In June 2015 I stood in a small room inside a government facility with one slide: "Breaking Into the Cybersecurity Industry." I've given that talk at 133+ events since, and it's still the conversation I care about most. This is the written version, updated for 2026, for anyone serious about getting in.
You don't need a degree to start. You need a plan, a lab and the habit of showing your work. This roadmap is the order we'd learn it in, and it starts with a free course: Breaking Into Cyber is free.
Pick a direction first
Cybersecurity isn't one job. Before you study, get a rough idea of which work pulls you. Each of these paths has its own roadmap:
- SOC analyst: watch the alerts, investigate and respond. SOC Analyst Roadmap
- Penetration tester: find the weaknesses before an attacker does, with permission. Penetration Tester Roadmap
- GRC analyst: turn requirements into practice and prove it with evidence. GRC Analyst Roadmap
- Cloud security: design and protect systems in AWS, Azure and Google Cloud. Cloud Security Roadmap
- Security leadership: run the program and own the risk decisions. vCISO Roadmap
You don't have to decide everything now. Pick a direction. You can change it later.
The Breaking Into Cyber ladder
- Bridge role. Help desk, IT support or junior compliance work. Your first job may not say "cybersecurity" in the title, and that's fine.
- Entry security role. SOC analyst, GRC analyst or junior penetration tester.
- Specialist. Incident response, forensics, cloud security, offensive security or assessment.
- Lead. Run a team or a program. From here the path continues into security leadership and the vCISO path.
The Breaking Into Cyber roadmap, phase by phase
Phase 1: Learn the field and make a plan (free)
Breaking Into Cyber is free. In about 80 minutes you leave with a one-page plan: which roles fit you, which certifications matter and when, and how to show your work. No tech experience needed.
Then learn the basics everything else is built on: TCP/IP, DNS, subnetting, the OSI model and the Linux command line. Intro to Cybersecurity is also free: 16 modules and 70+ written lessons, from recon and scanning to logs and incident response. New to the vocabulary? Watch 100 Cybersecurity Terms To Know first.
Phase 2: Build your lab (free)
You can't learn this by reading alone. Home Lab Setup is free and walks you through building a lab on a computer you already own; 8 GB of RAM and 50 GB of free disk is enough. You'll use free tools like VirtualBox, Kali Linux, Wireshark and Nmap.
For guided practice outside our courses, TryHackMe is a good first platform, and Hack The Box is the next step up.
Phase 3: Choose a side and get hands-on
Defense (SOC, incident response, threat intel): learn a SIEM, read logs and learn what normal looks like so you can spot what isn't. Cover6: First Watch is free: seven days in your own Splunk lab, working a ransomware intrusion at a fictional university.
Offense (penetration testing): learn scanning, vulnerability assessment and web testing. Cover6: First Shell is free: land your first shell six different ways in a private lab that runs in your browser.
Phase 4: Prove it and get seen
Cover6 Breaking Into Cyber Challenge is free and tough by design: a 60-question exam in 90 minutes, a hands-on practical in your own lab and a one-hour written follow-up.
Then show your work. Write up your labs. Put your scripts on GitHub. Post what you're learning on LinkedIn. Think of a pickup basketball court. By the time you call next, the person picking teams has already watched you shoot. Hiring works the same way. Apply when you meet most of a job posting, not all of it. Job posts are wish lists. And look hard at bridge roles.
You don't have to sprint. An hour a day, every day, adds up faster than you think. And you don't have to do it alone. The Cover6 Community has 10,000+ members and free events. Join us on Meetup and Discord, or submit a talk.
Certifications on this path
You don't need a certification to start. They help you get past résumé filters once you're applying. Professor Messer's free CompTIA video courses pair well with any of these.
- ISC2 CC: a lower-cost first certification covering the fundamentals. CC Exam Prep + Study Guide (free)
- CompTIA Network+: networking fundamentals. Network+ (N10-009) Exam Prep (free)
- CompTIA Security+: the most recognized entry-level security certification; federal contractors often ask for it by name. Security+ (SY0-701) Exam Prep ($39)
- CompTIA CySA+: the defensive next step. CySA+ (CS0-004) Exam Prep ($39)
- CompTIA PenTest+: the offensive next step. PenTest+ (PT0-003) Exam Prep ($39)
Each prep includes a 25-question practice quiz, a timed practice exam, a study guide and unlimited retakes.
Which path is yours?
Breaking Into Cyber is the starting point for every other path. When you know which work you like, open that path's roadmap from the list at the top. Still not sure? Take the free career path assessment.
Start here
Breaking Into Cyber is free. Enroll on that page and leave with your one-page plan. When you're ready, Intro to Cybersecurity is the next step.