Learn Cyber Security: The Definitive Guide

This is the complete guide to learning cyber security in 2026.

We curated all 30 cyber security resources in our catalog. All 30 of them are free. Not "free with an upsell". Free.

The stakes: the average data breach now costs $4.88 million (IBM), and the global workforce gap sits around 4 million people (ISC2). In this guide, you'll learn:

• What cyber security work actually involves (the real jobs, not the movie version)
• The six career paths, from SOC analyst to penetration tester
• The exact learning path we'd follow, with the free labs to practice on
• The best resources in our catalog, ranked
• Why certifications matter more here than in almost any other field
• The five mistakes that stall most beginners

Here's the full map.

Chapter 1: Cyber Security Fundamentals

What Is Cyber Security?

Cyber security is the practice of protecting systems, networks, and data from people who want to steal, break, or ransom them. The day job splits into two instincts: defense (keeping attackers out) and offense (finding holes before the attackers do).

Both sides matter. Most of the jobs are on defense. The offense side gets the movies, but a penetration tester spends more time writing reports than "hacking" in any cinematic sense.

And that's the first honest thing you should know: this field is less Matrix, more paperwork with occasional adrenaline. The people who thrive treat it like an endless puzzle, not an action film.

Now: the flip side of that honesty is that puzzle-people are exactly who the industry is short of, and the entry path costs nothing. All 30 resources in our catalog are free. Zero paid. We'll show you which ones to use and in what order.

Why Cyber Security Matters in 2026

Every company now runs on systems someone wants to break. Breaches make headlines weekly, ransomware has become an industry with customer support, and regulation keeps tightening. The result is a chronic global shortage of security people.

The numbers tell the story:

• ISC2's workforce study estimates the global cyber security workforce gap at around 4 million unfilled positions (ISC2).
• The US Bureau of Labor Statistics projects information security analyst employment to grow 33% through 2033, among the fastest of any occupation (US Bureau of Labor Statistics).
• Median pay for information security analysts in the US: $124,910 per year (US Bureau of Labor Statistics).
• The average cost of a single data breach reached $4.88 million in 2024 (IBM).
• Ransomware attacks now hit a business roughly every 11 seconds (Cybersecurity Ventures).

Here's the part that matters for you: cyber security is the rare high-paying tech field where the entire entry path is free. All 30 resources in our catalog cost nothing. Zero. We'll show you exactly which ones to use.

Key takeaway: Cyber security defends (and tests) the systems the world runs on. Demand massively outstrips supply, pay is top-tier, and the entire learning path is free.

Chapter 2: The Six Career Paths

"Cyber security" is a family of jobs. Knowing which one you want changes what you learn, so here's the map:

1. SOC Analyst (defensive, entry-level). Monitor alerts, investigate suspicious activity, escalate real incidents. The classic first job. A shift looks like: triage the queue, trace the weird login from another country, write up the phishing report, hand off at shift change. You learn fast because everything is on fire, gently.
2. Penetration Tester / Red Team (offensive). Get paid to break into systems, legally, with permission. Requires deep technical skill and, here's the part nobody mentions, excellent report writing: the client pays for the document, not the hack. Rarely a first job, but the dream for many.
3. Security Engineer (build). Design systems that are hard to break: IAM, network segmentation, secure pipelines. Often a path from general IT or development.
4. GRC (Governance, Risk, Compliance). The policy side: audits, frameworks (ISO 27001, SOC 2, NIST), documentation. Less hands-on-keyboard, heavily in demand, excellent for systems thinkers who like writing things down (and often the fastest path for career-switchers from audit, law, or operations).
5. Incident Responder. The firefighter. When a breach happens, they contain it and figure out what happened. High pressure, high learning, usually a mid-career role.
6. AppSec (Application Security). Secure the code itself: code review, dependency auditing, security champions inside dev teams. A natural second skill for developers.

Pay varies by path and region, so treat any single number with suspicion. But the shape holds: SOC analyst is the entry door (US median around $100K for information security analysts overall (US Bureau of Labor Statistics)), penetration testing and AppSec sit higher, and GRC scales with seniority. Pick a direction before you pick a course. A SOC analyst needs different depth than a future pentester, and the free lab platforms we'll cover serve both, differently.

Key takeaway: Six main paths, from SOC analyst to pentester. Choose your direction first, because it changes what you study and which labs you live in.

Chapter 3: The Learning Path

Security sits on top of general IT. Skip the foundation and everything above it is memorized magic. Here's the order that works.

Stage 1: Networking and Operating Systems (4–8 weeks)

Learn how computers actually talk: IP addresses, DNS, TCP and UDP, ports, routing. Then get comfortable in the terminal, Linux especially. Almost every security tool assumes you know both.

Our picks: the Linux fundamentals guides in our catalog, and OverTheWire Bandit, which teaches the Linux command line as a game. You solve levels by finding hidden information on a server. It doesn't feel like studying. That's the point.

Stage-one graduation test: explain to a friend what happens, packet by packet, when they type a website address and press Enter (DNS, routing, TCP handshake, HTTP, render). If you can narrate that story, you're ready. If parts are foggy, that's exactly what to fix. Every attack you'll ever study rides on that story.

Stage 2: Core Security Concepts (4–6 weeks)

Now the field itself: the CIA triad (confidentiality, integrity, availability), common attack types (phishing, SQL injection, cross-site scripting), encryption basics, and how real organizations defend things.

Our pick: the Google Cybersecurity Professional Certificate in our catalog. Free, structured, and built for absolute beginners. It won't make you an expert. It will give you the vocabulary and mental models everything else hangs on.

The concept checklist for this stage: the CIA triad, least privilege, defense in depth, authentication versus authorization, encryption at rest versus in transit, hashing versus encryption, common web attacks (OWASP's Top 10 list is the canonical map (OWASP)), and incident response basics. Twelve ideas. Every future lesson assumes them.

The only catch is that vocabulary can feel pointless until you've seen the attacks it describes. So pair the course with a lab platform from day one (next stage), and the two will feed each other. Theory names what your hands just did.

Stage 3: Hands-On Labs (ongoing, forever)

Reading about security is like reading about swimming. This is the stage where you actually get wet:

• TryHackMe. Guided rooms from beginner to advanced, with real vulnerable machines in the browser. The best structured path from zero: the "Pre Security" and "Complete Beginner" paths take roughly 60 to 80 hours and leave you genuinely functional.
• picoCTF. Capture-the-flag puzzles from Carnegie Mellon. Free, gamified, and sneaky-educational: the easy problems teach forensics and crypto without saying so.
• OverTheWire. Wargames that teach command-line fluency by making you use it. Bandit alone is 34 levels of escalating Linux competence.
• Hack The Box. Harder machines, less hand-holding. Graduate here when TryHackMe feels comfortable. Expect to be humbled. The "easy" boxes take days at first, and that's the point.
• PortSwigger Web Security Academy. The definitive free resource for web vulnerabilities, from the makers of Burp Suite. If you lean AppSec, this becomes your home. Its labs cover SQL injection through advanced request smuggling, all free.

Rotate. One structured platform for progression, one CTF for fun. The rotation keeps both skills sharp: systematic thinking and creative attack.

Stage 4: Specialize + Certify (8–12 weeks)

Pick your path from Chapter 2, then aim your study at its entry certification (next chapter). Build a home lab, document everything, and start writing up what you break and fix. Public writeups of CTF solutions are how unknown people prove competence before anyone pays them.

The home lab can be embarrassingly cheap: an old laptop running VirtualBox with two or three virtual machines (one attacker, one victim, one defender) teaches more than any course. When you can attack your own network, defend it, and explain every packet, you're past the beginner wall.

Your First 30 Days, Concretely

Because "start with fundamentals" is useless without a calendar. Here's week one through four, mapped to the free resources above:

• Days 1 to 7: OverTheWire Bandit, levels 0 through 10. Twenty minutes a day. That's it. The command line stops being scary somewhere around level 5.
• Days 8 to 14: Bandit 11 through 20, plus the first half of the Google Cybersecurity Certificate. One hour a day.
• Days 15 to 21: Create a TryHackMe account, finish the "Intro to Cyber Security" room, then the "Network Fundamentals" room. The vocabulary from the course starts attaching to things you've actually done.
• Days 22 to 30: First CTF. picoCTF's easiest five challenges. Expect to need writeups. That's fine: reading a writeup, redoing the attack yourself, is how this field has always been learned.

Thirty days in, you'll have touched five platforms, broken four things, and fixed your own networking gaps twice. That's a real foundation, and it cost nothing.

Key takeaway: Foundation first (networking, Linux, core concepts), then hands-on labs from week one, then specialize. Total realistic runway: three to six months to job-ready fundamentals.

Chapter 4: The Best Cyber Security Resources

We analyzed all 30 cyber security resources in our catalog. Here's what we found.

First, the headline: the cost split is 30 free and 0 paid. That second number is zero. This is one of only two all-free categories at this size in our whole catalog, and the free tier isn't charity-grade material. It includes Google's professional certificate (over a million completions (Google)), IBM's analyst track, and the same hands-on platforms professionals use to stay sharp.

Here's the deal: the type mix matters as much as the names. Six challenge platforms, five interactive courses, two wikis, and structured certificate tracks. This is a category built for doing, not watching, and the catalog reflects it.

The standouts:

1. TryHackMe (free). The best guided path from absolute zero. Browser-based machines mean no lab setup, which removes the exact excuse most beginners need removed.
2. Google Cybersecurity Professional Certificate (free). The structured, employer-recognized starting credential, completed by over a million learners (Google). Pair it with labs, don't let it be your only plan.
3. PortSwigger Web Security Academy (free). University-grade web security training, free, from the Burp Suite team (the makers of the tool used by most professional web pentesters). If the web is your target, nothing else competes.
4. OverTheWire Bandit (free). Command-line skills as a game. Do Bandit before you buy any course on anything.
5. picoCTF (free). Beginner-friendly CTF that teaches you to think like an attacker.
6. Hack The Box (free tier). The next mountain. Harder boxes, real-world flavor.
7. IBM Cybersecurity Analyst (free). The alternate structured track to Google's, with similar weight.
8. Certified Cloud Security Professional prep (free). For the cloud-curious, exam-prep material for one of the most respected cloud security certs.

The type mix matters here: our catalog leans on interactive platforms and structured certificates rather than lecture courses. That matches how this field is actually learned and hired for.

Key takeaway: Every resource you need, from first lesson to professional practice, is free. TryHackMe plus the Google certificate plus PortSwigger covers defense, credentials, and web offense.

Chapter 5: Do You Need Certifications?

Short answer: here, more than almost anywhere else, yes. Long answer follows.

Security hiring is conservative by nature. Employers are trusting you with the keys to everything, and certificates are how strangers signal trustworthiness at scale. The usual entry sequence:

• Security+ (CompTIA). The standard HR-filter cert for first jobs, especially US government-adjacent roles. Study free, pay for the exam (~$400).
• Google Cybersecurity Certificate. The newer, cheaper, respected entry credential. Free to learn here.
• Then specialize: CySA+ for defense, OSCP for offense (the pentest gold standard for proving hands-on skill), cloud certs as your path demands.

The honest math, with numbers:

| Certification | Exam cost (approx) | Role |

|---|---|---|

| Google Cybersecurity Certificate | Free course here, Coursera fee if certified | First credential |

| Security+ (CompTIA) | ~$400 | The broad HR filter |

| CySA+ | ~$400 | Defense/soc depth |

| OSCP | ~$1,600 | Offense gold standard |

Study materials are all free in our catalog. You pay for exams, not education. That's the opposite of most fields, where the content itself is the product. Let the free tier carry the learning and save the money for the exams.

What certs don't do: replace hands-on proof. A cert plus a home lab plus public CTF writeups beats a cert alone every single time. Interviewers ask about the last thing you broke and fixed, not the last PDF you read.

One more honest note: certifications compound with experience. Security+ fresh means "trainable". The same certificate five years later means nothing, because by then your track record speaks. Certs open the first door. What you do after decides the rest of the house.

Key takeaway: Certifications are the trust currency of security hiring. Learn free, pay only for exams, and back every cert with lab work you can talk about.

Chapter 6: Common Mistakes

With that, let's cover the five failure patterns. Every one of them is common, avoidable, and self-inflicted.

Mistake 1: Cert Collecting Without Labs

Five certificates and zero home labs is a known and mocked profile. Every cert should come with something you built or broke to prove it. The lab is the learning. The cert is the receipt.

The test hiring managers actually run: "walk me through the last thing you broke in your lab". If the answer is a course name instead of a war story, the interview is already over.

Mistake 2: Skipping Networking

"You can't secure what you don't understand" is a cliché because it's true. Most successful attacks exploit basic networking failures. If TCP/IP feels optional, every future lesson will feel like memorizing spells without knowing what magic is.

Mistake 3: Starting with Exploits

Beginners want to hack on day one. But exploitation without fundamentals produces script-kiddie knowledge: running tools whose output you can't read (and in professional settings, running tools you can't read the output of is worse than not running them). The fundamentals-first order in Chapter 3 exists because understanding beats tooling every time. Tools change. Fundamentals pay your rent.

Mistake 4: The Hollywood Model

Real security work is documentation, process, patience, and communication. Pentesters write long reports. SOC analysts write tickets and shift summaries. If writing feels beneath the job, the actual job will feel disappointing. Know that going in.

Mistake 5: Learning Alone in the Dark

The security community is unusually generous: Discord servers, CTF teams, local meetups, Bug Bounty chat. Isolated learners stall. Community learners accelerate. Publish your writeups, even bad ones. They compound.

The fix, concretely: post one writeup a month, join one CTF team (most recruit beginners), and answer one question in a community channel each week. Six months of that is a network, a portfolio, and a reputation. All before your first job.

Key takeaway: Labs before certs, networking before exploits, fundamentals before tools, and community before isolation.

Chapter 7: Frequently Asked Questions

Do I need to be a programmer?

No, though scripting helps. Python is the field's lingua franca for automation, and you'll pick up enough along the way. SOC analysts and GRC roles hire plenty of non-programmers who can think in systems.

Is cyber security actually entry-level friendly?

It's the most honest of the tech fields about this: true zero-to-employed paths exist, but the first job usually comes after 6 to 12 months of labs plus one certification. The 4 million-person gap (ISC2) means the demand is real, but employers still want proof you've done things.

Which certification first?

Security+ for the broad HR filter, or the Google Cybersecurity Certificate for a cheaper, newer, still-respected start. Both study paths are free in our catalog. You pay only exam fees.

What about bug bounties?

A great side door with brutal odds. Only a small percentage of hunters earn meaningful income (HackerOne's own reports show a steep earnings curve). Treat it as practice with a lottery attached, not a plan.

Key takeaway: No programming requirement, 6 to 12 months of labs plus a cert for the first job, and bounties are practice, not income plans.

Chapter 8: Your Next Step

There you have it: the complete map for learning cyber security in 2026, and every step of it is free.

The recap. Security is a family of careers, so pick your path first. The path runs foundation, labs, specialization, certification. And the entire education is free: 30 resources, zero dollars, with the exam fees as your only real cost.

One last thing worth saying. This field rewards the curious and punishes the careless, which is exactly why it suits self-taught people. Nobody cares where you learned to trace a packet. They care that you can.

Time to start tonight. OverTheWire Bandit level 0 takes twenty minutes, and it will tell you more about whether this field is for you than a month of reading.

With that, let's point you at the doors that open next:

• Learn Web Development · AppSec starts with knowing how the web is built
• Learn DevOps & Cloud · cloud security is the fastest-growing specialty
• Learn AI Tools & Prompting · AI security is the brand-new frontier

Every recommendation in this guide comes from our hand-checked catalog of 30 cyber security resources. Counts update automatically as the catalog grows.