Cyber Security Roadmap 2026: The Week This Plan Skips

12 min read

18,600 people have starred the most popular free cyber security study plan on GitHub. Not one of them seems to have written down that a full week of it is missing.

The best free cyber security roadmap for 2026 is still that plan, and it runs like this: seven days on networking, seven on security fundamentals, two weeks each on Linux, Python and traffic analysis, one week each on Git, the ELK stack and a cloud platform, then hacking labs and the job search. It costs nothing. But days 78 to 84 have no topic assigned to them, the plan actually runs to day 95, and it never once asks you to build something you can show a hiring manager.

Want the raw source? Click here for the 90DaysOfCyberSecurity repo by Farhan Ashraf. Star it, fork it, use it. But read this first, because those three gaps will cost you weeks if you walk into them blind.

Key takeaways

• 90DaysOfCyberSecurity is 12 weeks, sequential, and assumes zero prior experience.
• Networking and Security+ concepts come first for a reason. Skip them and everything after is memorisation.
• Days 78 to 84 are empty in the repo. There is a full week unaccounted for.
• The plan ends at day 95, not 90. The name is a round number, not a schedule.
• There is no project or portfolio step anywhere in it. That is the part that actually gets you hired.

[Image: A 12 week grid calendar with each block labelled by topic, networking through job search, with days 78 to 84 shown as an empty red block, in the Art of Code green and black style]

What is the best cyber security roadmap for 2026?

Honest answer: the best cyber security roadmap is the one you do not abandon in week three.

That sounds like a dodge. It is not. You already have access to more security training than a Fortune 500 team had in 2010. Professor Messer's entire Security+ course is free on YouTube. Hack The Box has a free tier. Linux Journey, Learn Git Branching, VulnHub, all free. The gap between you and a security job has never been a paywall.

The gap is sequence and consistency. A paid course sells you a sequence. A public GitHub roadmap gives you the same sequence for nothing, which means what you are really buying in a paid course is the guilt of having spent money. Some people genuinely need that guilt to finish things. If that is you, buy the course, no judgement.

For everyone else, a fixed public plan is enough structure. And in 2026 the plan with the most community behind it is 90DaysOfCyberSecurity, at 18.6k stars and 2.1k forks. That is why this post takes it apart instead of inventing a new one.

The people who finish are not smarter. They just did the two weeks that felt like homework.

What does the 90 day cyber security plan cover, day by day?

Here is the full breakdown, with what each block is really teaching you underneath the topic name.

Days	Topic	What you are actually learning
1 to 7	Network+ concepts	How packets move, what a subnet is, why ports matter
8 to 14	Security+ concepts	The vocabulary of the field. CIA triad, threat models, controls
15 to 28	Linux	The terminal, permissions, processes, logs
29 to 42	Python	Scripting, automation, parsing output you cannot read by hand
43 to 56	Traffic analysis	Wireshark, tcpdump, Suricata. Reading a network like a book
57 to 63	Git	Version control, branching, not destroying your own work
64 to 70	ELK stack	Log ingestion, searching, dashboards. The SOC analyst's daily view
71 to 77	Cloud (pick one)	AWS, Azure or GCP fundamentals and the shared responsibility model
78 to 84	Nothing. Empty.	See below
85 to 90	Hacking and pentesting	Hack The Box, VulnHub, guided exploitation
91 to 95	Resume and job search	Templates, applications, LinkedIn

The resource picks are good. Professor Messer's free Network+ and Security+ playlists beat most paid courses outright. Linux Journey and LabEx give you a terminal in the browser so you never fight an install on day one. Learn Git Branching is the only Git tutorial I have seen make branching click on the first attempt.

Notice what the sequence is doing. It front loads the boring stuff deliberately. Networking and security concepts are weeks one and two because every single thing after them, every Wireshark capture and every ELK query, is meaningless if you do not know what a TCP handshake is.

Most people want to start at day 85. That is the hacking week. That is exactly why most people quit on day 12.

What is missing from the 90DaysOfCyberSecurity repo?

Three things. None are dealbreakers. All of them matter.

One. Days 78 to 84 do not exist. Go back and read the table. It jumps from day 77, the end of cloud week, straight to day 85, the start of hacking week. A seven day hole sits in the middle of a plan named after a day count, and it has been there through 2.1k forks.

Two. The plan is 95 days, not 90. Days 91 to 95 are the resume and job search. So the real commitment is a little over three months, and the last five days are not study days at all. Budget accordingly or the end of the plan will feel like failure when it is just arithmetic.

Three. There is no assessment and no portfolio. You could complete every day of this plan, absorb all of it, and finish with nothing to show except a claim that you did it. Nothing in the repo produces an artifact. That is the single biggest weakness, and it is the one I would fix first.

Also absent: compliance and frameworks. No NIST, no CIS controls, no ISO 27001. For a hands on analyst path that is survivable. If you are aiming at GRC it is a hole you will have to fill yourself.

What should you actually do in days 78 to 84?

This is the week I would add, and the slot is perfect. It sits right after cloud week and right before hacking week, which is exactly where the plan should turn theory into an artifact.

Detection engineering plus a home lab.

Seven days, roughly like this:

• Days 78 to 79. Build the lab. A Windows VM and a Linux VM on your own machine, on a host only network so nothing escapes.
• Day 80. Ship logs from both into the ELK stack you set up in week 10. Now your dashboards have your data in them, not a tutorial's data.
• Days 81 to 82. Learn the MITRE ATT&CK framework. Pick five techniques. Just five.
• Days 83 to 84. Simulate those five techniques against your own VMs, then write a detection rule for each and prove it fires.

At the end of that week you have a lab you built, logs you shipped, attacks you ran and rules you wrote. That is a portfolio. It is also the most common thing hiring managers name when asked what separates a candidate who studied from a candidate who can do the job.

# Day 80: point a Linux VM's logs at your ELK stack
# /etc/filebeat/filebeat.yml
filebeat.inputs:
  - type: filestream
    id: syslog
    paths:
      - /var/log/auth.log
      - /var/log/syslog

output.elasticsearch:
  hosts: ["http://192.168.56.1:9200"]

# then
sudo filebeat test config
sudo systemctl enable --now filebeat

Run that, fail a few SSH logins on purpose, and watch them land in Kibana. The first time you see your own bad password attempt appear in a dashboard you built yourself, something clicks that no video can hand you.

[Image: A Kibana dashboard screenshot showing failed SSH authentication attempts spiking, annotated with an arrow reading "your own login, your own logs"]

Do you need Python and Linux for cyber security?

Yes to both, and no, you do not need to become a software engineer first.

Linux is not optional. Most of the tooling, most of the servers you will be defending or testing, and most of the logs you will read are Linux. You need the terminal, file permissions, processes, services and log locations. Two weeks in the plan is enough to get functional.

Python is required at a scripting level. You are not building applications. You are parsing logs, automating a check you would otherwise do 40 times, calling an API and reading someone else's tool well enough to change one line of it. The two weeks the plan allocates get you there if you write code every day instead of watching videos about writing code.

What you do not need: a computer science degree, C, assembly, or the ability to invent an exploit from scratch. Those matter for specific niches. They are not entry requirements.

Is entry level cyber security still worth it in 2026?

It is worth it, but the entry point moved, and pretending otherwise would be lying to you.

Tier one SOC work, the alert triage job that used to be the standard first rung, is the exact shape of work automation eats first. Rule based triage, alert enrichment, first pass classification. A lot of that is already handled by tooling and AI assisted workflows, and the teams running it are leaner than they were three years ago. That is why entry level postings feel scarcer than the "3.5 million unfilled jobs" headlines suggest.

What did not shrink is anything requiring judgement. Detection engineering. Cloud security. Incident response. Anywhere the question is "should this be an alert at all" rather than "is this alert real".

So the roadmap is still correct. Your target changed. Do not aim to be the person who reads the queue. Aim to be the person who decides what goes into it. Which is precisely why the missing week matters more than any other week in this plan.

The same logic applies to AI itself. Security people who use AI to write and tune detection rules faster will run circles around people who refuse to touch it. It is a tool. Learn it or watch someone with three years less experience out ship you.

Can you really learn cyber security in 3 months?

You can learn it. You probably cannot get hired on it alone. Both halves of that sentence are true and most people only tell you one.

Three months of honest daily work gets you: the vocabulary, working Linux and Python, the ability to read a packet capture, a functioning ELK stack and enough hands on time to hold a technical conversation without bluffing. That is real. That is more than a lot of people with a degree walk out with.

What three months does not get you: a certification most HR filters look for, years of experience, or a network of people who can refer you. Security+ alone is usually another 4 to 8 weeks on top.

So treat 90 days as the prerequisite, not the finish line. The people who get hired fast after this plan are the ones who spent months four through six building in public, doing labs, and applying, not the ones who finished day 95 and waited.

How do you get through 90 days without quitting?

Nobody quits on day one. They quit on day 11, or day 34, in the middle of Python week when the novelty is gone and hacking week is still a month out.

Three things that work:

1. Fix the time, not the amount. The same 45 minutes every day. Not "two hours when I am free", because you will never be free. A fixed slot survives a bad week. A flexible goal does not.
2. Ship something visible every week. A commit, a lab screenshot, a short post about what broke. Public progress creates a cost to stopping. It is the same reason building in public works for products.
3. Allow yourself to be behind, never to be gone. Missing day 30 is nothing. Missing days 30 to 37 and then deciding you must restart from day one is what actually ends it. Pick up where you dropped it.

A note from the other side of the fence, since it is relevant to how you should read all of this. I am not a security engineer. I build web products, I have shipped 17 developer tools and I run artofcode.in on Next.js and Convex. The number of times a security decision has landed on my desk with no security person in the room is not small. Password hashing, token expiry, what goes inside a JWT, whether an uploaded image is leaking someone's location. Every builder hits this. You do not need a SOC job to need this knowledge.

Which is also why I would use small tools instead of rebuilding them while you study. When you hit credentials and hashing, generate throwaways with a strong password generator rather than recycling your own. When you reach token based auth, decode a JWT and read the claims in plain text, which teaches you faster than any article why sensitive data does not belong in a payload. And when you start on data leakage, push a photo through this free metadata scrubber and look at what your camera has been quietly writing into every image you post.

What should you have at the end of day 95?

Not a certificate. Four things:

• A GitHub repo with your Python scripts and detection rules, committed across 12 weeks so the history itself proves the consistency.
• A home lab you can describe in an interview, including the part where you broke it.
• Ten to fifteen Hack The Box or VulnHub boxes with written notes on each.
• A resume that describes what you built, not what you watched.

That last one is where self taught candidates lose. "Completed a 90 day cyber security study plan" is a weak line. "Built a two VM lab, shipped logs to ELK, wrote detections for five MITRE ATT&CK techniques and validated each one fires" is a strong one. Same 90 days. Completely different outcome.

Actionable takeaways

• Use the 90DaysOfCyberSecurity repo as your only plan. Stop collecting alternatives.
• Do weeks one and two properly even though they are the least fun. Everything downstream sits on them.
• Block days 78 to 84 for the home lab and detection week. The repo leaves it empty. Fill it.
• Commit something to GitHub every week. The commit history is your proof of consistency.
• Budget 95 days, not 90, and treat the last five as job search work.
• Target detection, cloud and IR roles rather than pure alert triage.
• Plan for months four to six. Certification and applications live there, not inside the 90.

Frequently Asked Questions

Is the 90 days of cyber security roadmap free?

Yes. The plan is a public GitHub repository under an MIT license, and nearly every resource it links to is free or has a usable free tier. Professor Messer's Network+ and Security+ courses, Linux Journey, Learn Git Branching and VulnHub cost nothing. Hack The Box and Codecademy have paid tiers you can skip entirely.

Can a complete beginner follow this cyber security roadmap?

Yes. It assumes no prior security experience and starts with networking fundamentals from scratch. You need basic computer literacy and the ability to install software on your own machine. The first two weeks are deliberately slow so the Linux and Python sections later have something to stand on.

Can I learn cyber security in 3 months?

You can build a genuine foundation in three months: Linux, Python scripting, traffic analysis and a working ELK stack. Getting hired usually takes longer, because most employers also want a certification such as Security+ and some evidence you have built something. Treat 90 days as the prerequisite and plan for months four to six.

What is missing from the 90DaysOfCyberSecurity repo?

Three things. Days 78 to 84 have no topic assigned, so a full week sits empty. There are no quizzes or assessments to check retention. And there is no project or portfolio requirement, which is the part hiring managers weigh most heavily. Filling that empty week with a home lab and detection work solves the third problem too.

Do I need to know coding for cyber security?

You need scripting, not software engineering. Python at the level of parsing logs, automating repeat checks and calling an API is enough for most defensive roles. You do not need C, assembly or a computer science degree to start, though they matter in specific niches like malware analysis and exploit development.

Will AI replace entry level cyber security jobs?

It is already compressing them. Tier one alert triage is the most automatable part of security, and those teams are smaller than they were. Roles built on judgement, such as detection engineering, cloud security and incident response, are not shrinking. Aim there rather than at the alert queue.

Pick your start date, block 45 minutes a day, and if you want free tooling to lean on while you work through it, the whole Art of Code toolkit is open with no signup.

Written by Adithya Guttha, Founder of Art of Code.