The roadmap and a 20-week plan
Lesson 6 of 6
6The roadmap and a 20-week plan
The big pictureThe commonest beginner mistake is jumping straight to hacking tools before understanding how devices talk. This plan builds from the bottom: networking and Linux, then principles, then coding, then defence and the web, then the organisation, then the certificate. The first step today: TryHackMe's Pre Security path alongside Darb's networking track.
What the picture shows: Top: the plain path in two weeks, four steps. Bottom: the technical path in 20 weeks, each colour a phase, the numbers its weeks.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
The plain path · two weeks: days 1 to 3, protect your accounts: install a password manager, change reused passwords, turn on MFA for email and bank. Days 4 to 6, protect your devices: automatic updates, screen lock, 3-2-1 backups. Days 7 to 10, train your eye: redo the phishing drill and review the last ten suspicious messages you got. Days 11 to 14, protect your family: a "family password" for urgent calls, and go through their privacy settings with them.
The technical path · 20 weeks at about 10 hours a week, half hands-on: (1) IT foundations, weeks 1 to 3. (2) Security principles, 4 and 5. (3) Programming for security, 6 to 8. (4) Defence and detection, 9 to 11. (5) Web security and ethical testing, 12 to 14. (6) Identity, cloud and governance, 15 and 16. (7) The certificate and portfolio, 17 to 20. Phases 1 to 3 are beginner, 4 and 5 intermediate, 6 and 7 advanced.
Before You Start
🛡️Every lesson of this path
The plan points back to them in every phase.
The Core Idea
1Set up your lab for free
Every task needs four free things: a Linux virtual machine on VirtualBox, accounts on TryHackMe, the PortSwigger Web Security Academy and picoCTF, and Wireshark. That is your own lab, where you learn safely and legally.
2The technical plan, phase by phase
Press each phase to see its goal, what to study, its hands-on task and its done-when test. The test is not a formality: if you cannot meet it unaided, give the phase another week.
The study plan: 20 weeks in 7 phases
Built on about 10 hours a week, half of it hands-on. Press a phase. Do not move on before its "done when" is true.
1 · IT foundations
- Goal
- You understand how devices talk and work comfortably on Linux.
- Study
- Darb's networking path (the foundation, "How data moves" and the diagnostic tools lesson), the Linux for defenders lesson, and the Pre Security path on TryHackMe.
- Hands-on task
- On Linux: create a user, change a file's permissions, search the logs with
grep, and list open ports withss -tulpn. - Done when
- You explain the journey of opening a website and run 20 common Linux commands without searching.
2 · Security principles
- Goal
- You speak the field's language and understand risk, controls and cryptography.
- Study
- The cybersecurity basics track and the cryptography lesson, and the first courses of the Google Cybersecurity certificate or Professor Messer's videos.
- Hands-on task
- Pick an app you use daily and write down its assets, threats, three possible weaknesses, and one control for each.
- Done when
- You tell threat, vulnerability and risk apart with confidence, and encryption from hashing.
3 · Programming for security
- Goal
- You automate repeated chores and read code looking for mistakes.
- Study
- Python: files, regular expressions and requests. Bash: pipes,
awkandcut. - Hands-on task
- A script that reads your machine's login log, counts failed sign-ins per IP address, and prints the top five.
- Done when
- The script works on a real log from your lab and is on GitHub with a write-up.
4 · Defence and detection
- Goal
- You work like a junior SOC analyst.
- Study
- The lessons on how attackers think, detection and response, and the investigation project: ATT&CK, logs, SIEM and the response cycle, plus the Blue Team paths on TryHackMe.
- Hands-on task
- Run a Wireshark capture during a simulation in your lab and write a one-page incident report: what, when, scope, action, recommendation.
- Done when
- You map any alert to an ATT&CK tactic and suggest a fitting containment step.
5 · Web security and ethical testing
- Goal
- You understand flaws by exploiting them in a permitted lab, then fixing them.
- Study
- The web application security lesson and the OWASP Top 10:2025, the free PortSwigger labs, and picoCTF challenges.
- Hands-on task
- Solve the Apprentice labs on SQL injection, access control and XSS, and write the cause and the fix for each.
- Done when
- Twenty labs solved, each with a written summary.
6 · Identity, cloud and governance
- Goal
- You see security at the level of an organisation, not just a device.
- Study
- The identity, systems security, governance and AI lessons: IAM, Zero Trust, NIST CSF 2.0, the NCA essential controls and AI risks.
- Hands-on task
- A risk register for a made-up small company: ten risks, each with likelihood, impact, owner and a proposed control tied to a CSF function.
- Done when
- You present it in five minutes to a non-technical person and they get the priorities.
7 · The certificate and portfolio
- Goal
- You pass Security+ and own a portfolio that proves your skill.
- Study
- The official exam objectives line by line, and timed practice tests.
- Hands-on task
- Publish on GitHub: the script, the incident report, the lab write-ups and the risk register.
- Done when
- You score over 85% on three practice tests in a row, and your portfolio is public.
3Your portfolio on GitHub
By the end of the plan you have four pieces that prove your skill: the login-log script from phase 3, a one-page incident report from phase 4, write-ups of twenty web labs from phase 5, and a risk register from phase 6. Give each a README explaining the problem, what you did and what you learned. That is what you show in the interview.
203.0.113.0/24.Worked example
The task: you have only 5 hours a week instead of 10. How do you adjust the plan without losing its value?
The answer: double the length to about 40 weeks, and keep the hands-on tasks; cut extra reading first. Keep the phase order and the done-when tests unchanged. And check the exam date: 40 weeks from now SY0-701 will have retired, so prepare for SY0-801 and follow its material.
Myth vs Reality
| Myth | Reality |
|---|---|
| I will start straight away with hacking tools like Kali. | Tools without networking and Linux knowledge are just buttons. Start at phase 1. |
| I finished the course, so I finished the phase. | A phase ends when its practical test is met, not when the videos run out. |
Where you meet it at work
📅At home
The two-week plain path is enough to protect you and your family from the commonest attacks.
💼Job seeker
The technical path ends with a certificate and a four-piece portfolio to show in interviews.
Test your understanding
When do you move to the next phase?
The weeks are an estimate; the practical test is the real measure.
Which phase do you start with if you are starting from zero?
Everything after it depends on understanding how devices talk and how to work on Linux.
How many hours a week does the 20-week plan assume?
The hands-on half is what builds the portfolio.
When do you move from one phase to the next?
The bar is a proven skill, not time spent.
Which lab suits practising web attacks safely?
Environments built for training, with explicit permission.
Quick review cards
Check Your Understanding
What is the first step you take today?
TryHackMe's Pre Security path, alongside the first parts of Darb's networking track.
Why is half the time hands-on?
Because the market lacks skills, not theory, and practice is what becomes a portfolio that proves you can do it.
What three pieces should be in your portfolio before applying for a SOC job?
A script that analyses a real log, a one-page incident report, and write-ups of solved defensive labs.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
course2
Done with this lesson?
Sign in to save your progress.