Roadmaps
Each roadmap takes you to a named certification or a job in cyber security and AI: the courses to learn it, and the hands-on labs to prove you can do it. 31 certification roadmaps, the most-taken first, and 14 career roadmaps, AI security roadmaps among them.
All roadmaps
Type: Career roleClear all
14 roadmaps
Career paths
Each career path follows the certification paths the job requires, then adds the skills it is actually hired for.
The first security job for many: keep the systems patched, the accounts right and the controls on. A+, Network+ and Security+ in order, then Linux and Windows administration on real machines, and Microsoft's security, compliance and identity fundamentals.
4 courses 36 labs follows 4 cert paths + Infra Labs
The GRC career at its entry, for compliance officers and security auditors: keep the organisation on the right side of the standards and the regulators, and check that the controls work. Security+ for the grounding, ITIL where the organisation runs on it, GRC, PCI DSS and privacy for the substance, the controls hands on, then ISO 27001 and CISA.
4 courses 11 labs follows 4 cert paths + Infra Labs
Networks first, then the security of them: Network+ and CCNA for the plumbing, Security+ for the controls, then firewalls, IDS, segmentation and packet analysis on real machines.
4 courses 70 labs follows 3 cert paths + Infra Labs
The offensive career: find and prove weaknesses before an attacker does. Security+ as the baseline, then the hacking courses employers look for, then PenTest+ to certify it, with OSCP as the next step.
7 courses 38 labs follows 2 cert paths + Infra Labs
The practical skills a security operations centre actually hires for, and the incident response that follows an alert. Network+ and Security+ first, then defence, traffic analysis, SIEM and EDR, CySA+ to certify it, then evidence handling, malware analysis and GDPR breach reporting.
7 courses 82 labs follows 3 cert paths + Infra Labs
Secure the AI a company builds and buys: LLM apps, RAG, agents, the tools they call and the pipeline and cloud they ship on. Security+ and SecAI+ for the grounding, building and red-teaming AI for the skills, then CISSP, with AAISM as the step into leading AI security.
6 courses 41 labs follows 3 cert paths + Infra Labs
Secure what runs in AWS and Azure. Security+ and the cloud foundations first, then cloud identity, AWS security, DevSecOps and detection in the cloud, with CCSP for the senior step.
1 course 14 labs follows 6 cert paths + Infra Labs
From practitioner to the person who runs the programme: the technical baseline, governance, risk and service management, the CISO's first 90 days, then CISSP and CISM — the two certifications management adverts ask for.
3 courses follows 4 cert paths + Infra Labs
The GRC career at its senior end: identify, measure and own the organisation's cyber risk. Security+ for the technical grounding, GRC and ISO 27001 for the method, then CRISC and CISM.
1 course follows 4 cert paths + Infra Labs
Recover, preserve and explain what happened on a machine or a network. Security+ first, then disk, network, memory, malware and document forensics, CySA+ for the incident-response side, and the deepest lab series on the platform. Practice exams for CHFI, EC-Council's forensics certification, are under Practice tests: practice questions only, not a CHFI course.
6 courses 115 labs follows 2 cert paths + Infra Labs
The designer of the whole defence, usually after several years as an engineer: threat models, zero trust, identity, SecurityX for hands-on architecture, then CISSP and a cloud architect certification.
1 course follows 5 cert paths + Infra Labs
The builder of defences: harden the systems, secure the network, the cloud and the applications, automate it, then prove it with the certification employers ask for. Security+ first, then Linux and Windows hardening, network security, cloud and DevSecOps, application security, Python, then CISSP.
13 courses 120 labs follows 2 cert paths + Infra Labs
The defender who goes looking. Security+, SOC fundamentals and CySA+ first, then packet analysis, hunting in the SIEM and EDR, intelligence and ATT&CK, and the scripting that scales a hunt.
8 courses 54 labs follows 2 cert paths + Infra Labs
Know the adversary before they arrive. Security+ and CySA+ for the SOC grounding every CTI advert expects, then open-source intelligence tradecraft, the CTI models and frameworks, and Python to enrich the data.
6 courses 6 labs follows 2 cert paths + Infra Labs