Cybersecurity roadmap

A practical sequence for learning security without getting lost in random platforms, tools, and advice. Start at the first stage that exposes gaps, then move downward with evidence.

The flow

Move through one stage at a time

Stage 01

Build the base

4-6 weeks

Become comfortable with Linux, networking, HTTP, Git, and the way security notes are written.

  1. Use Linux daily and learn the shell commands you actually need for recon, files, processes, and services.
  2. Review TCP/IP, DNS, HTTP, TLS, routing, and common service ports until packet captures feel readable.
  3. Keep short notes for every concept: what it is, how to test it, and one command or tool that proves it.

Stage 02

Follow one guided path

6-10 weeks

Turn isolated basics into a repeatable workflow for enumeration, testing, exploitation, and reporting.

  1. Pick one structured platform path and finish it before adding more platforms.
  2. Write a small methodology for each category you meet: web, Linux, Windows, Active Directory, crypto, forensics.
  3. Repeat solved rooms from memory after a few days to check whether the process is becoming yours.

Stage 03

Solve with the team

Weekly

Build speed and judgment by solving alongside other members instead of practicing alone all the time.

  1. Join weekly team practice, ask for hints only after you can show what you already tested.
  2. Take one challenge category per session and write down the exact decision that unlocked progress.
  3. Present one short walkthrough or failed attempt so the team can compare methods.

Stage 04

Choose one lane

2-4 month cycles

Stop spreading effort across everything and go deep enough in one track to build useful skill.

  1. Choose web, red team, blue team, reverse engineering, forensics, cloud, or Active Directory for one full cycle.
  2. Build a reading list and lab list for that lane, then schedule practice blocks around them.
  3. Keep a portfolio artifact: write-up, script, detection rule, exploit notes, or lab report.

Stage 05

Validate with exams

When ready

Use certifications as a checkpoint for discipline and proof, not as a replacement for practice.

  1. Pick an exam only when it matches your current lane and you can explain why it helps your next step.
  2. Map exam objectives to your notes, then close the gaps with labs before buying attempts or vouchers.
  3. Practice timed reporting so the final result is readable, reproducible, and professional.

Stage 06

Prepare for competitions

Seasonal

Convert your training into performance for CTFs, olympiads, and public events.

  1. Build a small personal toolkit for notes, snippets, wordlists, scripts, and challenge templates.
  2. Review previous competitions and classify tasks by pattern, not just by final answer.
  3. Do a post-event review within 48 hours: what worked, what blocked the team, and what to train next.

Resources

Keep the toolset focused

Start here

  • Linux shell and file permissions
  • Networking, DNS, HTTP, and TLS
  • Git, Markdown, and reproducible notes

Web security

  • PortSwigger Web Security Academy
  • OWASP Top 10 with lab evidence
  • Burp Suite basics and request analysis

Defensive practice

  • Packet captures and log review
  • CyberDefenders and detection write-ups
  • Incident timelines and short reports

Team work

  • Weekly CTF practice
  • Shared notes and post-event reviews
  • Short internal walkthroughs

Questions

Common roadmap decisions

Where should a complete beginner start?

Start with Stage 01 and stay there until Linux, networking, HTTP, and basic notes feel usable. Beginner labs are enough at this point.

How fast should I move through the roadmap?

The dates are estimates. Move forward when you can repeat the work and explain your evidence without following a walkthrough line by line.

Do I need certifications?

No. Certifications are useful when they support a clear direction. Practice, notes, projects, and team contributions matter first.

How does this connect to Aegis activities?

Use the roadmap to prepare for team practice, events, CTFs, and olympiad training. Bring your notes and gaps to the group.

Next step

Bring your current stage to the team

Use this page to decide what to practice this week, then join a session with notes, evidence, and one clear question. The roadmap works best when it turns into shared practice.