Roadmaps Security roadmaps Offensive security and assessment
Find unknown flaws in software and prove their impact, for defence: fuzzing, binary and source analysis, exploitation concepts, and coordinated disclosure that gets them fixed.
Estimated time: 18–38 months · At about 10 hours a week.
Offensive skills are for authorised testing only: your own lab, a practice platform, or a system whose owner has given you written permission. Testing anything else is a crime in most countries.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Research only what you own or may study, never test on live third-party systems, and disclose responsibly. This frames everything that follows.
The stack, the heap, calling conventions and how programs use memory. Memory safety bugs are the classic research target, so learn this cold.
Read compiled code with a disassembler and decompiler to understand software you do not have source for. The core research skill.
Memory corruption, use-after-free, integer and type issues, logic flaws. Learn each with its root cause, the modern mitigations, and why it matters.
War games and deliberately vulnerable binaries teach the concepts legally. Build your skills here before looking at real software.
A debugger is how you understand what a program really does. Learn to drive one well; it is where research actually happens.
Feed a program malformed input at scale to find crashes that may be bugs. Coverage-guided fuzzing is the workhorse of modern research.
When you have source, read it for dangerous patterns and reason about untrusted input. Static analysers help; human review finds the subtle ones.
Most crashes are not useful bugs. Learn to triage them: what is the root cause, is it reachable, and could it matter.
Understand a bug well enough to describe its cause and impact precisely. This is what makes a report useful and a fix correct.
ASLR, DEP, stack canaries, CFI and memory-safe languages change what is exploitable. Understanding them is central to judging real impact.
Good research is mostly building the harness and corpus that reach interesting code. Learn to target the parts that handle untrusted input.
Understand how a bug could be turned into impact, enough to judge severity and to defeat it. Study this to assess risk and build mitigations, in your own lab.
A controlled proof of concept demonstrates impact for a report, on your own test system. It proves the bug is real without harming anyone.
Report to the vendor, agree a timeline, get a fix out, then publish. Learn CVE assignment and how to handle unresponsive vendors fairly.
Communicate a vulnerability clearly: affected versions, root cause, impact, fix. Request a CVE so defenders can track it.
Browsers, kernels, hypervisors, mobile and embedded are all deep research areas. Pick one and go deep; breadth comes later.
The highest-impact research drives mitigations and memory-safe design that kill bug classes outright. Aim your work at making flaws unexploitable.
Direct research at the targets that matter, manage disclosure at scale, and turn findings into fixes and mitigations across an ecosystem.
Build fuzzers, harnesses and analysis tools that scale your work and help others. Much progress comes from better tools.
Push for memory-safe languages, hardening by default and safer APIs. Preventing whole bug classes beats finding them one by one.
Vulnerability research finds flaws that nobody has reported yet, understands them deeply enough to judge their impact, and gets them fixed through coordinated disclosure. It is the most technical offensive discipline, and its purpose is to make software safer by finding bugs before attackers do.
This roadmap is a learning path grounded in ethics and the law. Research software you own or are permitted to study, use deliberately vulnerable practice targets, and disclose anything you find responsibly through proper channels. The deliverable is a fixed vulnerability and a CVE, never an exploited system. Understanding modern mitigations is as important as understanding bugs.
Vulnerability researchers protect everyone by finding and fixing flaws in widely used software, and they drive the mitigations that make whole classes of bug harder to exploit. The skills are deep and rare, and they underpin product security, defence and detection.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact