Learning

Two tracks. Twelve specialisms. Everything free.

A complete, self-directed route from "I have never touched a terminal" to employable — Information Technology first, cybersecurity on top of it. No videos to buy, no bootcamp to join, no affiliate links anywhere on this page.

Every resource here comes from a primary source we would stake our own name on: vendor documentation, national cyber centres, NIST, OWASP, MITRE and SANS. Where something costs money we say so, and we say whether it is worth it.

Start here

The order matters more than the material

Almost everyone who stalls did the same thing: they started with the exciting part. These four stages are the sequence we would give a new hire, and roughly what each one costs in evenings. Work down, not across.

  1. 1

    Build the foundation 120–200 hours

    Track A, in order: networking, then Linux, then Windows and Active Directory. You are learning how systems actually work so that later, when something is broken or hostile, you can tell the difference. Skip this and every stage after it becomes memorisation.

    Done when you can explain what happens between typing a URL and the page appearing, read a packet capture without panicking, and build a two-machine lab from nothing.

    Go to Track A →
  2. 2

    Choose a specialism 60–150 hours

    Track B splits into six genuinely different jobs. Read the one-line description of each before committing — most people pick offensive work because it looks exciting, when the market, the salaries and the day-to-day satisfaction are often better in defence and governance.

    Done when you can name the specialism you are aiming at and describe what someone in that job does on a Tuesday.

    Go to Track B →
  3. 3

    Get your hands dirty ongoing

    Reading builds vocabulary; doing builds judgement. Run the labs alongside the reading, not after it — one lab per topic, the same week you read about it. Break your own lab machines and fix them. Write down what you did.

    Done when you have a handful of finished labs you could talk an interviewer through, including one where you were stuck and explain how you got unstuck.

    Go to the labs →
  4. 4

    Prove it 1–6 months

    A certificate gets you past the first filter and nothing more — but the first filter is real. Take one, not five. Pair it with something public: a home lab write-up, a detection rule you wrote, a tool you fixed. Evidence beats acronyms in every interview we have ever sat on either side of.

    Done when you have one relevant certificate and one thing a stranger can read.

    Go to certifications →
How much time is realistic? Two focused hours a night, five nights a week, puts most people through Track A in about four months and into their first specialism by month seven. Half that pace still works — inconsistency is what kills it, not slowness.

Curriculum

Two disciplines. Twelve specialisms.

Security sits on top of IT — you cannot defend a network you could not build. If you are starting from nothing, work through the IT track first; almost everyone who struggles in security skipped it. Every resource is free unless marked otherwise, and every one is from a primary source: vendor documentation, national cyber centres, NIST, OWASP or MITRE.

Track A — Information Technology. Networks, operating systems, cloud and the scripting that ties them together. This is the ground everything else stands on, and it is where the jobs are. Roughly 120–200 hours end to end.
A1

Networking

How packets actually get from one machine to another. If you learn one thing properly, learn this — every other topic assumes it.

25–35 h
Beginner
A2

Linux & the command line

Most of the internet runs on it, most security tooling assumes it, and most interviews test it.

25–40 h
Beginner
A3

Windows & Active Directory

What most businesses actually run. Also the single richest attack surface in the average company, which is why Track B keeps coming back to it.

25–35 h
Intermediate
A4

Cloud fundamentals

Someone else's computer, with a very specific billing model and a very specific way of going wrong.

20–30 h
Intermediate

Written material

Our own guides — the actual instructions

Not links this time. These are the notes we work from, written out in full, with the commands and record syntax you can copy. Correct at the time of writing and maintained; if you spot an error, tell us and we will fix it.

01 Spotting a phishing email — the seven signals that actually matter 8 min read · everyone

Modern phishing does not look like the Nigerian prince. It looks like an invoice from a supplier you really use, in the format they really use, arriving in the week you really are expecting one. Spelling mistakes are no longer the tell. These are.

1. The reply-to address does not match the from address

The From line is decoration — anyone can write anything there. What matters is where a reply would actually go. In most clients you have to open the message details to see it. If From: accounts@supplier.com but Reply-To: accounts.supplier@gmail.com, you have your answer.

2. The domain is nearly right

Look character by character at the part after the @. Attackers register lookalikes: rnicrosoft.com (r-n reads as m), supp1ier.com (digit one for l), supplier-invoices.com (extra words), supplier.com.co (extra suffix). Read it out loud slowly.

3. It creates time pressure

"Within 24 hours", "before close of business", "final notice". Urgency exists to stop you checking. Genuine businesses cope with you taking an hour to verify.

4. It asks you to break a normal process

New bank details. Payment to a different account "just this once". A colleague who cannot talk right now and needs gift cards. Any change to payment details is verified by phone, on the number you already had — never the number in the email.

5. The link text and the link target disagree

Hover before you click; on mobile, press and hold. The status bar shows the real destination. Also check where the path begins: https://login.microsoft.com.verify-account.xyz/ is not Microsoft — the real domain is always the bit immediately before the first single slash, here verify-account.xyz.

6. An attachment you did not expect

Particularly .html, .iso, .img, .zip containing a shortcut, or an Office file demanding you "enable content". Enabling content runs code. That is the entire purpose of the prompt.

7. It is simply out of character

Your director does not normally email at 23:40 asking for a favour. Trust that instinct — it is pattern recognition, and it is usually right.

If you have already clicked: do not panic, and do not hide it. Disconnect from the network, tell the one named person, change the password from a different device, and check whether anything was authorised. Reporting it in ten minutes is a minor incident. Reporting it next week is a breach.
02 Setting up SPF, DKIM and DMARC properly — with the actual records 15 min read · technical

These three DNS records decide whether your mail is delivered and whether strangers can send invoices in your name. Do them in this order, and do not skip the monitoring phase — going straight to enforcement is how people lose a fortnight of email.

Step 1 — SPF: who is allowed to send as you

One TXT record on your root domain. One only — two SPF records is itself an error and causes both to fail.

Type:  TXT
Host:  @            (your root domain)
Value: v=spf1 mx a:mail.example.com include:_spf.google.com -all

Read it left to right: allow the servers in my mx record, allow mail.example.com, allow whatever Google publishes, and -all means reject everything else. Use ~all (soft fail) for the first fortnight if you are nervous, then tighten to -all.

Watch the ten-lookup limit. Every include: costs a DNS lookup, and SPF permanently fails above ten. If you use several senders — Microsoft, a CRM, a newsletter tool — you will hit it faster than you expect.

Step 2 — DKIM: sign what you send

Your mail server generates a key pair, keeps the private half, and you publish the public half. The selector (default below) is chosen by whoever generates the key.

Type:  TXT
Host:  default._domainkey
Value: v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

Use a 2048-bit key. Some DNS panels will not accept a value that long in one field and require it split into quoted chunks — that is a formatting quirk of the panel, not of DKIM.

The failure mode nobody catches: a mail server configured to sign with a key whose public half was never published. Every message then carries a signature that cannot be verified, which is worse than not signing at all. Check with our domain checker after any mail migration.

Step 3 — DMARC: say what to do when the first two fail

Start at p=none. This changes nothing about delivery — it only asks receivers to send you reports. Leave it for two to four weeks and read them.

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1; pct=100

Once the reports show your legitimate mail passing, tighten in two moves:

v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100
v=DMARC1; p=reject;     rua=mailto:dmarc@example.com; pct=100

p=reject is the destination. Anything less and a forgery may still land in someone's inbox. Add adkim=s; aspf=s for strict alignment once you are confident.

Order matters. SPF and DKIM first, verified working. Then DMARC at p=none and read the reports. Only then enforce. Publishing p=reject on day one, before your senders are listed, will bin your own invoices.
03 Backups that actually restore — the 3-2-1 rule and the test nobody runs 10 min read · owners & IT

Ransomware is a backup problem before it is a security problem. Firms that recover in a day and firms that pay differ by one thing: whether the backup was reachable from the machine that got encrypted.

The rule

  • 3 copies of the data — the live one and two backups.
  • 2 different media or platforms — not two folders on the same server.
  • 1 off-site, and offline or immutable. This is the one that saves you.

Modern ransomware looks for backups first. A NAS mapped as a drive letter, or cloud storage synced with saved credentials, gets encrypted along with everything else. If the live machine can write to it, assume it can destroy it.

What "immutable" means in practice

Storage that will not let anyone — including an administrator with the password — alter or delete a file until a set period has passed. Object-lock on S3-compatible storage, or a backup product with a hardened repository. Ask your provider one question: if an attacker has my admin credentials, can they delete my backups? If the answer is yes, you have copies, not backups.

The test

A backup is a hypothesis until you restore from it. Once a quarter, pick one real file and one whole system, and restore both to somewhere isolated. Write down how long it took. That number is your actual recovery time — the one in the sales brochure is not.

  • Can you restore a single file a user deleted last Tuesday?
  • Can you restore a whole server, and how many hours does it take?
  • Do you have the passwords needed during the restore, stored somewhere that is not the system being restored?
  • Does anyone other than one person know how to do it?
The question that finds the gap: "If we arrived tomorrow and every machine was encrypted, what is the first thing we would restore, and who would do it?" If the room goes quiet, that is the work.
04 Passwords and MFA — what current guidance actually says 8 min read · everyone

Most password policy in the wild is a decade out of date and makes security worse. NIST and the NCSC both reversed the old advice years ago. Here is the current position.

Length beats complexity

Three random words — correct-battery-lamp-post — resists cracking better than P@ssw0rd1! and is far easier to type on a phone. Substituting a 3 for an E fools nobody; every cracking tool has tried that since the 1990s.

Stop forcing routine expiry

Both NIST and the NCSC now advise against scheduled password changes. Forced rotation produces Summer2025! then Autumn2025! — predictable and worse. Change passwords when there is a reason: a breach, a suspicion, a departure.

The real problem is reuse

Attackers rarely crack your password; they take one from another site's breach and try it on yours. That is credential stuffing, and it works because people reuse. Check your own address at Have I Been Pwned.

Use a password manager

Nobody remembers eighty unique passwords, and the alternative to a manager is not memory — it is reuse or a notebook. Any reputable manager is a vast improvement. Protect it with a long passphrase and MFA.

Not all second factors are equal

  • Hardware key (FIDO2 / passkey) — strongest. Phishing-resistant by design: it will not authenticate to a lookalike domain.
  • Authenticator app code — good. Beats SMS comfortably.
  • Push notification — good, but beware MFA fatigue: attackers spam prompts until someone taps Approve. Enable number-matching if offered.
  • SMS — weakest, and vulnerable to SIM-swap. Still far better than nothing.
If you do one thing this week: turn on MFA for email. Email is the master key — every "forgot password" link on every other service ends up there.
05 A hardening checklist for a small business network 12 min read · IT & sysadmin

Ordered by how much risk each item removes per hour spent. Work down, not across.

Do these first

  • Remove internet-facing RDP. Exposed RDP is the single most common entry point for ransomware in small firms. Put it behind a VPN, or use a proper remote access broker. Changing the port is not a control.
  • MFA on email and remote access — every account, including the one belonging to whoever says they are too busy.
  • Patch the edge first — firewall, VPN appliance, anything with a public IP. Check them against CISA's KEV catalogue; if your model is listed, that is today's job.
  • Separate admin accounts. Nobody reads email as a domain administrator. Daily-driver account for daily work, admin account only when elevating.

Then these

  • Inventory. You cannot secure what you do not know you own. A spreadsheet is a legitimate start.
  • Disable what you do not use — old accounts, dormant VPN logins, legacy protocols, a forgotten test server. Every one is a door.
  • Turn on disk encryption — BitLocker or FileVault, on every laptop. A stolen laptop should be a hardware loss, not a data breach.
  • Central logging with at least 90 days retention. Intrusions are usually found weeks later; logs shorter than that answer nothing.
  • Written joiners/leavers process. Most orphaned accounts belong to people who left politely.

Then verify from outside

  • Scan your own public IP range — know exactly what is exposed.
  • Grade your TLS at SSL Labs; aim for A.
  • Check email authentication with our domain checker.
  • Benchmark each platform against its CIS Benchmark.
A caution about the order. It is tempting to buy a product first. Every item above is free or already included in what you own, and each removes more risk than most purchases. Do them before spending anything.

Hands-on

Practice ranges — legal places to actually try this

Reading about attacks builds vocabulary. Performing them builds judgement. Every platform below is intended to be attacked; none of them require you to touch a system you do not own.

Free

PortSwigger Web Security Academy

The best free application-security training that exists, from the people who make Burp Suite. Hundreds of labs with worked solutions.

portswigger.net/web-security
Free

OverTheWire

Classic wargames over SSH. Bandit teaches the Linux command line by making you earn each level. Start here if you are starting anywhere.

overthewire.org/wargames
Free

OWASP Juice Shop

A modern, deliberately broken web shop you run yourself in Docker. Every OWASP Top Ten category is in there somewhere.

owasp.org — Juice Shop
Free tier

TryHackMe

Guided, beginner-friendly rooms with a gentle learning curve. The free tier is substantial; the subscription buys structure rather than content.

tryhackme.com
Free tier

Hack The Box

Harder, less hand-holding, closer to real assessment work. Move here once TryHackMe stops being uncomfortable.

hackthebox.com
Free

CyberDefenders & Blue Team labs

Defence rather than attack: analysing captures, logs and malware. Badly under-practised, and where most actual jobs are.

cyberdefenders.org
One rule. Only test systems you own or have written permission to test. In most countries — including the US, UK and across the EU — unauthorised access is a criminal offence regardless of intent, and "I was only learning" is not a defence.

Certifications

Which certificate, and in what order

Our honest opinion, having hired and been hired: certificates get you past the first filter. Nothing more, and nothing less. Do not collect them.

Start~$400

CompTIA Security+

The default first certificate, and the one most job filters look for. Vendor neutral, broad, not deep. Professor Messer's course covers it free.

Career changers · IT staff moving toward security
StartFree–$100

Microsoft SC-900 / AZ-500

If your world is Microsoft 365 and Azure — which for most small businesses it is — these map directly onto work you will actually do.

Anyone administering Microsoft environments
Practitioner~$400

CompTIA CySA+

Detection and response rather than theory. A sensible second step if you are heading toward a SOC or blue-team role.

Analysts · defenders
Advanced~$1,600

OSCP

Hard, hands-on, twenty-four hour practical exam. Genuinely respected because it cannot be passed by memorising. Do not attempt it first.

Offensive security · penetration testing
Advanced~$750 + experience

CISSP

Management-oriented and requires five years of documented experience. It is a career certificate, not a learning one — treat it accordingly.

Security managers · consultants
Any stageFree

Vendor free tiers

Google, AWS and Microsoft all publish free security fundamentals training. Worth doing, worth listing, not worth paying for.

Everyone

Prices are indicative and change — check with the awarding body before budgeting. We have no commercial relationship with any of them.

Reference

The first hour: what to do when it happens

Print this. The moment you need it, nobody will be in a state to read a website. Adapted from NIST SP 800-61 and NCSC incident management guidance.

  1. 0–5 min
    Do not turn it off. Disconnect from the network — pull the cable, turn off Wi-Fi — but leave the machine powered on. Shutting down destroys evidence in memory and can trigger ransomware to finish encrypting.
  2. 5–15 min
    Tell one named person. Every organisation needs one person who is told first, even if that person is the owner. Speed matters more than certainty — reporting a false alarm must never be punished.
  3. 15–30 min
    Change the credentials that matter, from a clean device. Email first, then banking, then remote access. Never from the suspect machine.
  4. 30–45 min
    Establish what was reachable. Not what was taken — what that account or machine could reach. Assume everything it could touch is compromised until shown otherwise.
  5. 45–60 min
    Preserve, then decide. Photograph screens, note timestamps, keep logs. Then decide whether this is something you handle or something you escalate — and check your obligations. GDPR gives you 72 hours to notify a personal-data breach.
  6. After
    Write it down while it is fresh. What happened, what you did, what you wish you had. That document is worth more than any product you buy afterwards.
NIST SP 800-61 — Computer Security Incident Handling Guide NCSC — Incident Management collection CISA — Ransomware Guide

Glossary

The words, without the mystique

Security has a vocabulary problem. Here is the plain meaning of the terms you will meet everywhere else on this site.

CVEA public reference number for one specific vulnerability, so everyone is talking about the same flaw.
CVSSA 0–10 severity score for a vulnerability. Above 9 is critical; treat 7 and up as urgent if you run the software.
Zero-dayA flaw being exploited before a fix exists. Rarer than headlines suggest, and rarely your biggest risk.
PhishingA message designed to make you act — click, pay, or hand over a credential — by impersonating someone you trust.
RansomwareMalware that encrypts your files and sells them back. Usually arrives through a click or an exposed remote-access service.
MFA / 2FAA second proof of identity beyond a password. The single most effective control available to a small business.
SPF / DKIM / DMARCThree DNS records that together prove an email genuinely came from your domain and was not altered.
PatchA vendor fix for a known flaw. Most successful attacks use a vulnerability that was patched months earlier.
Least privilegeGiving an account only the access it needs. Limits how far an attacker travels once inside.
BECBusiness email compromise — fraud by impersonating a colleague or supplier, usually to redirect a payment. Costs small firms more than ransomware.
Attack surfaceEverything of yours that a stranger can reach. Shrinking it is cheaper than defending it.
KEVCISA's catalogue of vulnerabilities known to be exploited in the wild. If something you run is on it, patch today.

Stay current

The part that never finishes

This field changes underneath you. Pick two or three of these and read them properly rather than subscribing to twenty and reading none. Everything below is free, and none of it is sponsored.

Read weekly

Watch for warnings

Watch and listen

  • Darknet DiariesTrue stories from the field. The best on-ramp there is if security still feels abstract.
  • Risky BusinessWeekly news with actual scepticism. Where the industry finds out what happened.
  • IppSecFull walkthroughs of retired Hack The Box machines. Watch how someone competent thinks.
  • LiveOverflowWhy things break, at a level below the tooling. Excellent for binary and web internals.
  • NetworkChuckNetworking, Linux and home-lab builds, at a beginner-friendly pace.

Books worth the time

Find people

  • DEF CON GroupsLocal monthly meetups worldwide. The single best way to meet people who do this for a living.
  • OWASP chaptersFree local chapters focused on application security. Talks are usually open to anyone.
  • r/netsecTechnical link aggregation with heavy moderation. Better signal than most feeds.
  • Dr. Talj Gaming CommunityOurs. Gaming first, but the same people run it who secure businesses by day — ask anything.

Practise weekly

One habit beats all of this. Once a week, take a single item from any feed above and reproduce it in your own lab — the vulnerability, the detection, the misconfiguration. People who do that for a year are unrecognisable at the end of it.

Theory, meet reality

Now watch it happen to somebody else

Everything above ages. To keep it current, read the vulnerabilities as they are published — we run a live feed off the National Vulnerability Database and the security press, refreshed every twenty minutes, plus a free checker that tells you whether your own domain can be spoofed.

Open the live feed See the attack map
  • Live vulnerability feedNew CVEs with severity scores, alongside the day's security news
  • SPF, DKIM and DMARC checkerType a domain, see in ten seconds whether anyone can forge mail in your name
  • Live attack mapReal failed logins against our own mail servers, read from our own logs

Training for your team

Want this delivered to your people?

Everything on this page is free and self-directed. If you would rather someone walked your staff through it, we run short, practical sessions for small teams — no slideware marathons. Phishing, passwords, and what to do when something looks wrong, using your own systems as the examples.

Ask about team training Contact us

Talk to an engineer

A person, not a ticket queue

Tell us what you are running and what is bothering you. It reaches the engineers directly, and you get a straight answer — not a sales call.

What is it about?
Email instead

Goes straight to info@cyberinsight.us. We usually reply the same working day, and your details go to us and nobody else.