Roadmaps Security roadmaps Offensive security and assessment
Assess and secure the radio links around us under authorisation: Wi-Fi, Bluetooth, NFC, RFID and other RF, their protocols and encryption, and wireless intrusion detection.
Estimated time: 9–18 months · At about 10 hours a week.
Offensive skills are for authorised testing only: your own lab, a practice platform, or a system whose owner has given you written permission. Testing anything else is a crime in most countries.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Frequencies, modulation, antennas and why signals leak past boundaries. A little radio theory makes everything else make sense.
The 802.11 family, how clients associate, and the management frames that make Wi-Fi work. Learn the protocol before the attacks.
WEP, WPA2 and WPA3, personal and enterprise. Learn why the old ones failed and what WPA3 improves.
A supported adapter, your own access point and, optionally, a software-defined radio. Transmit only on your own equipment and legal frequencies.
Transmitting on many bands needs a licence, and interfering with or intercepting others' communications is illegal. Know the rules before you transmit.
Monitor mode and capture let you see the wireless around you. Capturing your own network's traffic is the start of assessment.
Rogue access points, evil twins, deauthentication and handshake capture. Learn how each works and the controls that stop it, testing only your own network.
802.1X, EAP methods and RADIUS, and the certificate and configuration mistakes that undermine them. Learn to assess and harden enterprise Wi-Fi.
Guest Wi-Fi, captive portals and segmentation. Done wrong they bridge untrusted users into the network; learn the safe design.
Detect rogue access points, evil twins and deauth floods. Monitoring the air is the defensive counterpart to wireless assessment.
WPA3, strong enterprise authentication, management frame protection, segmentation and rogue detection. Turn assessment findings into a hardened network.
Explain the exposure, the realistic impact given signal range, and the fixes. Range and context matter in wireless reports.
Classic and Low Energy Bluetooth, pairing, and the weaknesses in how devices connect. Assess and secure the many devices that use it.
Access cards, payments and tags. Learn how they work, how cloning and relay attacks happen, and how systems defend against them.
An SDR lets you receive and study many signals. Use it to learn protocols and research devices, receiving only and within the law.
Zigbee, Z-Wave, Thread and LoRaWAN connect smart and industrial devices. Learn their security models and common weaknesses.
How phones attach to mobile networks and the idea of rogue base stations. The telecom roadmap covers the operator side in depth.
Access badges, car keys and building systems are radio devices. Wireless assessment overlaps with physical security testing.
Design, monitor and harden wireless across sites, including guest, corporate, IoT and operational networks, with rogue detection throughout.
Radio research uncovers flaws in devices and protocols. Work within the law and radio regulations and disclose responsibly.
Wi-Fi 7, private 5G, ultra-wideband and new IoT radios keep arriving. Keep learning the new protocols and their security.
Wireless links are everywhere and, unlike wired networks, their signals travel beyond your walls. Wireless security covers Wi-Fi, Bluetooth, NFC, RFID and other radio technologies: how they authenticate and encrypt, how they are assessed, and how to detect attacks against them.
This roadmap is a learning path for authorised assessment and defence. Transmitting on many frequencies is regulated and testing others' networks is illegal, so work only on your own equipment, in a controlled lab, or within an engagement scope, and respect radio regulations. The emphasis is on understanding and hardening wireless.
Wireless is a soft entry point into many organisations and a growing one as IoT and operational devices go wireless. Assessors and engineers who understand the radio layer and can secure it are relatively rare and in demand.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact