How to Start Learning Cybersecurity from Scratch (A Beginner's Roadmap)

Every week I hear some version of the same question: "I want to get into cybersecurity, but I don't know where to start." The honest answer is that most people don't start because nobody gives them a clear sequence. They Google their way into a pile of acronyms, feel stupid, and quit before they've even begun.

That stops today. This post is the roadmap I wish someone had handed me at the beginning — practical, sequenced, and free of hype.

Step 1: Understand What You're Actually Getting Into

Cybersecurity is not one job. It's an ecosystem. Before you pick a tool or pay for a course, spend a week just reading about the domains of the field:

Network security — protecting the pipes data travels through
Application security — securing software and web apps
Digital forensics & incident response — investigating attacks after they happen
Ethical hacking / penetration testing — finding holes before the bad guys do
Governance, risk & compliance (GRC) — the policy and legal side

Why does this matter? Because a beginner who wants to investigate cybercrime needs a very different path than one who wants to test corporate networks. Know your direction before you commit your time.

Step 2: Learn Networking First — No Shortcuts

This is the step most beginners skip, and it's why they struggle later. You cannot understand how attacks work if you don't understand how data moves.

Specifically, get comfortable with:

The OSI model — seven layers that explain how every network conversation happens
TCP/IP, DNS, HTTP/S, and ports — the protocols you'll see in every real investigation or attack scenario
IP addressing and subnetting — how devices find each other on a network
How routers and firewalls make decisions

You don't need a physical lab to start. Use free tools like Packet Tracer (from Cisco's free NetAcad program) or GNS3 to simulate networks on your own computer. Spend four to six weeks here. It will pay dividends for the rest of your career.

Step 3: Get Comfortable with Operating Systems

The two operating systems you must know are Windows and Linux.

Windows matters because most corporate environments run on it — and most attackers target it. Learn Active Directory, user permissions, event logs, and the registry.

Linux matters because most security tools live there. Start with Kali Linux (built specifically for security work) or Ubuntu if Kali feels too intense at first. Practice navigating the command line, managing files, and running scripts. If you can't move around a Linux terminal confidently, you'll hit a wall fast.

A practical exercise: Install Kali Linux as a virtual machine on your existing computer using VirtualBox (free). Run it alongside your main OS. Treat it like a sandbox — break things, fix things, learn.

Step 4: Learn to Think Like an Attacker

This is the mindset shift that separates people who memorize facts from people who actually understand security. Before you can defend anything, you need to understand how attacks are structured.

Study the MITRE ATT&CK framework — it's a free, publicly available knowledge base that maps out the tactics and techniques real attackers use, from initial access all the way through to covering their tracks. Bookmark it. Refer to it constantly.

Then explore CTF (Capture the Flag) challenges on platforms like TryHackMe or Hack The Box. These are legal, gamified hacking environments where you practice breaking into intentionally vulnerable systems. They're the closest thing to real-world experience you can get for free.

Step 5: Pursue Your First Certification

Certifications are not a substitute for knowledge — but they signal credibility and give you a structured curriculum. For beginners, these three are the most respected starting points:

CompTIA A+ — if you need to build foundational IT knowledge first
CompTIA Network+ — validates your networking fundamentals
CompTIA Security+ — the industry's go-to entry-level security cert, recognized by the US Department of Defense and employers nationwide

Study for Security+ using the official CompTIA materials, supplemented by Professor Messer's free video course online. Budget roughly three to four months of consistent study.

Step 6: Build a Portfolio, Not Just a Resume

Employers and clients want proof. As you learn, document everything:

Write up CTF solutions in a simple blog or GitHub repository
Build a home lab and screenshot what you've configured
Complete free courses and collect the certificates

One demonstrated project is worth more than a list of buzzwords on a resume.

The Honest Truth About the Timeline

You can become job-ready in cybersecurity in twelve to eighteen months with consistent, focused effort. Not days. Not a weekend bootcamp. But also not the decade some people make it sound like. The field rewards people who are curious, methodical, and willing to keep learning — because the threats never stop evolving, and neither do the defenders.

If you're ready to go beyond the basics — to learn how attackers think, how investigations are conducted, and how to operate as a serious security professional — that's exactly what I've built CyberShield Academy for. It picks up where this roadmap leaves off.

Start here. Build the foundation. Then come hungry for the next level.