Roadmaps
Each roadmap takes you to a named certification or a job in cyber security and AI: the courses to learn it, and the hands-on labs to prove you can do it. 31 certification roadmaps, the most-taken first, and 14 career roadmaps, AI security roadmaps among them.
All roadmaps
Type: CertificationClear all
31 roadmaps
Start here: the most-taken certifications
The industry-standard entry certification for a cyber security role. Five exam domains, taught end to end, then proven in hands-on labs across Windows and Linux.
11 courses 148 labs + Infra Labs
Networking is the foundation security is built on. The recommended step between A+ and Security+.
8 courses 56 labs + Infra Labs
The standard first IT certification and the usual route into a helpdesk or support role. Two exams: Core 1 hardware and networking, Core 2 operating systems and security.
9 courses 62 labs + Infra Labs
The blue-team analyst certification and the natural step after Security+. Security operations, vulnerability management, incident response and reporting. Built on CS0-004. CS0-003 can still be booked until 22 December 2026.
5 courses 169 labs + Infra Labs
The offensive counterpart to CySA+. Scoping, reconnaissance, exploitation, post-exploitation and — the part most people underrate — writing the report.
4 courses 99 labs + Infra Labs
An entry certification from the body behind CISSP. A good first credential if you want security specifically, rather than general IT. ISC2 updated the exam outline on 1 September 2026 (governance and cloud security now have their own domains); the course chapters still use the earlier domain names.
2 courses 33 labs + Infra Labs
The senior security certification, spanning eight domains. Requires five years of experience to certify fully. This is the management and architecture track, not a hands-on one. ISC2's new CISSP exam outline applies from 15 April 2027. This roadmap teaches the April 2024 outline, which applies before then. Check which one you will sit.
16 courses 71 labs + Infra Labs
Widely requested in job adverts, especially in government and defence contracting. Broad tooling coverage across the attack lifecycle.
16 courses 81 labs + Infra Labs
The networking certification employers know by name. Deeper and more vendor-specific than Network+, and the standard credential for network roles.
5 courses 25 labs + Infra Labs
Linux administration to a professional standard — the platform most security tooling and most servers run on.
4 courses 95 labs + Infra Labs
Foundation
The entry point to the AWS certification track — services, pricing, security model and the shared responsibility boundary.
3 courses 37 labs + Infra Labs
The starting point if you are new to IT altogether — core terminology, hardware, software and basic security before A+.
3 courses 22 labs + Infra Labs
IT service management. Not a security certification, but frequently required for senior IT roles and useful context for anyone running security as a service. PeopleCert released ITIL Version 5 in 2026. ITIL 4 Foundation can still be booked, and this roadmap teaches ITIL 4.
5 courses
The entry point to the Azure track — cloud concepts, core Azure services, and how Microsoft prices and secures them.
1 course 23 labs + Infra Labs
The entry Microsoft security certification — the security, compliance and identity story across Microsoft 365 and Azure.
1 course 22 labs + Infra Labs
Intermediate
Design secure, resilient, high-performing and cost-optimised architectures on AWS. The four SAA-C03 domains, taught and then built.
1 course 62 labs + Infra Labs
Cisco's SOC-analyst certification, formerly CyberOps Associate — monitoring, intrusion analysis and incident response from a network operations perspective.
1 course 68 labs
Vendor-neutral cloud operations — deployment, security, maintenance and troubleshooting across providers rather than one. The labs run on Azure and AWS; DevOps is taught on its own step.
4 courses 92 labs + Infra Labs
ISO/IEC 27001:2022 — Lead Implementer and Internal Auditor · ISO 27001:2022
The international standard for information security management. It is the organisation that gets certified, and customers' security questionnaires ask whether yours is; these courses teach you to implement an ISMS to the standard and audit it internally.
5 courses 7 labs
The international standard for information security management. It is the organisation that gets certified, and customers' security questionnaires ask whether yours is; these courses teach you to implement an ISMS to the standard and audit it internally.
5 courses 7 labs
Administer Azure in production — identity, governance, storage, compute, networking and monitoring.
2 courses 39 labs + Infra Labs
Identity is the new perimeter. SC-300 covers Entra ID, access management, governance and identity protection in depth.
1 course 25 labs + Infra Labs
Advanced
SecurityX (CAS-005) practice labs — built for CASP+, renamed SecurityX by CompTIA. Advanced, labs-led security practice in architecture, enterprise risk and advanced operations; hands-on practice, not a SecurityX course.
113 labs + Infra Labs
Specialist AWS security — detection, incident response, infrastructure protection, identity, data protection, and security foundations and governance in AWS. Labs only: StationX has no SCS-C03 course yet.
35 labs + Infra Labs
Cloud security at architect level. The exam is vendor-neutral, so the labs here practise it on both Azure and AWS. The usual next step for a CISSP holder whose estate has moved to cloud. ISC2 revised the outline on 1 August 2026; the main course follows an earlier one, so the steps after it fill the gaps.
8 courses 57 labs + Infra Labs
The audit and assurance certification. The standard credential for IT audit, and increasingly asked for in compliance-heavy sectors. The main course is short on Domains 3–5; the continuity course in Step 4 and the control labs in Step 3 fill part of the gap.
6 courses 24 labs
The management-track certification: governance, risk management, the security programme and incident management. Pairs with CISSP for anyone moving into leadership. ISACA's new CISM outline applies from 3 November 2026; the weights shown are the new ones. Our practice tests follow the 2022 outline. The new outline adds enterprise and information security architecture, which no CISM course here covers yet; Step 5 links the CISSP Domain 3 & 4 boot camp, which teaches it.
8 courses 3 labs
CompTIA's AI security certification: how AI works, how AI systems are attacked and secured, how to use AI in security operations, and how AI is governed. Four exam domains, every AI attack explained, then practice tests.
8 courses 34 labs + Infra Labs
Enterprise IT risk management on the current outline (from 3 November 2025): governance, risk assessment, risk response and reporting, and technology and security. The most risk-focused of the ISACA credentials. There is no current-outline CRISC course here and no CRISC practice tests yet: each step teaches its domain from our GRC and continuity courses.
4 courses 28 labs
ISACA's AI security management certification: govern an AI programme, manage AI risk, and choose the controls that secure AI systems. For security managers who already hold CISM or CISSP.
2 courses
Microsoft's expert-level security certification. Design a Zero Trust strategy and security architecture across an estate. Requires a prior Microsoft security associate certification: Security Operations Analyst, Identity and Access Administrator, or Cloud and AI Security Engineer.
2 courses 59 labs + Infra Labs
OffSec's 24-hour hands-on exam: three standalone machines and an Active Directory set, then a written report. You book the exam with OffSec, on its own or with the PEN-200 course; passing earns OSCP, which does not expire, and OSCP+, which lasts three years. The StationX courses and labs here prepare you for it and are not OffSec material.
24 courses 101 labs + Infra Labs