Where should a beginner start learning cybersecurity?

Start with networking and Linux, because almost every security task assumes you can read an IP address, a port and a file permission. Then learn the fundamentals: the CIA triad, risk, attack surface, failing closed, defense in depth and security logging. Specialise only after that, into blue team, application security, cloud security or authorised testing.

Do I need to learn hacking to work in cybersecurity?

No. Most cybersecurity jobs are defensive: securing applications, configuring cloud permissions, monitoring logs and responding to incidents. Understanding how an attack works helps you defend against it, but the skill employers need most is preventing, detecting and fixing weaknesses in systems you are responsible for.

Which programming language is most useful for cybersecurity?

Python is the most common, because it is used for scripting, log analysis, automation and most security tooling. Bash is essential for working on Linux systems. For application security, learn the language your target applications are written in, since you need to read and fix that code.

How do the lessons on this site differ from hosted security labs?

Each lesson here is a small program you run on your own machine, usually in a Docker container, with its real output shown: first the weakness, then the fix and the run that proves it. Hosted lab platforms run guided exercises in their own virtual machines. The two work well together.

Cybersecurity Learning Roadmap

Security is a set of habits applied to systems you already know, not a separate subject. This roadmap starts with the fundamentals every path shares, then splits into five career paths. Every lesson here is defensive: you run small programs against your own code and containers, see the weakness, then see the fix hold. Topics marked planned are on the way and aren’t linked yet.

Stage 0: Prerequisites

Goal: be comfortable at a Linux shell and in one scripting language.

Linux: files, processes, and especially users and permissions
Python or Bash: enough to read and change a 25-line script
Docker: every security lesson here runs in a throwaway container
Networking: IP addresses, ports, DNS, HTTP and firewalls, each run in a Docker lab, ending with port scanning your own lab

Stage 1: Security fundamentals

Goal: know what you’re protecting, how to rank what could go wrong, and the design rules that keep mistakes from becoming breaches.

The CIA Triad, Demonstrated on One Machine: a checksum, a file permission and a connection cap, each failing and then holding
Threat, Vulnerability, Risk: a risk register, and the averaging bug that hides a critical risk
Attack Surface: every listening port is a door
Fail Closed: when an exception grants access (OWASP A10:2025)
Defense in Depth: three layers against one SQL injection
Security Event Logging: log the event, not the secret (OWASP A09:2025)
OAuth and Token-Based Authorization: scopes, audience, refresh rotation, PKCE, and why bearer tokens leak

Milestone: take a small app you’ve written and list its listening ports, its secrets and where they’re stored, the role it connects to its database with, and what it logs on a failed login. Fix one thing on each list.

The lessons this topic borrows from elsewhere on the site, such as least privilege in SQL, Redis and Kafka, and authentication in FastAPI, are listed on the Security Fundamentals page in reading order.

Stage 2: Choose a path

All five paths start from Stages 0 and 1.

A. Cybersecurity for beginners

Networking, then Linux, then the fundamentals above, then Cryptography, then a home-lab project. The cryptography topic runs in order: hashes and HMACs, AES-GCM, cipher modes and nonce reuse, password hashing work factors, signatures and key exchange, certificates and a local CA, the TLS handshake and envelope encryption and key rotation. Every lesson runs in a local container against keys it generates itself.

B. Ethical hacker (authorised, lab-only)

Networking, then Linux, then Python, then web security (planned), then ethical hacking (planned: scope and rules of engagement, recon of your own lab, vulnerability assessment, reporting). The attacker side of web security is taught well by PortSwigger’s free Web Security Academy, and this site focuses on the fix. Start with JavaScript security and Java security, which show real vulnerable code and its fix.

C. SOC analyst / blue team

Networking, then Defensive Security: detection as code over logs you generate yourself, in one Docker lab. It runs in order: Linux SSH auth logs, Sigma rules and ATT&CK mapping, Suricata on a packet capture, alert triage and tuning, preserve-then-contain incident response, an incident timeline, static analysis with EICAR and YARA and email header and DKIM triage. Alongside it, read Security Event Logging, Alerting and Runbooks and Incident Management.

D. Application security engineer

A programming language, then Cryptography, then web security (planned), then DevSecOps (planned: scanners on a planted bug, secrets scanning, threat modeling). Start with the security lesson for your language: Python, Java, JavaScript, C or Bash. Then read FastAPI auth and Spring Boot security.

E. Cloud security engineer

Networking, then cloud IAM, then cloud security (planned: CIS checks, pod security, infrastructure-as-code scanning, policy as code), then containers. Start with AWS IAM, GCP IAM, Azure Entra ID, IAM concepts that transfer, Docker security and Kubernetes security. For how cloud KMS keys work underneath, read envelope encryption and key rotation.

Ground rules for every path

Practise only on systems you own or have written permission to test. Every lesson here targets its own local code or containers.
Use obviously fake secrets in examples, such as sk_test_FAKE_..., and never paste real keys into a tutorial, a ticket or a log.
A fix isn’t finished until a run proves it, ideally a test that failed before the fix and passes after.