How to Learn Cybersecurity Online in 2026
Learning how to learn cybersecurity online is a realistic goal for a complete beginner, but most guides skip the hard parts. They list 20 free courses and leave you to guess the order, the costs and what employers actually want. This guide gives you a clear order instead: learn the IT basics, pick one direction, practise in legal labs every week, and prepare for one entry certification. You do not need a degree, and you can start for free.
This guide is for beginners with no security background. You will learn what cybersecurity work involves, which skills to learn first, which free resources to trust, how to practise safely and legally, and how long the first 90 days should take.
In this guide
- What cybersecurity work actually is
- Step 1: Learn the IT basics first
- Step 2: Pick a direction: defence or offence
- Step 3: Choose one structured course
- Step 4: Practise in legal labs every week
- Step 5: Build proof with write-ups
- Step 6: Prepare for one entry certification
- Your 90-day plan
- Worked example: a realistic first 90 days
- What it costs and what to expect
- Common mistakes
- Risks and scams to watch for
- Frequently asked questions
What cybersecurity work actually is
Cybersecurity means protecting computer systems, networks and data from unauthorised access, damage and theft. A cyber attack is an attempt to break into a system or steal data, and a vulnerability is a weak point that makes an attack possible. Security teams spend most of their time on prevention, monitoring and fixing weak points, not on dramatic hacking scenes from films.
The field has several distinct jobs, and they need different skills. A security analyst watches for threats and investigates alerts. A penetration tester, also called an ethical hacker, tests systems for weak points with written permission. An incident responder deals with breaches after they happen. A security engineer builds and maintains the defences. You do not need to learn all of these at once. You need one entry point, then you can specialise later.
| Role | Main work | Good first step |
|---|---|---|
| Security analyst | Monitor alerts and investigate suspicious activity | Learn networking and log reading |
| Penetration tester | Test systems for weak points with permission | Learn networking, Linux and web basics |
| Incident responder | Contain breaches and restore systems | Learn operating systems and basic forensics |
| Security engineer | Build and maintain security tools and controls | Learn networking, cloud basics and scripting |
Most beginners aim for a security analyst role first, because it is the most common entry job and it builds on the same basics as the other roles. If you are unsure which role suits you, compare the options in our guide to the best digital skills to learn before you commit to one path.
Step 1: Learn the IT basics first
Cybersecurity sits on top of basic IT knowledge. If you skip the basics, every later topic feels harder than it should. Spend your first two to three weeks on three subjects: networking, operating systems and Linux.
Networking means learning how computers talk to each other. Start with IP addresses, DNS, which turns website names into addresses, and TCP/IP, the basic rules that move data across networks. You should also understand what a firewall does and how a VPN works. Cisco Networking Academy offers free introductory networking courses, and they are a good place to start because the material is structured and the explanations are plain.
Operating systems means learning how Windows and Linux work at a basic level: files, users, permissions and services. Linux matters most in security work, because many security tools and most servers run on it. Install Linux in a virtual machine, which is a simulated computer that runs inside your real computer, and practise basic commands there. You do not need to become a Linux expert. You need to move around files, read logs and run simple tools without fear.
You should also learn a little Python, because it is the most useful scripting language in security work. A scripting language lets you write small programmes that automate repetitive tasks. If you already know some coding, this step goes faster. If you do not, read our guide on how to learn coding for beginners and focus on the Python basics only.
Step 2: Pick a direction: defence or offence
After the basics, choose one direction for the next three months. Defence means protecting systems and watching for attacks. Offence means testing systems for weak points with permission. Trying to learn both at once is the most common reason beginners stall.
| Direction | What you practise | Suits you if |
|---|---|---|
| Defence | Log analysis, alert triage, incident response basics | You like detail, patterns and steady work |
| Offence | Web attacks in labs, network scanning, report writing | You like puzzles and thinking like an attacker |
Defence is the safer first choice for most people, because it leads directly to analyst roles and the learning material is easier to follow. Offence is rewarding too, but it needs more patience and a stronger grasp of networking first. Either choice is fine, and you can switch later. What matters is that you pick one and follow it for 90 days.
While you choose, learn the NIST Cybersecurity Framework, which is a free public guide that describes how organisations manage security risk. The current version is CSF 2.0, and you can read it on the NIST Cybersecurity Framework page. It gives you the vocabulary that security teams use every day, such as govern, identify, protect, detect, respond and recover.
Step 3: Choose one structured course
Free resources are plentiful, but random videos leave gaps. Choose one structured course and finish it before you start another. A structured course has a set order, checks your understanding and gives you a clear end point.
Good starting options include the Google Cybersecurity Certificate on Coursera, which covers threats, networking, Linux, Python and incident response, and the free introductory course from Cisco Networking Academy. Check the enrolment page for current pricing and trial terms before you sign up, because they change. The Google certificate is a paid programme with a free trial, so read the terms carefully.
Do not collect courses. One finished course beats five half-finished ones.
Step 4: Practise in legal labs every week
Theory alone will not get you hired. You need hands-on practice, and it must be legal. Only ever test systems you own or have written permission to test. Testing a real website, a company network or someone else's account without permission is illegal in most countries, and it can end your career before it starts.
Use platforms that provide machines built for practice. TryHackMe offers guided rooms for beginners, including Pre Security, Cyber Security 101 and SOC Level 1 paths, with over 1,000 labs. Hack The Box is closer to real problem solving and expects more self-reliance. PortSwigger Web Security Academy is free and teaches web attacks such as SQL injection and cross-site scripting, which is a way of injecting malicious scripts into web pages, in a safe lab. OWASP Juice Shop is a deliberately vulnerable web application you can run in your own lab.
Set up a simple home lab with VirtualBox, which is free software for running virtual machines, and a Kali Linux virtual machine. Kali Linux is a version of Linux that comes with security tools already installed. In your lab you can run Wireshark to look at network traffic, Nmap to scan your own machines, and Burp Suite to test web applications you own. Aim for at least three hours of lab time every week, and keep a log of what you tried and what you learned.
Step 5: Build proof with write-ups
Employers cannot see what you know, only what you can show. After each lab, write a short write-up: what the task was, what you tried, what worked, what failed and what you would do differently. Publish two or three of your best write-ups on a simple blog or on LinkedIn. Keep them honest and clear. A write-up that explains a failed attempt and what you learned from it is more convincing than a perfect-looking one.
Add one small project to your proof. For example, set up a home network in virtual machines, record the traffic, and write a one-page report on what you found. Or complete a beginner Capture The Flag challenge, which is a security puzzle competition, and document your solution step by step. Two or three solid pieces of proof matter more than a long list of course certificates.
Step 6: Prepare for one entry certification
A certification is a formal credential you earn by passing an exam. It is not the same as a course completion certificate, which only shows you finished a course. Employers give more weight to exam certifications, because they test your knowledge under exam conditions.
The most common first certification is CompTIA Security+. It covers core security concepts and is widely recognised for entry roles. The CompTIA Security+ official page confirms that Security+ V7 is the current version, and that Security+ V8 is expected to launch on or around 17 November 2026, so check which version you are studying for before you book. ISC2 also offers free training for its entry level Certified in Cybersecurity credential, which is another sensible first option. Check the official pages for current exam fees and requirements before you pay anything.
Prepare with the official exam objectives, practice questions and your lab notes. Give yourself four to six weeks of focused study after you finish your first course. Do not book the exam until you can pass practice tests comfortably. One certification, earned properly, is worth more than three rushed attempts.
Your 90-day plan
| Weeks | Focus | Output by the end |
|---|---|---|
| 1 to 3 | Networking, Linux and IT basics | Notes and a working Linux virtual machine |
| 4 to 6 | One structured course, first half | Half the course finished, first lab write-up |
| 7 to 9 | Course second half, plus weekly labs | Course finished, two lab write-ups |
| 10 to 12 | Pick defence or offence, exam preparation | One project write-up, exam study plan started |
Two hours a day, five days a week, is enough to follow this plan. If you can only manage one hour a day, stretch it to six months. Consistency matters more than speed.
Worked example: a realistic first 90 days
Example only: these numbers are not typical results and they do not predict what you will earn or how fast you will find work.
Amina is a beginner with no IT background. She studies two hours a day, five days a week, for 12 weeks. That is 120 hours in total. She spends the first 30 hours on networking and Linux basics, using free Cisco Networking Academy material. She spends the next 50 hours on the Google Cybersecurity Certificate, finishing it in week 9. She spends 30 hours in TryHackMe labs, completing the Pre Security path and starting Cyber Security 101. She spends the last 10 hours writing up three labs and starting her Security+ study plan.
Her costs are zero for the first 90 days, because she uses free courses and free lab tiers, plus a trial period for the certificate course. She does not earn anything in this period, and she does not apply for security jobs yet. Her goal for the 90 days is a finished course, three write-ups and a clear exam plan. That is a realistic first milestone, and it is the foundation for the next three months of exam preparation and job applications.
What it costs and what to expect
| Item | Typical cost | Notes |
|---|---|---|
| Structured beginner course | 0 to about 50 US dollars a month | Free trials and free courses exist; check current terms |
| Lab platforms | 0 to about 15 US dollars a month | Free tiers cover beginner rooms; paid tiers add more labs |
| Home lab software | 0 US dollars | VirtualBox and Kali Linux are free |
| Entry certification exam | Check the official page before you pay | Exam fees change; never pay through a third party seller |
| Total for the first 90 days | 0 to about 150 US dollars | Most beginners can start for free |
Expect slow progress at first. The basics take 3 to 6 months to feel comfortable, and becoming job-ready usually takes 6 to 12 months of steady study and practice. Some people take longer, and that is normal. A certificate does not guarantee a job. Employers also look at your practical skills, your write-ups and how you perform in interviews. Results vary with your background, your location, the local job market and how much time you can give each week.
Common mistakes
- Jumping into ethical hacking tools before learning networking and Linux, which makes every tool feel like magic instead of a skill you understand.
- Collecting five courses at once and finishing none of them.
- Only watching videos and never doing labs, so you can describe security but cannot do it.
- Testing real systems without permission, which is illegal and can end your career.
- Treating a course completion certificate as if it were an exam certification.
- Comparing yourself with people who already work in IT and deciding you are too far behind.
- Skipping write-ups, so you have nothing to show an employer when you apply.
Risks and scams to watch for
Be careful with bootcamps and courses that promise a guaranteed job or a fixed salary. No course can guarantee employment, and any seller that claims otherwise is not honest. Avoid courses that pressure you to pay today for a discount that expires tonight. Check reviews from independent sources, not only the testimonials on the seller's own page.
Never pay for a "starter kit" or a "job placement fee" to start learning. Legitimate learning platforms do not charge you to apply for a job. If a job advert asks for bank details, a payment or a copy of your ID before an interview, treat it as a scam and report it. Our guide on how to spot online job scams explains the warning signs in detail, and our guide on how to find legitimate online jobs shows safer ways to search.
Also be careful with fake certification sellers. Only book exams through the official certification body or its authorised test centres. A cheap exam voucher from an unknown seller is usually a scam.
Frequently asked questions
Can I learn cybersecurity online for free?
Yes, for the fundamentals. Free courses, free labs and free reference material cover networking, Linux and basic security well. You will pay only if you choose a paid course or an exam certification, so check the price on the official page before you commit.
Do I need a degree to work in cybersecurity?
No. Skills, hands-on practice and certifications matter more than a degree for most entry roles. Some employers still prefer a degree, but many hire on demonstrated skill, so build proof with labs and write-ups.
How long does it take to learn cybersecurity?
The basics take about 3 to 6 months of steady study. Becoming ready for an entry role usually takes 6 to 12 months, including lab practice and exam preparation. Your background and the hours you can give each week change the timeline.
Is coding needed for cybersecurity?
Not always, but it helps. Basic Python is useful for automation and for many analyst roles. Penetration testing and development roles need more coding, while some defence roles need very little.
Which cybersecurity certification should I get first?
CompTIA Security+ is the most common first choice, and the ISC2 Certified in Cybersecurity credential is another sensible entry option. Pick one, study its official objectives, and book the exam only when practice tests go well.
Can I get a cybersecurity job with only free learning resources?
Free resources can build the knowledge, but employers also want proof. Add lab write-ups, a small home lab project and one exam certification, and your application becomes much stronger.
Conclusion
Learning cybersecurity online comes down to a simple order: basics first, one direction, one finished course, weekly legal labs, written proof and one entry certification. Start with networking and Linux, choose defence or offence, and follow the 90-day plan above. If you want to compare this path with other options, read the best digital skills to learn, see how coding fits in with our guide on how to learn coding for beginners, and understand how data skills overlap in our guide on how to learn data analysis online. For the full set of skill guides, browse all digital skills guides.
A note for the reader
Rules, exam fees and job requirements differ by country, and certification prices change, so check the official page for your country before you pay or book anything. Earning results vary, and nothing on this site is financial advice. Facts in this guide were checked against official pages on 2026-11-10, including the CompTIA Security+ page, TryHackMe and the NIST Cybersecurity Framework. If you spot a mistake, please report it through the corrections page.
