How to Learn Cybersecurity from Scratch in 2026: The Complete Beginner’s Roadmap

A six-month study guide covering networking, Linux, Windows administration, SIEM tools, Security+ preparation, and practical lab milestones.

You open a beginner cybersecurity course and meet a wall of unfamiliar terms: DNS, Linux permissions, SIEM, incident response. Then someone recommends a different course, a certification, and a collection of hacking tools. Where should you actually begin?

If you want to learn cybersecurity from scratch, start with how computers, networks, and accounts work. Then learn how to protect them, recognize suspicious activity, and explain what the evidence shows. Tools become easier to understand when you know which question you are using them to answer.

This roadmap gives you a six-month sequence with a practical result at every stage. It is designed for someone without professional IT experience. You can follow it at home, through a structured course, or with a mentor. The aim is a solid foundation and a small portfolio- not a promise of an exam pass or a job within six months.

What should you learn first in cybersecurity?

Begin with networking and operating systems, alongside basic security concepts. Networking explains how devices communicate. Windows and Linux administration explain how accounts, files, services, and permissions behave. Security concepts help you decide what needs protection and why.

Learn three terms early. A vulnerability is a weakness. A threat is something that could cause harm. Risk considers the likelihood and consequences of harm in a particular context. An unpatched application, for example, matters differently depending on its exposure and the information it handles.

Also learn confidentiality, integrity, and availability: keeping information accessible only to appropriate people, protecting it from improper changes, and keeping systems usable when needed. These ideas connect technical tasks to the people and services they protect.

How to use this six-month roadmap

Treat each month as roughly four weeks of focused work, with spare weeks for review. A suggested starting schedule is eight to ten hours per week: two hours learning concepts, four to five hours practising, and two to three hours reviewing and writing up your work. This is an editorial planning suggestion, not a universal workload requirement.

If a milestone still requires a walkthrough, spend more time on it before adding another tool. Progress means being able to explain and repeat a task, including what went wrong.

Keep a learning notebook from the first week. For each exercise, record the question, environment, steps, evidence, conclusion, and limitations. That habit will make your later portfolio much easier to build.

Before you start: set up a manageable learning environment

You need access to a computer, a place to save notes, and an environment where practice is explicitly permitted. Browser-based labs can be useful if your computer cannot comfortably run virtual machines. Local virtualization is another option when the hardware, operating system, and software licensing support it.

Start with one Linux environment and access to a Windows training environment; you do not need to run an entire enterprise network immediately. Check the lab provider’s requirements before paying. For a local lab, use a private or isolated network, keep intentionally vulnerable machines off the public internet, and use test accounts and fictional data.

Practise only on your own lab systems or environments that authorize the activity. If you use a cloud lab, check its costs and remove resources when finished. A simple setup you understand is more useful than several installations you cannot maintain.

Month 1: understand networking and basic security

Weeks 1–2: follow a connection

Learn what clients, servers, switches, routers, and firewalls do. Understand IP addresses, basic subnets, DNS, DHCP, ports, and the purpose of TCP and UDP. You do not need to memorize every protocol before starting a lab.

Follow a familiar action: opening a website. How does the device find an address? How does traffic reach the destination? What does encryption protect, and what information remains visible along the way?

Cisco’s Networking Basics course is a useful starting resource for network devices, protocols, and communication. Work through concepts actively: draw a connection and explain it in your own words.

Weeks 3–4: observe normal activity

Use a network simulator or an authorized packet-capture exercise to identify source and destination addresses, protocols, and ports. If you use Wireshark, begin with supplied training captures or traffic from a lab you control. Encrypted traffic will not simply reveal the contents of a session.

Connect each observation to a security question. A port identifies a communication endpoint; it does not establish that traffic is malicious. A firewall decision depends on the rule and context.

Lab milestone: produce a labelled network diagram and a short explanation of one connection, including DNS resolution and the destination port. You are ready to move on when you can distinguish an address, a service, and a protocol without relying on a glossary.

Month 2: become comfortable with Linux

Weeks 5–6: files, commands, and permissions

Learn to navigate directories, create and inspect files, search text, and understand paths. Then practise users, groups, ownership, and read, write, and execute permissions. Learn when administrative privileges are required rather than running every command with elevated access.

Ubuntu’s Linux command-line tutorial assumes no prior knowledge and provides exercises in file operations, command combinations, and administrator privileges. Use it as a foundation, then repeat the tasks with different lab files.

Weeks 7–8: services and records

Learn what a running process and a service are, how software updates are managed, and where your lab system records relevant activity. Log locations and formats differ between distributions and configurations, so consult the documentation for your environment.

Create two test users and a fictional project folder. Set permissions so one user can modify the folder while the other has only the intended access. Test both accounts and record the result.

Lab milestone: write a short Linux permissions report showing the requirement, configuration, and verification. Include one service or log observation. You should be able to explain why an operation was allowed or denied, not just reproduce the command.

Month 3: learn Windows administration and identity basics

Weeks 9–10: manage a small Windows environment

Study local users and groups, standard versus administrator accounts, file permissions, updates, services, and basic firewall settings. Learn to inspect activity in Event Viewer and perform a small read-only PowerShell task, such as listing services.

Next, learn what a domain and Active Directory do at a conceptual level. A local account belongs to a computer; a domain account is managed through the directory. Building a domain can be an optional extension after you understand local accounts, rather than a prerequisite for every beginner.

Weeks 11–12: connect actions to evidence

In an authorized Windows lab, inspect a failed sign-in and identify the relevant account, time, and failure context. Microsoft’s failed-logon event reference explains event 4625 and its fields. What you can observe depends on the system and audit configuration, so a missing record does not prove that nothing happened.

Compare an ordinary mistake with a hypothetical pattern of repeated attempts. What additional context would help you distinguish them? Avoid treating a single failed sign-in as proof of compromise.

Lab milestone: document a test account’s permissions and create a short sign-in timeline. Explain the difference between the event you observed and the conclusion you can reasonably draw.

Month 4: investigate logs with a SIEM tool

Weeks 13–14: search and organize events

A security information and event management system, or SIEM, brings event data together to support detection and investigation. Start with one platform and a small dataset rather than trying to master several products.

Learn to select a time range, filter by account or host, count events, and inspect the original records behind a result. Check whether the data was parsed correctly and whether timestamps use the same time zone.

Splunk’s search introduction points beginners toward its Search Tutorial for adding data, searching, and creating reports. Use a tutorial dataset to learn the interface, then apply the same habits to a clearly labelled security training dataset. General search practice alone is not a complete security investigation.

Weeks 15–16: build a small investigation

Use synthetic or authorized sample authentication records. Compare successful and failed activity, group events by a relevant field, and identify a pattern worth reviewing. Explain how missing fields or an incomplete time range could affect your conclusion.

If you create a detection rule, state its assumption and test it against both suspicious and benign examples. A rule that alerts on every login is noisy; a rule that never alerts may be missing the behavior you wanted to detect.

Lab milestone: save a query and write a one-page investigation containing the timeline, supporting events, alternative explanation, and recommended next check. A dashboard screenshot can illustrate your work, but the written reasoning is the main result.

Month 5: connect your skills to CompTIA Security+ preparation

Weeks 17–18: map your knowledge to exam objectives

Use the official CompTIA Security+ information to find the objectives for the exam version you intend to take. Match your study materials to that version and confirm its availability before booking. A learner beginning late in 2026 may sit an exam in 2027, so do not rely on an old course title or an assumed retirement date.

Turn the objectives into a study checklist. Mark topics you can explain, topics you have practised, and topics needing review. Use your earlier labs to make abstract ideas concrete: permissions illustrate access control, while login records support monitoring and investigation.

Add topics your technical labs may not cover fully, such as risk decisions, policies, recovery planning, and organizational responsibilities. The objectives should guide the gaps you investigate.

Weeks 19–20: practise explaining decisions

Use legitimate practice questions and review why each answer fits the scenario. If you miss a question about access, revisit your permissions lab rather than only memorizing the answer. Practise scenario-based tasks as well as definitions.

Keep exam readiness separate from completing this month. If foundational gaps remain, continue studying before paying for an attempt. You can use certification objectives to organize learning even if you decide to take the exam later.

Lab milestone: create an objectives checklist and a small revision pack linking at least five concepts to examples you can explain. Record your weak areas and what you will do to address them.

Month 6: complete a capstone and choose your next direction

Weeks 21–22: bring the pieces together

Build a fictional investigation around a test account with repeated failed sign-ins and later access to a lab resource. Use logs you are authorized to collect or a suitable training dataset. Document the environment and make clear which actions were simulated.

Apply the earlier months: explain the network context, account permissions, relevant Windows or Linux records, and SIEM query. Ask what the evidence supports and what remains unknown. Recommend a proportionate next step instead of declaring an attack simply because the exercise contains unusual activity.

Lab milestone: deliver a concise investigation report with a timeline, query, evidence, interpretation, and one proposed improvement. Test the improvement where your lab permits it and document the result.

Weeks 23–24: review and select a next step

Repeat one exercise without following the original walkthrough. Ask a mentor, instructor, or learning peer to challenge your explanation. Where did you make an assumption? Can you reproduce the result? What would you need to know before acting on a real system?

Select two or three projects for a portfolio. Remove credentials and personal information, identify all lab work clearly, and make the explanation readable without dozens of screenshots.

Then choose a direction to explore: security operations, identity and access, vulnerability management, governance, or authorized offensive testing. Compare actual role requirements before deciding what to study next. IT support can also be a route to building operational experience alongside your security learning; if you already work there, see how to move from IT help desk to cybersecurity.

Common mistakes when learning cybersecurity from scratch

Collecting resources without completing exercises makes progress hard to assess. Choose one core resource for each stage and use your milestone to decide whether you need another.

Starting with complex attack tools can hide gaps in networking and administration. Learn what a system normally does so you can explain what a test changed.

Copying commands without understanding their effect leaves you unable to troubleshoot. Use documentation, keep the lab recoverable, and explain the command before you run it.

AI assistants can help explain terminology or suggest questions, but check their answers against documentation and your own results. Do not submit generated reports you cannot defend or paste private credentials into a learning tool.

Finally, do not measure progress only by course completion. A clear account of an unsuccessful lab, including the cause and correction, can show more understanding than a certificate of attendance.

Self-study, a course, or a bootcamp?

You can learn cyber security at home through documentation, courses, and authorized labs. Self-study gives you flexibility, but you must organize the sequence and find feedback yourself. A focused course can help with one gap; a bootcamp can offer a broader schedule, guided practice, and instructor support.

Before choosing, compare a sample lab, assessment expectations, weekly workload, total costs, and the feedback included. Ask whether you will explain an investigation independently or mainly follow demonstrations. Choose support around the learning problem you actually have.

For structured study, Metana’s Cybersecurity Bootcamp describes foundations, network security, SOC training, digital forensics, and a capstone. Explore the curriculum and ask how its current schedule and support fit your starting point. This roadmap is an independent study sequence, not a description of Metana’s course timetable.

Frequently asked questions

Can I learn cybersecurity with no IT experience?

Yes, you can begin without professional experience. Start with networking, operating systems, and accounts, then add security concepts and labs. Give yourself more time where those foundations are unfamiliar.

How long does it take to learn cybersecurity?

Six months can organize a meaningful first stage of study. Your pace depends on prior knowledge, available time, practice, and feedback. Developing professional competence continues beyond this roadmap.

Do I need coding skills before I start?

No. Begin with the fundamentals, then add small scripting tasks when they solve a problem you understand. Reading and explaining a short PowerShell or Python script is a useful early goal.

Can I learn cybersecurity for free?

You can begin with publicly available documentation and learning resources such as Cisco’s catalog and Ubuntu’s tutorial. Check current access terms. Exam attempts, some labs, software, and instructor support may cost extra.

Should I learn Linux or Windows first?

Both are useful. This roadmap introduces Linux first, then Windows, to build skills in stages. If you already know one system, spend more time practising the other and connecting both to identity and logs.

Do I need Security+ before using a SIEM?

You can practise basic log searches before sitting a certification exam. This guide puts SIEM practice earlier so you have concrete examples to connect with your exam study. Confirm the requirements of any course or role separately.

Will this roadmap make me job-ready in six months?

It can help you build foundations and evidence of learning. Job readiness depends on the role’s requirements and your ability to apply those skills. Completing a schedule or passing an exam does not guarantee an offer.

Start with one question you can answer

You do not need every cybersecurity tool on your first day. Start by explaining one network connection, then one permission decision, then one investigation. Each step gives the next one context.

Save this roadmap, schedule your first study sessions, and begin with the networking milestone. For more learning guides, explore Metana’s cybersecurity articles. If you would benefit from guided labs and feedback, review Metana’s Cybersecurity Bootcamp and request the current syllabus.

Learning resources

Cisco Networking Academy learning catalog - networking fundamentals and beginner course options.

Ubuntu: The Linux command line for beginners - guided terminal exercises.

Microsoft: Windows failed-logon event reference - event 4625 and its fields.

Splunk: Get started with Search - an introduction and route to the Search Tutorial.

CompTIA Security+ - official certification information and entry point for checking exam objectives.

Metana Cybersecurity Bootcamp - current program information.

Metana cybersecurity articles - further reading.