Learning Cybersecurity from Scratch: A Realistic 6-Month Self-Study Roadmap

Most cybersecurity roadmaps fail in the same quiet way. They list fifty topics, link to a pile of courses, and leave you to figure out the order, the pace, and what "done" looks like for each step. Three weeks in, you have watched a dozen videos, finished nothing, and you are no closer to a job than when you started. This roadmap is built to avoid that trap. It covers six months, assumes you are starting from zero, and tells you exactly what to study, what to build, and what to skip each month.

Before the detail, one honest note: you do not need a computer science degree, a paid bootcamp, or an expensive lab setup to start learning cybersecurity from scratch. You need a working laptop, a steady internet connection, and roughly 10 to 15 hours a week. That is the whole budget this plan is built around. If you can give it more time, you will move faster. If you can give it less, the plan still works — it just takes longer, and you should stretch each month rather than rush through it.

A VPN is one of the first practical tools worth having while you learn. Public Wi-Fi, lab platforms, and research on unfamiliar sites are all part of this field, and protecting your own connection while you work is a habit worth building early. NordVPN is a solid starting point for that, and it is the one we link to through this guide. You will see it again in the verdict, where it fits the job-search stage of the plan.

The short answer

Six months is enough to go from zero to a credible beginner: someone who understands networks and Linux, can use the core security tools, has completed real labs, can explain common web vulnerabilities, understands how a security operations centre works, and has a small portfolio to show for it. Six months is not enough to become a senior analyst, a penetration tester, or a specialist in any one area. Anyone promising that is selling you something.

The plan runs in this order for a reason. Month 1 builds the foundations everything else stands on. Month 2 adds the security concepts. Month 3 is where you start breaking and fixing things in labs. Month 4 goes deep on web and application security. Month 5 covers detection and SOC work. Month 6 turns all of it into a portfolio and a job search. Skip ahead and the later months will feel like memorising phrases in a language you never learned to speak.

Key takeaways

• Budget 10 to 15 hours a week. Consistency beats weekend cramming — an hour a day, most days, will carry you further than a single 12-hour Saturday.
• Month 1 is networking and Linux. Without those two, every tool you touch later will feel like magic, and magic is hard to debug.
• Free and low-cost resources carry this whole plan: TryHackMe, Hack The Box, and the OWASP project cover most of the hands-on work.
• Build something every month. Notes alone do not prove skill. A lab write-up, a small script, or a home lab setup does.
• CompTIA Security+ is a well-known entry-level certification and a reasonable optional goal at the end of the six months — not a requirement to start, and not a guarantee of a job.
• This roadmap will not make you job-ready for a senior role, and it will not replace real experience. It will make you a credible junior candidate with proof of work.

How this roadmap works

Each month has a theme, a weekly rhythm, and a finished piece of work. The weekly rhythm is the same throughout: three study sessions of about two hours, one longer lab session of three to four hours, and one short review session where you write up what you learned. That adds up to 10 to 15 hours a week. The review session matters more than it looks. Writing a short explanation of something forces you to find the gaps in your understanding, and those write-ups become your portfolio later.

Month 1: Foundations — networking and Linux

Month 1 is the least glamorous and the most important. Cybersecurity sits on top of networking and operating systems, and every shortcut you take here will cost you twice as much time later. When a scan returns nothing, when a lab machine will not connect, when a tool throws an error you do not understand — nine times out of ten, the answer is a networking or Linux concept you skipped.

Start with networking. Learn what an IP address is, how subnets divide a network, what DNS does, how TCP and UDP differ, and what happens, step by step, when you type a web address into a browser and press enter. You do not need to memorise packet headers. You need to be able to explain, in plain language, how data gets from your laptop to a server and back. The OSI model is worth learning as a map, not as a list to recite — use it to locate problems. If a connection fails, which layer is the problem on?

Linux is the second half of the month. Most security tools run on Linux, most servers run on Linux, and most lab environments expect you to be comfortable in a terminal. Install a Linux distribution in a virtual machine — Ubuntu is a fine starting point — and use the terminal for real tasks. Learn to move around the file system, manage files and permissions, read logs, manage processes, and install software from the command line. Learn how users, groups, and file permissions work, because access control is a security concept wearing a system administration costume.

By the end of Month 1, you should be able to set up a Linux virtual machine, explain how a web request travels across a network, use basic terminal commands without looking them up every time, and describe what DNS, TCP, UDP, and ports do. Your finished work for the month is a short write-up: a diagram of your home network and a one-page explanation of how a web request works, written in your own words. If you cannot explain it simply, you do not understand it yet — and that is useful information, not a failure.

Month 2: Security fundamentals

Month 2 is where the field starts to take shape. The goal is a working vocabulary and a mental model of how attacks and defences fit together — not a pile of memorised definitions. Start with the CIA triad: confidentiality, integrity, and availability. It sounds like textbook material, and it is, but it is also the lens professionals use to judge whether a control is doing its job. Every security measure you meet from now on protects one of those three things, usually at the cost of convenience somewhere else.

Authentication and authorization deserve a full week of this month. Learn the difference between proving who you are and proving what you are allowed to do. Study passwords properly — why length beats complexity, why reuse is the real danger, and how password managers change the problem. Learn how multi-factor authentication works, why SMS codes are weaker than app-based codes or hardware keys, and how single sign-on fits into the picture. This is also the right time to set up a password manager for yourself and turn on multi-factor authentication on your important accounts, including the lab platforms you use. Practise on your own accounts first; it makes the concepts stick.

Month 3: Hands-on labs — tools and practice

Month 3 is where the learning turns practical. Up to now you have been studying concepts. Now you start using the tools, in lab environments built for exactly that purpose. The rule for this month is simple: never run a scan, an exploit, or a test against a system you do not own or have explicit permission to test. Lab platforms exist so you never have to break that rule. Everything in this month happens on TryHackMe, Hack The Box, or your own virtual machines.

Start with TryHackMe. Its guided rooms walk you through the tools step by step, and that hand-holding is what you need at this stage. Work through the beginner paths — the ones covering Linux, networks, and introductory security — and take notes on every tool you use. Nmap for scanning, Gobuster or dirb for finding hidden web content, Burp Suite for inspecting web traffic, Hydra for password attacks in a lab, Wireshark for reading network traffic. For each tool, learn what it does, what a normal result looks like, and what its output is telling you. A tool you can run but cannot interpret is not a skill yet.

Then move to Hack The Box, starting with its easiest machines. The difference between the two platforms matters: TryHackMe teaches you the steps, Hack The Box makes you find them yourself. That gap is uncomfortable, and it is the whole point. Your first Hack The Box machine will take hours, and most of that time will be spent stuck. That is normal. Getting stuck, reading documentation, searching for the right approach, and trying again is the actual job. Write up each machine you complete — what you tried, what failed, what worked — and keep those write-ups. They are the beginning of your portfolio.

Month 4: Web and application security

Web security is the largest single area of junior security work, and it is where your earlier months pay off. The OWASP Top 10 — the OWASP project's list of the most common web application risks — becomes your syllabus now, and each item gets focused study and practice. The pattern for each vulnerability is the same: understand how it works, exploit it in a lab, then learn how to fix it. The fix is what employers care about. Anyone can run a scanner. Fewer people can explain the fix clearly enough for a developer to implement it.

Start with injection flaws, above all SQL injection. Learn how a database query is built, how an attacker changes its meaning by injecting input, and how parameterised queries stop it. Practise on the OWASP Juice Shop or WebGoat, both free and deliberately vulnerable applications built for learning. Then move to cross-site scripting: how attacker-controlled content ends up running in another user's browser, and how output encoding and content security policies limit it. Follow with broken access control — the most common real-world problem — and learn to test whether a user can reach data or functions they should not be able to.

Your finished work for Month 4 is a short vulnerability report, written as if for a client. Pick one vulnerable application, test it properly, and write up two or three findings with severity, evidence, impact, and a clear fix. Use screenshots of the evidence, describe the steps to reproduce each issue, and keep the language plain enough that a non-security manager could follow it. A good report is a skill in itself, and it is one of the first things an interviewer will ask you to demonstrate. For a closer look at one of the platforms behind this kind of practice, see our Hack The Box product page.

Month 5: Detection and SOC basics

Month 5 shifts your view from attacking to defending — specifically, to detection. A security operations centre, or SOC, watches for signs of attack, investigates alerts, and decides what to do about them. This is where a large share of entry-level security jobs actually sit, so understanding it is worth a full month even if your long-term goal is penetration testing. Attackers and defenders need to understand each other, and this month gives you the defender's half.

Start with logs. Logs are the raw material of detection: records of what happened, on which machine, at what time. Learn to read Windows Event Logs and Linux system logs, and learn what normal looks like before you try to spot abnormal. A failed login is normal. A hundred failed logins from one address in a minute is not. That sense of baseline — what a healthy system looks like — is the skill. Build it by watching your own machines first.

Then learn the tools that collect and search logs at scale. A SIEM — security information and event management — system gathers logs from many sources and lets an analyst search them in one place. Splunk has a free tier, and Elastic Security has a free and open-source option; either will do for learning. Set one up in your home lab, feed it logs from your virtual machines, and practise writing searches: failed logins by source, unusual outbound connections, processes running from strange locations. Write detection rules for a handful of common attacks and test whether they fire when you run the attack in your lab. That loop — attack, log, detect — is the heart of detection engineering.

Month 6: Portfolio and job preparation

Month 6 is not a study month. It is a packaging month. You have five months of work behind you; now you turn it into something an employer can judge in ten minutes. Start with the portfolio. A GitHub profile with your lab write-ups, your vulnerability report, your detection rules, and your study log. A short personal site or blog post that links it all together. Every item should answer the same question: what did this person actually do? A repository with three honest, well-written projects beats a profile full of forked tutorials. Our guide to cybersecurity for small business owners shows the same ideas from a small organisation's side.

Next, the CV. Security hiring managers read a lot of CVs from people with no experience, so yours needs to be short and specific. List the tools you can use, the labs you completed, and the projects you built — with links. Leave out the courses you started and did not finish. If you completed CompTIA Security+ or another entry-level certification, it goes here; if you have not, that is fine, and the certification is an optional extra rather than a requirement. The portfolio does the heavy lifting. The certificate, if you choose to get one, is supporting evidence, not the main argument.

Finally, apply. Target junior SOC analyst, security analyst, and IT support roles with a security angle — those are the realistic entry points, and they are also the roles where your detection work from Month 5 matters most. Tailor each application to the role. A generic CV sent to fifty companies will do worse than ten applications that mention the company's stack and explain why your lab work is relevant to it. Expect rejections. They are not a verdict on the plan. Most junior candidates apply for months before landing a role, and the ones who keep building while they apply are the ones who get hired.

What this roadmap will not do

Honesty about limits is part of this guide, so here they are, plainly. This roadmap will not make you a penetration tester. Professional penetration testing needs deeper knowledge, more lab time, and usually a year or more of focused practice beyond this plan. It will not make you a malware analyst, a cloud security engineer, or a specialist in any single area. Those are all real careers with their own roadmaps, and this plan is the foundation under all of them, not a shortcut to any one of them.

It will not guarantee you a job. No six-month plan can. The job market, your location, and your interview performance all matter, and none of them are in this guide's control. What the plan does is give you a genuine, checkable set of skills and a portfolio that proves them. That puts you ahead of most applicants who have only watched courses — but it is a starting position, not a finish line.

It will not teach you everything, and it should not try. Cybersecurity is too wide for any one roadmap. After Month 6, the right move is to pick a direction — SOC work, web testing, cloud security, or something else — and go deeper there, with the foundation this plan built. The people who last in this field are the ones who keep learning after the roadmap ends.

Common mistakes to avoid

The first mistake is collecting courses instead of finishing them. A library of half-watched videos is not progress. Pick one resource per topic, finish it, and move on. The second mistake is skipping the write-ups. Notes feel like a chore when you are in the middle of a lab, but they are the difference between learning and merely doing. The third is practising only on guided platforms and never on a machine where you have to find the path yourself. Guided labs teach the steps; unguided ones teach the thinking. You need both.

The fourth mistake is ignoring the basics. It is tempting to jump to exploitation, to the exciting parts, before the networking and Linux work is solid. Resist it. The people who struggle most in interviews are not the ones who never learned advanced attacks — they are the ones who cannot explain a subnet or read a log. The fifth mistake is learning alone and silently. Join a community, a study group, or a forum for beginners. Ask questions. Answer other beginners' questions when you can — teaching is the fastest way to find out what you actually understand.

The verdict

Six months, 10 to 15 hours a week, free and low-cost resources, and a portfolio built as you go: that is the whole plan. It will not turn you into an expert. It will turn you into a beginner with real skills, real lab experience, and real proof of work — and that is a strong place to start a security career from.

Start with Month 1 this week, not next month. Set up the Linux virtual machine, run your first Nmap scan on your own network, and write up what you found. The first week is the hardest part of the whole plan, because it is the week where learning becomes a habit instead of an intention. After that, the months take care of themselves.

And keep your own security in order while you learn it. A VPN on public networks, a password manager, and multi-factor authentication on your accounts are the first three habits of the field, and they cost very little to build now. NordVPN covers the first of those three, and it is the tool we recommend for it in this guide. If you want the full picture of the platform behind your lab practice, our NordVPN product page has the detail.

Disclosure: SaaSNivo may earn a commission if you buy through some links in this guide, including the NordVPN and Hack The Box links above, at no extra cost to you. That does not change our recommendations.

Frequently asked questions

Can I learn cybersecurity from scratch in 6 months?

Yes, to a credible beginner level. Six months at 10 to 15 hours a week is enough to learn networking, Linux, security fundamentals, hands-on labs, web security, and detection basics, and to build a small portfolio. It is not enough to become a specialist or a senior analyst.

Do I need a degree to get a cybersecurity job?

Not for most junior roles. Employers hiring junior SOC analysts and security analysts usually care more about demonstrable skills and a portfolio than a degree. A degree helps, and it matters more for some employers and some countries, but it is not a universal requirement.

How many hours a week does this roadmap need?

About 10 to 15 hours a week: three study sessions of two hours, one lab session of three to four hours, and one short review session. Less time still works if you stretch each month out. More time moves you faster, but only if you keep the write-ups and the lab work in the plan.

Is CompTIA Security+ worth it for a beginner?

It is a well-known entry-level certification and a reasonable optional goal after this roadmap. It can help a CV pass an initial screen, especially for SOC roles. It is not a requirement to start learning, and it is not a guarantee of a job on its own.

Should I start with TryHackMe or Hack The Box?

Start with TryHackMe. Its guided rooms teach you the tools step by step. Move to Hack The Box once you are comfortable with the basics — its machines expect you to find the path yourself, which is harder and more realistic.

Can I learn cybersecurity for free?

Mostly, yes. The free tiers of TryHackMe and Hack The Box, the OWASP guides, and free SIEM options cover the hands-on work in this plan. Paid upgrades add convenience and more content, but they are not required to complete the six months.