Self-taught cybersecurity
0 / 0 done
← Academy

A route, not a syllabus · every course is free or free-tier

Can you teach yourself cybersecurity from open courses?Yes. This is the route.

Cybersecurity is unusually friendly to self-teaching: the best labs in the field are free, hiring leans on demonstrated skill, and the foundations are ordinary networking, operating systems and code. The route below sequences the open courses so that each one assumes only what came before it.

Route map: four trunk phases, a junction into six specialisation tracks, and a parallel "prove it" line running from phase 2 onward. 5 · Prove it — CTFs, write-ups, one or two certs · runs alongside from phase 2 0 Foundations 4–8 wk 1 Security basics 8–12 wk 2 Hands-on core 12–16 wk 3 Depth 8–12 wk 4 A · Offensive / pentest B · Defensive / SOC C · Cloud security D · Application security E · AI security F · Governance & risk
₹0Cost of every course on this page
12–18 monthsFrom zero, at 8–10 hours a week
US$0–700Optional spend on a first exam or two

Labs over lectures

Video courses give you vocabulary; wargames and labs give you skill. From phase 2 onward, aim for two hours in a lab for every hour of video. Every phase below pairs the two.

Free to learn, not free to prove

All the material here is open. The exams employers recognise cost money, so the plan treats certifications as a final, optional step and lists them by price.

Order matters

Security sits on top of networking, operating systems and code. The route front-loads those so that later labs are reasoning, not guesswork.

Fast track Already a developer or systems engineer? Start at phase 1, skim Security+ for vocabulary only, and spend the saved weeks in phases 2 and 3. Expect 6–9 months to the end of a track.

Free fully free, no card needed Free tier core content free, some modules paid Audit watch and read free; pay only for the certificate PWYC pay what you can the prep is free, the exam is not
0

Foundations

4–8 weeks · skip anything you already know

Every later lab assumes you can read a packet capture, move around a Linux shell, and script a repetitive task. Do only the items that are actually gaps.

1

Security foundations

8–12 weeks · vocabulary and mental models

Threat models, the CIA triad, cryptography basics, identity, common attack classes. The Security+ objectives are the industry's de facto checklist of what "entry level" means; CS50 explains the same ideas from first principles.

2

Hands-on core

12–16 weeks · where the learning actually happens

From here on, labs lead and video supports. Keep a notes file per lab: what you tried, what worked, why. Those notes become the write-ups in phase 5.

  • TryHackMe — Cyber Security 101 path Free tier≈ 50 h

    Guided rooms across networking, web, Windows and Linux internals, cryptography and tooling. Most rooms are free; the subscription is cheap if you want all of them.

  • Hack The Box Academy — fundamentals modules Free tierTier 0 modules

    Linux Fundamentals, Windows Fundamentals, Introduction to Networking, Web Requests, Introduction to Web Applications. The free tier covers these; higher tiers need a small subscription.

  • Hack The Box — Starting Point Free tierguided machines

    Your first real shells on real targets, with a guided walkthrough for each box.

  • PortSwigger Web Security Academy Free200+ labs

    Completely free, from the makers of Burp Suite. The best web-security training in existence, paid or otherwise. Do the "apprentice" labs now and come back for the rest in track D.

  • OverTheWire — Natas, Leviathan, Narnia, Krypton Freewargames

    Web (Natas), Linux privilege escalation (Leviathan), binary basics (Narnia), classical crypto (Krypton). No accounts, no cost, no hand-holding.

  • picoCTF (Carnegie Mellon) Freepermanent practice CTF

    Hundreds of challenges across every category, sorted by difficulty. A standing gym for the rest of the route.

  • pwn.college (Arizona State University) Freefull curriculum

    A complete university course in binary exploitation delivered as levels, from "what is a program" to kernel exploitation. Start with the Fundamentals dojo.

  • OpenSecurityTraining2 Freedeep courses

    University-depth classes: x86-64 assembly, debuggers, reverse engineering, vulnerability classes, trusted computing. Slow, thorough, free.

  • OWASP Juice Shop Freeopen source

    A deliberately vulnerable web app to run locally and break. Pairs with the PortSwigger labs.

  • OffSec — Metasploit Unleashed Freereference course

    The free course on the Metasploit framework from the people behind the OSCP.

  • CTF 101 handbook Freereference

    A short primer on each CTF category. Keep it open while solving.

3

University depth

8–12 weeks · optional · run it in parallel with phase 2

These courses explain why attacks work at the level of memory, protocols and browsers. They separate people who can follow a tutorial from people who can reason about a system nobody has written a tutorial for.

4

Pick a track

12–16 weeks · one track, then breadth later

Generalists are made from specialists, not the other way round. Choose one line, ride it for three to four months, and let the others wait. Each track ends with the certifications people in that line actually recognise.

A

Offensive / penetration testing

For people who enjoyed the wargames most. Methodology, enumeration, exploitation, privilege escalation, Active Directory.

Target certs eJPT (≈ US$250) → PNPT (≈ US$400) → OSCP (≈ US$1,750 with course). eJPT · OSCP / PEN-200

B

Defensive / SOC / blue team

Where most first jobs are. Detection, log analysis, incident response, threat hunting, malware triage.

Target certs BTL1 (Centri, formerly Security Blue Team, ≈ US$500) · CompTIA CySA+ · Cisco CyberOps Associate.

C

Cloud security

Identity, misconfiguration and logging across AWS, Azure, GCP and Kubernetes. High demand, thin supply.

Target certs SC-900 (US$99) → AZ-500 or AWS Certified Security – Specialty · CCSK for vendor-neutral.

D

Application security

The natural track for developers: finding and fixing vulnerabilities in code, pipelines and web apps.

Target certs Burp Suite Certified Practitioner (US$99) · OSWE later. For many AppSec roles, a portfolio of fixed bugs beats any cert.

E

AI security & LLM red-teaming

The newest line. No settled certification yet, so write-ups and tools count for more than anywhere else.

Target certs none standard yet. Publish: a garak or PyRIT run against an open model, a prompt-injection case study, a threat model using ATLAS.

F

Governance, risk & compliance

Frameworks, audit, policy and risk. Less code, more judgement; often the fastest route in for people with management experience.

Target certs Security+ · ISC2 CC · later CISA, CISM or CISSP (these require documented experience).

5

Prove it

ongoing from phase 2 · evidence beats claims

Nobody hires "self-taught" on the word alone. They hire on write-ups, CTF rankings, repositories, community presence and one or two well-chosen exams. Start producing evidence the week you start phase 2.

Publish

  • A blog with one write-up per lab or machine. Model it on 0xdf: what you tried, what failed, why the final path worked.
  • A GitHub account with your scripts, notes and any tool you build. Readable READMEs matter more than clever code.
  • A running "cheat sheet" repository you update after every phase.

Compete

Join

  • null — India's open security community, with free monthly meets in every major city, and its conference Nullcon.
  • OWASP chapters and DEF CON groups — local, free, worldwide.
  • The TryHackMe and Hack The Box Discord servers for day-to-day questions.

Stay current

Certifications, by price

The preparation for every one of these is free and already on this page. Buy at most one or two, chosen for the track you picked, and only once the labs feel easy.

CertificationTrackList priceWhy
Microsoft SC-900C · CloudUS$99Easiest first credential; identity and zero-trust vocabulary.
Burp Suite Certified PractitionerD · AppSecUS$99Credible web-security proof; prep is the PortSwigger labs.
ISC2 Certified in CybersecurityF · GRCUS$199Foundational, vendor-neutral; ISC2 brand recognition.
eJPTA · Offensive≈ US$250Practical junior pentest exam; a fair first offensive cert.
CompTIA Security+Any≈ US$400The HR filter. Regional vouchers are cheaper; prep is Professor Messer.
PNPTA · Offensive≈ US$400Realistic Active Directory pentest with a written report and debrief.
BTL1B · Defensive≈ US$500Practical 24-hour blue-team incident investigation.
OSCPA · Offensive≈ US$1,750The pentest standard; includes the PEN-200 course and lab time.

A week that works

3 hLectures & reading

The current course, at 1.5×, notes open.

5 hLabs

One long session beats five short ones. Get stuck; stay stuck a while.

1 hWrite-up

Document the week's lab while it is fresh. This is the portfolio.

1 hField

ISC diaries, one podcast, one community thread. Know what is happening now.

Ten hours a week gives the timeline on the right. Five hours roughly doubles it; twenty roughly halves it, with diminishing returns past that because retention needs sleep between sessions.

PhaseDurationCumulative
0 · Foundations4–8 wk2 mo (skip if experienced)
1 · Security foundations8–12 wk≈ 4–5 mo
2 · Hands-on core12–16 wk≈ 8 mo
3 · University depth8–12 wkoverlaps phase 2
4 · One track12–16 wk≈ 12 mo
5 · Prove itongoingfrom month 5