roadmap.sh: Cyber Security

What it is

An interactive roadmap from roadmap.sh, the community-maintained site that also publishes the well known frontend, backend, and DevOps roadmaps. The cyber security version lays out the field as a set of connected topics: computer and networking basics, operating systems, programming fundamentals, security concepts, cryptography, and then the branch points where people specialise into offensive security, defensive and SOC work, cloud security, or governance and risk.

Why it is worth the time

Cyber security is often marketed as one job when it is really a dozen adjacent ones, and a beginner's first problem is usually not skill but scope: which of those dozen paths is worth six months of study. Seeing networking, Linux, and scripting sit underneath every branch on the same map is a useful correction to the common mistake of jumping straight into tool tutorials without the fundamentals that make those tools make sense later.

How to use it

Treat it as a map, not a syllabus to complete top to bottom in order. Spend real time on the base layer, networking, Linux, and basic scripting, since almost nothing above it works without those. Once the fundamentals feel solid, pick one branch (for example blue team and SOC work, or web application security) rather than trying to cover all of them shallowly at once. The roadmap links out to external courses and documentation for each node, so it works well alongside a hands on platform like TryHackMe or a wargame like OverTheWire's Bandit, which supply the practice the roadmap itself does not.

Free versus paid

The roadmap and its topic pages are free to browse. roadmap.sh also offers paid add-ons on the wider site, such as an AI tutor and project based practice, but the roadmap content that matters here costs nothing.

Prerequisites

None beyond basic computer literacy. It is written for complete beginners as well as developers pivoting into security.

Common questions

Is this enough on its own? No. It is a map for deciding what to study next, not a substitute for hands on labs, a wargame, or a structured course. Does it replace a certification study guide? No, but it is a reasonable way to check whether your Security+ or similar study plan is missing an area entirely. Should I follow it in a straight line? No, cyber security branches quickly, and picking a direction early saves time.