How to Choose a Path
4 entriesCybersecurity has more established certifications than most IT fields. A common route is an entry-level credential, then a specialization in defense, offense, governance or cloud, then senior credentials such as CISSP. Hands-on labs matter as much as exams.
Step 1: Entry Level
6 entriesFoundations for people new to security.
Step 2: Defensive Security & Operations
7 entriesSecurity operations, analysis and incident response.
Step 2: Offensive Security
6 entriesEthical hacking and penetration testing.
Step 3: Governance, Risk & Senior Credentials
6 entriesManagement and architecture credentials for experienced professionals.
Cloud Security
8 entriesSecuring workloads on public clouds.
Free Labs, CTFs & Learning Platforms
13 entriesPractise safely on legal targets.
Related Pages
8 entriesNeighbouring pages on this site.
Frequently Asked Questions
Which cybersecurity certification should I take first?
CompTIA Security+ is the most common vendor-neutral starting point, and ISC2 Certified in Cybersecurity (CC) is a lighter entry credential. The Google Cybersecurity Professional Certificate on Coursera is a beginner course rather than an exam credential.
What are the best certifications for ethical hacking?
CompTIA PenTest+ and EC-Council CEH are knowledge-focused. OffSec OSCP+ is hands-on and highly regarded for penetration testing.
Which certification is best for senior roles?
CISSP is the best-known for senior practitioners, CISM suits security managers, and CISA suits auditors.
How can I practise hacking legally?
Use platforms built for it, such as TryHackMe, Hack The Box, picoCTF, PortSwigger Web Security Academy and OverTheWire. Never test systems you do not own or have written permission to test.
How current is this page?
Links were checked in October 2026. Exam names, versions, prices, prerequisites and retirement dates change often, so confirm details on the provider's own page. Descriptions summarize each provider's pages, and listing is not an endorsement. Sites that block automated checks, such as Cisco's, are kept and may need a manual click.