Roadmaps Security roadmaps Offensive security and assessment
Test whether an organisation can detect and respond to a realistic attack: adversary emulation, purple teaming, breach and attack simulation, and control validation, all under strict authorisation.
Estimated time: 13–26 months · At about 10 hours a week.
Offensive skills are for authorised testing only: your own lab, a practice platform, or a system whose owner has given you written permission. Testing anything else is a crime in most countries.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Objective-based, threat-realistic testing of detection and response, not a vulnerability hunt. Learn how it differs from penetration testing and when each fits.
ATT&CK is the shared language of tactics and techniques. Learn it thoroughly; it drives emulation planning and detection mapping alike.
Red teaming needs explicit, senior authorisation, a legal agreement, clear objectives and strict rules, including who knows and how to stand down. This comes first.
Adversary emulation copies a specific actor; breach and attack simulation automates known techniques continuously. Learn where each adds value.
Build a lab with logging and a SIEM so you can run techniques and see what defenders would. Learning to be seen matters as much as the technique.
Choose a threat actor relevant to the organisation, study its documented behaviour, and plan an emulation of its techniques against an objective.
Run individual, documented techniques safely and check whether they are detected. Atomic Red Team is the standard open library for this.
Understand how operators manage access during an engagement, and how defenders detect it. Study the detection side as hard as the operation.
Learn how attackers try to avoid defences specifically so you can help defenders catch them. Keep the emphasis on improving detection.
Protect the engagement data, avoid harm to production, and keep meticulous logs of everything you do. Safety and accountability define a professional.
The real output is a map of what defenders saw and missed, per technique. Learn to produce it and track improvement over time.
From objective and scoping through emulation to an after-action review with defenders. The review and the improvements are the deliverable.
Run techniques openly with defenders watching, fixing detections as you go. It improves security faster than a closed red team and is often the better choice.
Automated, continuous validation of controls against known techniques. Learn to run a BAS programme and act on its results.
Test whether specific controls, such as EDR or email filtering, actually work against the techniques they should stop, and report gaps to owners.
Regulated frameworks such as TIBER-EU and CBEST run intelligence-led red teams against live financial systems under strict governance. Learn how they work.
Report what defenders detected, how fast they responded, and which controls and detections to improve, with ATT&CK coverage. Outcomes, not war stories.
Build a continuous emulation programme aligned to the threats the organisation actually faces, with threat intelligence driving what you test.
Recruit, train and keep operators, maintain a safe methodology, and manage the sensitive relationship with defenders and leadership.
Show detection and response improving over time across ATT&CK. That trend, not individual wins, is what justifies the programme.
Red teaming goes beyond finding vulnerabilities: it tests whether an organisation can detect, respond to and recover from a realistic attack. An authorised team emulates the techniques of a chosen threat actor, under tight rules, to exercise the defenders and the controls.
This roadmap is a learning path for authorised, objective-based testing and, increasingly, for purple teaming, where offence and defence work together to improve detection. It centres on MITRE ATT&CK, emulation planning and measuring defensive outcomes. Every engagement needs written authorisation and a clear objective agreed with leadership.
Organisations that pass vulnerability scans still fall to real attacks because detection and response fail. Red and purple teams measure and improve that, and the demand for people who can run them constructively, not just break in, is high.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact