Most cybersecurity roadmaps you find online are a wall of logos: forty tools, twelve certifications, no order and no sense of how long anything takes. This one is sequenced. Each stage says what to learn, why it comes where it does, what you should be able to do before moving on, and roughly how long that takes for someone starting from zero.
Quick answer
A cybersecurity roadmap moves through eight stages: computer and networking foundations, operating systems, security fundamentals, choosing a defensive, offensive or GRC track, hands-on tools, portfolio projects, certifications in the right order, and the job search. Most beginners need three to six months of consistent effort to reach entry-level readiness.
Key takeaways
- Order matters more than volume. Networking and operating systems before any security tool — skip that and everything later becomes memorisation instead of understanding.
- Pick a track at stage 4, not at the start. Defensive, offensive and GRC need the same foundations; committing early usually means committing blind.
- Defensive security has the most entry-level openings in India. If your goal is a first job rather than a specific job, start there.
- Certifications come after hands-on work, not before. A certificate with no projects behind it is visible in the first ten minutes of an interview.
- Three to six months of consistent effort is realistic. Anyone promising job-ready in three weeks is selling something.
What Is a Cybersecurity Roadmap?
A cybersecurity roadmap is an ordered learning plan that takes you from no security knowledge to employable, stage by stage, with a clear dependency between each step and the next.
The word that matters is ordered. A list of topics is not a roadmap. A roadmap tells you what has to be true before the next thing makes sense — you cannot investigate a suspicious connection until you can read network traffic, and you cannot read network traffic until you understand what a port is.
It also has to end somewhere specific. “Learn cybersecurity” is not a destination. “Be able to work a Tier 1 alert queue and explain my investigation” is. Every stage below is written against an outcome you can demonstrate, not a topic you have watched.
What a roadmap is not
- Not a tool list. Tools change every two years. The reasoning behind them does not.
- Not a certification sequence. Certifications validate a roadmap; they are not the roadmap itself.
- Not a fixed calendar. Someone from an IT support background moves through stages 1 and 2 in days. A non-IT graduate may need six weeks. Both are normal.
The Cybersecurity Roadmap at a Glance
Here is the whole path in one table. The durations assume roughly 10 to 15 hours a week, starting from no IT background. Add or subtract depending on what you already know.
| Stage | What you learn | Rough time | You are done when you can… |
|---|---|---|---|
| 1. Networking | OSI and TCP/IP, IP addressing, ports, protocols, DNS, DHCP, routing and switching basics | 3–5 weeks | Open a packet capture and explain what happened in the session |
| 2. Operating systems | Linux command line, file permissions, services, logs; Windows security model and Active Directory | 3–4 weeks | Find the right log for a given question on either OS |
| 3. Security fundamentals | CIA triad, threats vs vulnerabilities vs risk, controls, cryptography basics, attack types | 2–3 weeks | Describe a real breach accurately using correct terminology |
| 4. Pick a track | Defensive (SOC), offensive (VAPT) or governance, risk and compliance | 1 week to decide | Name the job title you are aiming at, and why |
| 5. Tools and labs | One tool per category, used properly, in a lab you control | 4–6 weeks | Complete an end-to-end task without following a tutorial |
| 6. Projects | Three to five finished pieces of work with written reports | 3–5 weeks | Walk someone through work you produced and defend your decisions |
| 7. Certification | One entry-level credential aligned to your track | 4–8 weeks | Pass, and explain the concepts without the exam wording |
| 8. Job search | Resume, portfolio, LinkedIn, mock interviews, applications | Ongoing | Explain your projects in an interview without notes |
Stages overlap in practice. Nobody finishes networking, closes the book and starts Linux. You will loop back constantly, and that is how it should work — a concept from stage 1 only truly lands when you hit it again in stage 5. The order matters for where you start, not for where you are allowed to return.
Stage 1: Computer and Networking Foundations
Start here, without exception. Networking is the single biggest predictor of how far a security career goes, and it is where weak candidates are identified fastest in interviews.
What to learn
- The OSI and TCP/IP models — not as a memorised list, but as a way to locate a problem.
- IP addressing and subnetting, enough to read a network diagram.
- Ports and protocols: HTTP and HTTPS, DNS, DHCP, SMB, RDP, SSH, SMTP.
- How a request actually travels from a browser to a server and back.
- Switching, routing and NAT at a conceptual level.
Why it comes first
Almost every security alert you will ever investigate is a statement about network behaviour: an unusual destination, an odd port, a protocol used where it should not be. If you cannot read that, you can only escalate alerts, never resolve them.
How you know you are done
Capture live traffic on your own machine, pick one session, and explain it end to end — which protocol, what was requested, what came back, and whether anything about it is unusual. If you can do that unaided, move on.
Stage 2: Linux, Windows and Active Directory
Security incidents happen on operating systems, so you need to be comfortable on both. Linux for servers, tooling and most security software; Windows and Active Directory because that is what the corporate environment runs on and what attackers move through.
Linux — what actually matters
- Navigating the file system and working confidently at the command line.
- Users, groups, permissions and
sudo. - Processes, services and how to start, stop and inspect them.
- Where the logs live and how to search them.
- SSH, and basic networking commands.
Windows and Active Directory — what actually matters
- The Windows security model: accounts, groups, privileges, UAC.
- Active Directory structure — domains, OUs, group policy.
- Event logs: which ID tells you what, and how to filter them.
- Why AD is the target in most enterprise intrusions.
Beginners often skip Windows because Linux feels more “security”. That is backwards for defensive roles. The alerts you will triage in a SOC are overwhelmingly about Windows endpoints and Active Directory accounts.
How you know you are done
Given a question — “did this account log in from somewhere unusual?” — you know which log to open on either operating system, and you can get the answer out of it.
Stage 3: Security Fundamentals
Now, and only now, security concepts. With stages 1 and 2 behind you, these ideas attach to something concrete instead of floating as vocabulary.
What to learn
- The CIA triad — confidentiality, integrity, availability — and how every control maps to one of them.
- Threat, vulnerability, risk — three words beginners use interchangeably and interviewers use as a filter.
- Control types — preventive, detective, corrective; technical, administrative, physical.
- Cryptography basics — hashing versus encryption, symmetric versus asymmetric, what TLS actually does, what a certificate proves.
- Common attacks — phishing, credential theft, privilege escalation, lateral movement, ransomware delivery.
- Authentication and authorisation — MFA, least privilege, and why over-permissive access causes so many breaches.
How you know you are done
Pick a publicly documented breach, read the incident report, and write one page explaining what happened in correct terminology — what the initial access was, what the vulnerability was, which controls failed and which would have helped. If you can write that page, this stage is closed.
Stage 4: Pick Your Track
This is the decision point. Up to here, everyone learns the same things. From here the paths separate, and choosing early — before you understand what each job actually involves — is how people end up training for a role they would not enjoy.
| Track | What the job is | Core skills | Entry-level demand | Suits you if… |
|---|---|---|---|---|
| Defensive (SOC / blue team) |
Monitor, triage and investigate alerts; respond to incidents | Log analysis, SIEM, alert triage, incident response, threat intelligence | Highest — most first jobs in India start here | You like patient investigation and working to a process |
| Offensive (VAPT / red team) |
Test systems and applications for exploitable weaknesses, under authorisation | Recon, enumeration, exploitation, web and API testing, report writing | Lower at junior level than its popularity suggests | You like breaking things apart and documenting exactly how |
| GRC (governance, risk, compliance) |
Policy, risk assessment, audit evidence, ISO 27001 and regulatory work | Frameworks, risk analysis, documentation, stakeholder communication | Steady, and often overlooked by beginners | You are strong on writing and structured thinking |
An honest word on the offensive track
Penetration testing is the most-wanted track and the hardest to enter directly. Most working testers arrived from a systems, network or development background rather than straight from a course. If that is your goal, plan for a longer runway — or enter through a defensive role and move across once you have operational experience.
Stage 5: Tools and Hands-On Labs
One tool per category, learned properly, beats twenty tools demonstrated once. Products differ; the discipline behind them does not. Learn the discipline and switching tools later is a matter of learning an interface.
Defensive track tools
- Wireshark — read traffic, follow a session, spot the anomaly.
- A SIEM — Splunk, QRadar, Microsoft Sentinel or Wazuh. Which one matters far less than being able to write a query, build a dashboard and tune a noisy rule.
- Sysinternals — trace a suspicious process on a Windows host.
- MITRE ATT&CK — the framework defenders use to map observed behaviour to known techniques. Learn it as a working reference, not a poster.
Offensive track tools
- Nmap — discovery and enumeration, understanding what each scan type actually sends.
- Burp Suite — intercept, modify and replay web requests.
- Nessus or OpenVAS — scanning, and more importantly triaging what comes back.
- Kali Linux and Metasploit — controlled exploitation in a lab you own.
Build a lab you control
A laptop with virtualisation software, one Windows VM, one Linux VM and a deliberately vulnerable target is enough to cover most of this stage. The point is not the tool count. It is having somewhere you can break things without consequences and repeat a task until it is automatic. If you would rather not assemble one yourself, our cyber security course provides 24/7 lab access across more than twenty tools.
Legality is not a technicality. Testing systems you do not own or have written permission to test is a criminal offence in India under the Information Technology Act, 2000, regardless of intent. Use your own lab or a deliberately vulnerable practice environment — nothing else.
Stage 6: Projects and Portfolio
Projects are what turn a roadmap into something an employer can evaluate. Three to five finished pieces of work, each with a written report, will do more for your first interview than any additional course.
Defensive project ideas
- SOC monitoring build — ingest log sources into a SIEM, write correlation rules, work an alert queue, document how you triaged and escalated.
- Phishing investigation — analyse headers, links and attachments from a suspicious email, extract indicators, recommend a response.
- Incident timeline — take a simulated compromise from detection to recovery and produce a timeline with root cause.
Offensive project ideas
- Web application assessment — test a deliberately vulnerable application against the OWASP Top 10 and write a professional report with reproduction steps.
- Network vulnerability assessment — scan a lab network, validate findings by hand, and deliver a prioritised remediation plan with CVSS reasoning.
What makes a project count
Not the topic — the write-up. A finding described so a developer can reproduce and fix it is a professional deliverable. The same finding as a screenshot with no context is a homework submission. Write every project as if a manager who was not there has to act on it.
Stage 7: Certifications, in the Right Order
Certifications validate what you already know. They do not substitute for it. Take one after stage 6, not before — the exam is far easier when the concepts are attached to work you have actually done.
Exam codes, fees and formats change regularly. Everything below was accurate at the time of writing and should be confirmed on the certifying body’s own website before you plan around it.
| Order | Certification | Why here | Check before booking |
|---|---|---|---|
| First (optional) | ISC2 Certified in Cybersecurity (CC) | Entry-level, no experience required — useful if you want an early credential while building projects | The free “One Million Certified in Cybersecurity” route closed to new enrolments in May 2026 and the exam returned to standard pricing with an annual maintenance fee. The exam outline was also scheduled for revision during 2026. |
| Core | CompTIA Security+ | The widely recognised baseline for SOC and analyst hiring — the one most job descriptions name | SY0-701 was still the live version as of late 2026, with a successor (V8, expected as SY0-801) in draft that adds AI and large language model content. CompTIA typically keeps the outgoing version bookable for around six months after a new one launches. Confirm which code you are booking, and the current fee. |
| Next, defensive | CompTIA CySA+ | For analysts moving past entry level into detection and response work | A newer version (CS0-004) launched in 2026 and the previous English exam has a published retirement date. Check which version your study material targets. |
| Next, offensive | CEH or OSCP | Only once you have real hands-on testing work behind you | Eligibility rules, training requirements, practical exam options and cost — both are substantially more expensive than the entry-level options. |
| Vendor-specific | Microsoft security certifications | If your target employers run Sentinel, Defender and Entra | Microsoft renames and retires role-based exams frequently. Check the current exam code on Microsoft Learn. |
Most institutes push the most expensive certification first. The order that actually gets freshers hired usually runs the other way — foundations, projects, then one credential that matches the job you are applying for. Our 25-module cyber security programme sequences certification guidance after the project stage for exactly this reason.
Stage 8: Job Search, Resume and Interviews
This stage is a skill of its own, and it is where well-prepared candidates most often stall. Treat it with the same seriousness as stage 5.
Resume
- Lead with projects, not with courses completed.
- Describe each project by what you did and what you found, not by the tool you opened.
- Name the specific SIEM, scanner or framework you used — recruiters filter on those words.
- Keep it to one page until you have real work experience.
Interviews
- Expect to explain networking from scratch. It comes up in almost every interview.
- Expect a scenario: “this alert fired — what do you do?” They are testing your process, not a memorised answer.
- Be able to walk through one project in detail, including what you got wrong and fixed.
- “I do not know, but here is how I would find out” is a good answer. Guessing confidently is not.
Which roles to apply for
SOC analyst, cybersecurity analyst, security operations analyst, network security analyst, vulnerability assessment analyst and junior penetration tester are the realistic entry points. Incident response, threat intelligence and forensics roles usually expect some operational experience first, though the roadmap prepares you for that move.
Cybersecurity Roadmap by Your Background
The stages do not change. How fast you move through them does.
| Your background | Where to start | What to skip or speed up | Track that usually fits |
|---|---|---|---|
| Fresher / student, any stream | Stage 1, from zero | Nothing — do the full sequence | Defensive (SOC) — most entry openings |
| IT support / helpdesk | Stage 1, quickly | Much of stage 2 is already familiar — focus on AD and event logs | Defensive, with a fast path to SOC Tier 1 |
| System or network admin | Stage 3 | Stages 1 and 2 are largely covered | Defensive or network security; strongest starting position of all |
| Developer | Stage 1, then stage 3 | Scripting and application logic are already there | Application security, DevSecOps, offensive web testing |
| Non-IT graduate or career switcher | Stage 1, allow extra time | Nothing — budget six weeks for stages 1 and 2 rather than three | Defensive, or GRC if you write well |
| Working professional, limited hours | Stage 1, part-time | Nothing — stretch the calendar, not the sequence | Whichever matches your existing domain |
One caution for career switchers: the temptation is to skip to the interesting stages. It does not work. Every shortcut taken in stages 1 to 3 reappears in stage 8 as a question you cannot answer.
How Long Does the Cybersecurity Roadmap Really Take?
Three to six months of consistent effort to entry-level readiness, for most beginners. That assumes 10 to 15 hours a week and real lab practice rather than watching sessions.
A realistic breakdown
- Weeks 1–8: stages 1 to 3 — networking, operating systems, security fundamentals.
- Weeks 9–10: stage 4 — choose a track, having now seen enough to choose properly.
- Weeks 11–16: stage 5 — tools and daily lab work.
- Weeks 17–21: stage 6 — projects and written reports.
- Weeks 22–28: stage 7 — certification, while stage 8 runs in parallel.
Full-time instructor-led training compresses the first half considerably, because the sequencing and the lab environment are handed to you instead of assembled. Cyber Security Academy runs a three-month programme on exactly this structure — 25 modules, more than twenty tools, six capstone projects, four practical assignments and two Capture The Flag challenges.
What the timeline does not include is the part that never ends. The attack surface changes every year; cloud and AI-related security work barely existed in this form five years ago. Reaching your first role is the start of the learning, not the end of it.
Cybersecurity Roadmap for the Hyderabad Market
Hyderabad’s security hiring is shaped by its Global Capability Centres — banking, insurance, pharmaceutical and healthcare firms running security operations for overseas parent companies. That changes how you should weight the roadmap.
- Weight the defensive track heavier. The volume of local openings sits in security operations, not offensive testing. If your goal is a first job in this city, stage 4 has an obvious answer.
- SIEM experience is the differentiator. In stage 5, spend your time there rather than spreading across ten tools.
- Compliance awareness helps more than it does elsewhere. Most GCC security work happens under audit obligation, so ISO 27001 and NIST vocabulary is worth having even in a technical role.
- Shift work is normal at entry level. SOC roles in GCCs frequently run 24/7 coverage. Worth knowing before you commit, not after.
If you want the sequenced version of this with a trainer and a lab, our cyber security training in Hyderabad covers stages 1 to 8 in three months, classroom in Kukatpally or live online. SOC analyst training is the defensive specialisation; ethical hacking is the offensive one.
Mistakes That Derail a Cybersecurity Roadmap
- Starting with hacking tools. The most common failure. Tools without networking and operating systems underneath produce someone who can run a scan and cannot explain the output.
- Collecting courses instead of finishing one. Four half-completed courses is worth less than one finished with its projects.
- Choosing a track from social media. Offensive security looks more exciting online. Defensive security has more openings and a clearer ramp.
- Certification first. A credential with nothing behind it is transparent in the first interview question.
- Never writing anything. Security work is half investigation, half communication. A strong finding written badly gets ignored.
- Learning offence without defence, or the reverse. Understanding both sides is what makes either side useful.
- Waiting to feel ready. Nobody feels ready. Apply once you have projects you can explain.
Frequently Asked Questions
What is the cybersecurity roadmap for beginners?
Networking foundations, then operating systems (Linux, Windows and Active Directory), then security fundamentals, then choosing a defensive, offensive or GRC track, then hands-on tools and labs, then projects with written reports, then one certification, then the job search. The order is the point — each stage depends on the one before it.
How long does the cybersecurity roadmap take?
Three to six months of consistent effort for most beginners, at roughly 10 to 15 hours a week. Full-time instructor-led training compresses the first half. Someone from a system or network administration background can move considerably faster because stages 1 and 2 are already covered.
What should I learn first in cybersecurity?
Networking. It underpins every defensive role and it is where weak candidates are identified fastest in interviews. Learn to read traffic and explain a session before you touch a single security tool.
Do I need coding to follow a cybersecurity roadmap?
Not to start. Entry-level defensive roles rely on reading logs, understanding protocols and investigating systematically. Basic Python or PowerShell becomes valuable at stage 5 for automation and for mid-level roles, but it is not a prerequisite.
Should I choose defensive or offensive security?
Defensive, if your goal is a first job — it has the most entry-level openings in India and a clearer path in. Choose offensive if you specifically want testing work and can accept a longer runway, since most junior testing roles go to people with prior systems, network or development experience.
Can I follow a cybersecurity roadmap without an IT background?
Yes. No computer science degree or prior security experience is required. What you do need is basic computer literacy, willingness to work at a command line, and time for labs. Budget extra weeks for stages 1 and 2 rather than trying to move at the same pace as someone from IT.
Which certification should I do first?
CompTIA Security+ is the widely recognised baseline that most job descriptions name. An entry-level credential such as ISC2’s Certified in Cybersecurity can come earlier if you want something while building projects. Take either after you have hands-on work behind you, and confirm current exam codes and fees on the certifying body’s website before booking.
How many projects do I need before applying for jobs?
Three to five finished pieces of work, each with a written report you can walk through. The number matters less than your ability to explain your decisions, including what you got wrong and how you corrected it.
Is cybersecurity still a good career to start in 2026?
Entry-level hiring is competitive and the bar for demonstrable skill has risen — project work and hands-on evidence matter more now than a certificate alone. The work itself keeps expanding, particularly around cloud, identity and AI-related security. Treat the roadmap as the minimum, not as a guarantee.
Can I learn cybersecurity on my own without a course?
Yes, and many people do. Self-study demands two things most beginners underestimate: the discipline to follow the sequence rather than jump to the interesting parts, and a lab environment you build and maintain yourself. Structured training mainly buys you sequencing, a ready lab and someone to ask when you are stuck.
What jobs can I apply for after finishing the roadmap?
SOC analyst, cybersecurity analyst, security operations analyst, network security analyst, vulnerability assessment analyst and junior penetration tester. Incident response, threat intelligence and digital forensics roles usually expect operational experience first.
Does the roadmap change for the Hyderabad job market?
The stages stay the same; the weighting changes. Hyderabad’s Global Capability Centres concentrate hiring in security operations, so the defensive track and SIEM depth matter more here than offensive tooling, and compliance vocabulary is worth having even in technical roles.
Start at stage 1, with a trainer and a lab
Sit in on a real session in Kukatpally or online, see the lab setup, and ask where your background puts you on this roadmap. No obligation.
Reference sources. Framework and certification details in this article draw on primary sources including MITRE ATT&CK, the OWASP Top 10, NIST, CompTIA and ISC2. The current OWASP Top 10 is the 2025 edition, released in November 2025 and finalised in January 2026. Certification codes, fees and exam formats change; confirm current details with the certifying body before booking.
Published by Cyber Security Academy, Kukatpally, Hyderabad. Last reviewed September 2026.