Roadmaps Security roadmaps
Cybersecurity & AI security roadmaps
A career roadmap for each area of cybersecurity and AI security: what the job is, what to learn in what order, labs to build, the certifications that matter, and where it can take you.
Real tools and sources, links checked every week
How these roadmaps work
- Every roadmap uses the same four stages: Beginner, Intermediate, Advanced and Expert. Each stage ends with a checkpoint. Move on when you can do everything in it.
- Start with one of the six core domains. Most specialist areas build on one of them.
- Do the labs on your own machines, or on platforms built for practice. Only ever test systems you own or have written permission to test.
- Times assume about 10 hours a week alongside work or study.
Core domains
The six foundations of a security career. Start here.
- Security Operations (SecOps) Watch an organisation's systems around the clock, spot attacks in the noise, and respond before they turn into breaches.
- Network Security Design, build and watch the networks everything else runs on, so attackers cannot get in easily or move around once they do.
- Identity and Access Management (IAM) Make sure the right people, and only the right people and services, can reach the right things, for the right reasons.
- Cloud Security Secure what organisations build and run on AWS, Microsoft Azure and Google Cloud, from accounts and permissions to containers and data.
- Application and Software Security Find and fix security flaws in the software people build, and help developers write code that is secure from the start.
- Digital Forensics and Incident Response (DFIR) When an attack happens, work out exactly what the attacker did, stop them, recover, and preserve the evidence properly.
IT security and infrastructure
Securing the machines, networks and services an organisation runs on.
Coming soon. These are written category by category.
- Endpoint Security
- Operating System Security
- Server Security
- Virtualization Security
- Container Security
- Hardware Security
- Mobile Security
- Wireless Security
- Email and Messaging Security
- DNS and Web Security
- Remote Access Security
- IT Asset Management and Security
- Configuration and Patch Management
- Backup and Recovery Security
- IT Service Security
Information security and data protection
Protecting information itself: who can see it, where it lives and how long it is kept.
Coming soon. These are written category by category.
- Information Security Management (ISMS)
- Data Security
- Data Loss Prevention (DLP)
- Database Security
- Big Data Security
- Data Privacy
- Cryptography
- Post-Quantum Cryptography
- Secrets and Key Management
- Records and Document Security
- Data Governance
- Data Sovereignty and Residency
- Privacy-Enhancing Technologies
- Intellectual Property Protection
- Information Lifecycle Security
Application, engineering and product security
Building security into software, pipelines and products from the first line of code.
Coming soon. These are written category by category.
- Web Application Security
- API Security
- Mobile Application Security
- Secure SDLC
- DevSecOps
- Product Security
- Software Supply Chain Security
- Source Code Security
- Infrastructure as Code Security
- CI/CD Pipeline Security
- Embedded Software Security
- Security Architecture and Design
- Security Testing and Assurance
- API and Microservices Architecture Security
- Open-Source Security
Defensive security and threat management
Finding, understanding and stopping attacks.
Coming soon. These are written category by category.
- Security Operations Center (SOC)
- SIEM
- SOAR
- XDR
- Threat Hunting
- Detection Engineering
- Threat Intelligence
- Incident Response
- Digital Forensics
- Malware Analysis
- Ransomware Defense
- Vulnerability Management
- Exposure Management
- Attack Surface Management
- Security Validation
- Deception Technology
- Cyber Threat Analysis
- Crisis Management
- Cyber Resilience
Offensive security and assessment
Testing defences the way attackers would, with permission and within agreed rules.
Coming soon. These are written category by category.
- Penetration Testing
- Red Teaming
- Purple Teaming
- Security Auditing
- Vulnerability Research
- Security Code Review
- Web and API Security Assessment
- Cloud Security Assessment
- Wireless Security Assessment
- Mobile Security Assessment
- Hardware and Firmware Assessment
- Adversary Emulation
- Bug Bounty and Coordinated Disclosure
- Security Quality Assurance
- Attack Path Analysis
Governance, risk, compliance and audit
Deciding what to protect, proving it is protected, and keeping the business running.
Coming soon. These are written category by category.
- Cybersecurity Governance
- Risk Management
- GRC
- Security Policy Management
- Security Awareness and Education
- Third-Party Risk Management
- Supply Chain Risk Management
- Internal and External Security Audit
- Regulatory Compliance
- Security Metrics and Reporting
- Business Continuity Management
- Disaster Recovery
- Cyber Insurance and Risk Transfer
- Security Program Management
- Security Architecture Governance
- Assurance and Certification
AI and machine learning security
Securing AI systems, and using AI to defend everything else.
Coming soon. These are written category by category.
- AI System Security
- LLM and Generative AI Security
- Agentic AI Security
- Machine Learning Security
- AI for Cybersecurity
- AI Red Teaming and Safety Evaluations
- AI Governance and Risk Management
- AI Model Privacy and Data Protection
- AI Infrastructure Security
- AI Application Security
- AI Supply Chain Security
- AI Safety and Reliability
- Responsible AI
- AI Security Monitoring
- AI Regulatory Compliance
- AI Identity and Access Control
- AI Security Testing and Evaluation
- AI Data Governance and Provenance
- AI Agent Memory and Context Security
- AI-Assisted Digital Forensics and Threat Intelligence
Specialised and emerging
Security for particular industries, physical systems and new technology.
Coming soon. These are written category by category.
- OT Security
- ICS Security
- SCADA Security
- IoT Security
- Automotive Cybersecurity
- Railway and Transportation Security
- Aviation Cybersecurity
- Maritime Cybersecurity
- Energy and Utility Security
- Healthcare Cybersecurity
- Financial Services Security
- Telecommunications Security
- Satellite and Space Cybersecurity
- Aerospace and Defense Security
- Government and Public Sector Security
- Critical Infrastructure Protection
- Blockchain and Web3 Security
- Quantum Security
- Physical Security
- Cyber-Physical Systems Security
- Operational Safety and Cybersecurity
- Privacy and Identity Technologies
- Electronic Fraud and Abuse Prevention
- Digital Trust and Assurance
- Cybersecurity Research and Education
No roadmap matches. Try a shorter word, or clear the filters.
Offensive skills are for authorised testing only: your own lab, a practice platform, or a system whose owner has given you written permission. Testing anything else is a crime in most countries.
How this is kept accurate
Every tool, certification and resource here is real, and every link goes to the official site of the people who make it. Paid items are marked. A script checks every link once a week, and certification prices come from the official pages on the date shown on the Certifications page.
Found a mistake, or want a roadmap written sooner? Contact