS Lightsail or student tier). Configure security
policies, IAM users/groups, and encryption (S3 bucket with SSE). Perform a small pentest on your
cloud setup (e.g. open ports).
 Forensics Challenge: Download a known forensic challenge (e.g. SANS Forensics challenges)
and solve it using Autopsy/Volatility.
 Red Team vs. Blue Team Exercises: Use free Blue Team labs (Security Onion VM, Splunk Free)
to detect a simple attack, and alternately use Metasploitable to attack.

Sample Weekly Study Schedules

Tailor your weekly plan to your availability. The table below outlines typical activities
for 5h/week, 15h/week, and 30h/week learners. Adjust days and focus as needed:
 5 hours/week (Beginner pace): Break study into ~1–2 hour sessions on alternate days.
Example: Mon (1h theory + 1h lab), Wed (1h reading + 1h practice), Fri (1h review/quizzes). Use
remaining time for recap. Focus on fundamentals gradually.
 15 hours/week (Moderate pace): Schedule ~3h on weekdays: e.g., Monday–Thursday: 3h each
(mix reading, labs, and small projects); plus 3h on weekend (review or extra practice). This allows
covering multiple topics per week with hands-on practice.
 30 hours/week (Accelerated pace): Study ~6h/day (Mon–Fri) with intensive sessions. For
example, each day: 2h lecture, 2h lab, 2h review/projects. Ensure at least 1–2 rest days for
absorption. This pace is fast but doable with discipline.
Below is a flowchart example showing how a typical week’s flow might look at each pace:
30h/week Schedule
Mon: 6h Intensive Lab/Study
Tue: 6h Topics Deep-Dive
Wed: 6h CTF/Project
Thu: 6h Hands-on Drills
Fri: 6h Exam Prep/Review
Done
15h/week Schedule
Mon: 3h Lecture/Lab
Tue: 3h Lab/Project
Wed: 3h Lecture/Lab
Thu: 3h Project/Review
Fri: 3h Quiz/Reading
Done
5h/week Schedule
Mon: 1h Lecture\n1h Lab
Wed: 1h Reading\n1h Lab
Fri: 1h Quiz/Review
Done
Show code
These are illustrative. Adjust days and content to fit your learning style (for example, reading
theory one day, hands-on the next). The key is consistency: even at 5h/week, regular weekly
practice (like weekly labs or quizzes) builds retention.

Assessment Checkpoints and Milestones

Track progress with measurable goals. Examples:
 Self-Quizzes: After each module, take a short quiz. Use free online quizzes for CompTIA A+,
Linux+, or practice problems (many resources and apps exist). Google’s Security Starter Projects
(e.g. mini-projects with rubrics) can also gauge learning.
 Certifications: Milestones at certs if applicable. For many beginners, CompTIA Security+ is a
target (~mid-stage). It validates core security skills (covering threats, architecture, cryptography).
Prerequisites: CompTIA Network+ or equivalent experience is recommended before Security+.
Other certs: A+ (hardware/software basics), Network+ (networking), Linux+, and advanced
certs like OSCP (practical pen-test) or CISSP (broad management theory).
 Project Milestones: Define projects with clear deliverables. For example: “By Month 3, build a
home lab with two VMs and secure SSH” or “By Month 6, complete a full vulnerability scan
report on a target.” Use portfolio checkpoints like finishing a CTF or posting a write-up.
 (Coursera’s Project briefs suggest deliverables like “vulnerability report with findings and
mitigations”.)
 Cert Exam Goals: If pursuing a cert, schedule study and exam dates. Use official exam objectives
as syllabus. E.g. aim to study for and pass Security+ (SY0-701) or OSCP by set dates.
 Skills Demonstrations: Periodically “teach” or explain a concept (e.g. do a mock presentation or
blog post). This self-checks understanding.

Recommended Resources
Focus on official or authoritative sources. Below are top picks by topic (with at least one free
option each):
 General Security Concepts: Coursera “Intro to Cybersecurity” courses, or FreeCodeCamp’s
cybersecurity modules. SANS Reading Room (free whitepapers) or NIST/SP guides for
frameworks.
 Networking: Cisco Networking Academy (free courses, e.g. “Networking Basics”). Cisco’s official
documentation and labs (Cisco Packet Tracer simulator). CCNA study materials (Cisco Press
books). Free CCNA Packet Tracer (download) to practice.
 Operating Systems: Linux Foundation’s Introduction to Linux (free, self-paced). Microsoft Learn
(free) for Windows/PowerShell basics. Official documentation: Ubuntu Wiki, Fedora Docs.
 Programming (Python/Bash): [Link] tutorial (free) and the “Automate the Boring Stuff
with Python” (free online text). Codecademy or Coursera (audit mode). Bash Guide on [Link]
(The Linux Documentation Project).
 Security Tools:
 Nmap: Official Nmap docs and reference guide. “Nmap Network Scanning” book (official, over
half free online).
 Wireshark: Official wiki tutorials, and “Wireshark Network Analysis” book by Orebaugh (some
resources free).
 Metasploit: Rapid7’s Metasploit Unleashed (free online course) or OWASP’s free docs.
 Burp Suite: (Community edition free for basic use) + PortSwigger’s Web Security Academy
(free labs on OWASP Top10).
 IDS: Snort/Suricata documentation (free). TryOpenSOC’s free online labs.
 Vulnerable Labs/CTFs: TryHackMe (free rooms) and Hack The Box (free tier). OWASP Juice
Shop (free web app). PicoCTF, Root-Me, and VulnHub VMs (free). SANS’ Open-SANS projects
(occasionally free).
 Cryptography: NIST’s “Computer Security Resource Center” (free NIST standards and glossary).
Applied Crypto by Christof Paar (lecture videos online).
 Cloud: AWS Free Tier with official AWS training (AWSome Day, etc.). Microsoft Learn for Azure
(free). Google Cloud’s free credits + Qwiklabs (some free labs). Cloud Security Alliance resources.
 Frameworks/Standards: OWASP Top 10 (official doc). NIST Cybersecurity Framework (public
PDF). ISO/IEC 27001 official page. CIS Critical Security Controls documentation (free PDFs).
 Books (select): “CompTIA A+ All-in-One Exam Guide” (for hardware/OS), “CompTIA Security+
Guide” (cert prep), “The Web Application Hacker’s Handbook”, “Metasploit: The Penetration
 Tester’s Guide”, “Python Crash Course”. Many of these are not free, but their official guides have
summaries online.
 Communities and News: Cybrary (free video courses), free SANS courses/webcasts, security
podcasts (e.g. Darknet Diaries), and blogs (Krebs on Security, Schneier on Security).
Whenever possible use primary sources (vendor documentation, standards bodies, official
training). For example, Cisco’s site and CompTIA’s site provide authoritative overviews. Many tools
have excellent free tutorials (e.g. OWASP, Nmap).

Common Pitfalls and Tips for Success

Be aware of learning traps and use strategies to retain knowledge:
 Don’t Skip Fundamentals: A very common beginner mistake is “jumping into tools (SIEM,
Metasploit, Burp) without understanding basics”. Without solid grounding in networking, OS,
and scripting, security tools will feel like magic. Fix: Build a strong foundation first.
 Avoid Overwhelm: Cybersecurity has many subfields (Red Team, Blue Team, Cloud, GRC, etc.).
Trying to learn all at once leads to surface-level understanding. Instead, choose an initial focus
(e.g. system/network defense or pentesting) and dive deep, then branch out.
 Hands-on Practice is Crucial: Reading alone doesn’t stick. Beginners often “watch videos but
avoid practical labs”. It’s critical to build virtual labs and do real tasks (capture flags, analyze logs)
every week. Even small labs (e.g. configuring a firewall, analyzing a pcap) solidify theory.
 Don’t Memorize—Understand: Avoid rote memorization of ports, commands or jargon. The
field tests analysis skills. Emphasize understanding concepts (e.g. why an exploit works, how a
protocol normally behaves) over memorizing trivia.
 Document Your Learning: Many beginners forget to keep notes or share progress. Write blog
posts or GitHub READMEs for projects. “Not documenting what you learn” means forgetting
details. Teaching others (through writing or videos) helps retention.
 Set Realistic Pace: Cybersecurity is a marathon, not a sprint. Expecting to master everything in
weeks is unrealistic. Be patient and disciplined. Small daily progress (even 30–60 min on labs)
compounds over time. Celebrate each milestone (project completed, concept understood) to
stay motivated.
 Stay Current: The field evolves. Follow reliable sources (NIST, OWASP, security news) to see new
threats and tools. Participate in forums or local meetups. Regular community interaction not
only teaches trends but also holds you accountable.
By focusing on fundamentals, doing regular labs, and iterating (learn → practice → reflect), you’ll
solidify knowledge for the long term. Remember: cybersecurity mastery is about depth of
understanding and consistent practice, not speed.

6–12 Month Learning Timeline

A sample timeline (for a self-paced beginner) might look like this:
 Months 1–3 (Foundations): Cover hardware, OS, Linux CLI, basic networking (DNS, DHCP, IP).
Complete a Linux Foundation intro course and Cisco’s “Networking Basics”. Practice by building
 a simple home lab (VirtualBox + two VMs). Milestones: finish Linux and Networking courses;
pass CompTIA A+ or Cisco CCNA Exam (if aiming for certs); complete one beginner CTF (e.g.
TryHackMe Intro).
 Months 4–6 (Intermediate Skills): Learn security tools and processes. Study firewalls,
encryption, and OWASP Top10. Do hands-on labs: perform network scans (Nmap) and web
vulnerability assessments. Begin CompTIA Security+ prep (covers many foundational topics).
Milestones: submit a vulnerability report on a lab web app; earn CompTIA Network+ or
Security+ certification; solve multiple intermediate CTF challenges.
 Months 7–9 (Advanced Focus): Delve into offensive and defensive specialties. For red team
track: practice exploit dev, buffer overflows, and complete an OSCP challenge lab. For blue team
track: set up a SIEM (Splunk Free or ELK), simulate an incident, analyze logs. Also, strengthen
cloud skills (deploy a secure AWS setup). Milestones: complete one advanced course (e.g.
“Pentesting” or “Incident Response”), or earn an OSCP/CISSP (depending on role focus).
 Months 10–12 (Mastery and Showcase): Tackle capstone projects. Example projects: develop
a phishing detector tool, optimize firewall rules, or write an incident response plan for a breach
scenario (similar to Coursera’s suggested projects). Polish your portfolio: document your projects
with README and visual aids. Consider obtaining a high-value cert (OSCP, CISSP, or GIAC) as a
capstone. Milestones: publish a project or blog post; obtain targeted certification; participate in a
community CTF or present learnings at a meetup.
For slower (12+ month) pacing, extend each phase. For accelerated (3–6 months full-time),
condense topics (e.g. spend 2–4 weeks per major topic).
Visualization (Mermaid Gantt): Below is a simplified 6-month plan example:
2026-05-012026-06-012026-07-012026-08-012026-09-012026-10-01Hardware & OS
BasicsLinux FundamentalsNetworking BasicsNetwork Security & ToolsVulnerability
AssessmentPentesting BasicsIncident Response & ForensicsAdvanced
PentestingCloud Security ConceptsFoundations (Months 1-2)Intermediate (Months
3-4)Advanced (Months 5-6)Cybersecurity Learning Roadmap (6 months)
Show code
This timeline allocates roughly the right duration for each stage at ~15h/week. Adjust dates and
tasks to your calendar. The key is measurable milestones (courses finished, cert passed, project
done) at each phase.

Sources
We have drawn on official and expert sources to inform this plan. For example, Coursera’s 2026
Cybersecurity Roadmap highlights key foundational concepts (CIA triad, threats,
authentication) and recommends hands-on labs (network monitoring, vulnerability assessment).
CompTIA and Cisco documentation confirm core skill areas (Security+ skills include network
security, cryptography, and risk management; Cisco offers free training in networking and
cybersecurity). NIST/OWASP frameworks (CIA model, Top 10 risks) underline critical learning
topics. Lessons from experts (e.g. Medium’s “common mistakes” article) shaped our advice on
pitfalls and study habits. Where possible, we cite primary sources (tool documentation, official
cert guides, standards) to ensure the plan is grounded in current best practices.
This plan is a comprehensive guide – start at the beginning, practice consistently, and build up
gradually. Good luck on your cybersecurity journey!