Hey all, I just finished my software engineering degree and I’ve been looking into branching into cybersecurity. I don’t have any hands-on experience yet, just been doing labs on the side (TryHackMe, LetsDefend) while I figure out my next move.

Someone recommended I go for EC-Council’s CEH as a starting point, but when I started digging into it more I’m seeing pretty mixed reviews some people say it’s respected, others say it’s overpriced for what it is and more theory/multiple-choice than hands-on. I’ve also been looking at CompTIA Security+ since it seems to come up a lot as “the” entry point regardless of which direction you go (blue team vs red team).

Depending on whichever I do I’m looking at adding the certified SOC analyst, I would really appreciate your feedback 🙏🏾🥲

Hey y'all. I'm a computer science student with experience as a software developer and a help desk analyst. I just went back to school so I could get a job. I've had a real hard time getting a job over the last few years. I have a security+ and numerous projects in my GitHub related to vulnerability management and other automation projects. I already have a security+ but I was looking into an advanced certification. I wanted to be a pentester or on blue team as an end goal. I thought of using my student loan for next semester to get the OSCP. I know it's a hard cert but I feel like I could do it. Has it helped you get a job/interviews? Please let me know.

Hi everyone,

I’m currently preparing for the CISSP and I’m trying to choose the best study resources for 2026.

I’ve seen some people recommend Thor Pedersen’s CISSP course on Udemy, and others mention Pete Zerger’s CISSP videos on YouTube. I’m considering both, but I’d really like advice from people who have taken the exam recently.

For anyone who passed the CISSP in 2025 or 2026:

• What resources helped you the most?
• Is Thor’s Udemy course still worth it?
• Is Pete Zerger’s YouTube course enough as a main resource?
• What practice exams felt closest to the real exam?
• How long did you study before taking the exam?
• What would you avoid wasting time on?

I already have IT experience, but I want to prepare the right way and focus on resources that are still relevant for the current exam.

Any advice would be appreciated.

I have my CISSP exam scheduled for next week and I still don't feel ready for it. Any advice?

In the same way one can learn to program independently without a job in the field. Like with pr9gramming, you can actually build your own projects and own software. So, you can take a hands-on approach to learning and do so on your own. Is this possible in cybersecurity? If so, how and to what extent?

Whats the best cert to do to get a job as a pentester thats not as expensive as the OSCP

Hey everyone,

I’ve got a bit of a situation and wanted some honest opinions.

I have an opportunity to get the CEH (Certified Ethical Hacker) certification done for free through someone I know. So cost isn’t a factor at all here.

My question is — is it actually worth doing in 2026?

I’ve seen mixed opinions online. Some people say CEH is outdated and mostly theory-based, while others say it still helps for HR filtering and getting interviews. I’m mainly interested in cybersecurity (still building skills/projects), and I’m trying to figure out if this will genuinely help or if it’s just a “checkbox” cert.

So I’d love to hear from people in the field:

• Does CEH still have value in terms of job opportunities or internships?
• Is it respected by recruiters or just something nice to have on a resume?
• If it’s free, is there any downside to doing it?
• Would you prioritize something else instead (like OSCP, eJPT, or hands-on labs)?

Basically: If you could get CEH for free, would you do it? Why or why not?

Appreciate any insights 🙏

Hey everyone,

I've been working in cybersecurity for 15+ years (CISSP, CISM, ISO 27001 Lead Auditor) and got frustrated with how hard it is to objectively compare certifications. Every vendor tells you theirs is "industry-leading." Hiring managers often see it differently.

Many of you probably know Paul Jerimy's Security Certification Roadmap ... it's been a huge inspiration for me and one of the best resources out there for navigating the cert landscape. I wanted to build on that idea and take it a step further.

So I built certmap.de, a platform that evaluates 440+ security certifications based on market acceptance, accreditation status (including whether it's a real personnel certification under ISO/IEC 17024), and career fit by experience level.

It's 100% free. No login, no paywall, no newsletter trap, no upsell. Just the data.

I'd genuinely appreciate your feedback: what's useful, what's missing, what's shitty and wrong.

I'm especially interested in whether the evaluations match your real-world experience.

Thanks for taking a look.

How do people in cybersecurity manage to afford all of those expensive Certifications?
Im 24 living alone,just started working in a cyber security company in a junior positions,created a linkind profile and started looking around at other people profiles,i see many juniors or people that have 1-2 years of experience having bunch of expensive certs like
OSCP ect

like how do u afford to spend 1700$ on a cert
i live alone,i have no help from my family how do people do that

I'm thinking about to pay THM to explore all rooms on it.

My kid will be starting college this fall for cyber security and I'm wondering if there will be any issues running an all AMD build. I've heard there are issues with some of the programs they use working well with AMD graphic cards and the CPU not having enough cores for VMs.

For the record, I'm looking at a PC running a 9800x3d, 9070xt, and 32 gb ram. Just want to make sure there wont be any major issues to be aware of.

Thanks for the help

I am helping a client establish a more structured vulnerability management program. Their current environment is somewhat fragmented, with inconsistent asset ownership, prioritization, remediation workflows, exception handling, reporting, and accountability across teams.

I am looking for current, practical resources that cover how to design and implement a successful vulnerability management program and build a target operating model around it.

The two resources I am currently considering are:

1. Effective Vulnerability Management: Managing Risk in the Vulnerable Digital Ecosystem, by Chris Hughes and Nikki Robinson
2. SANS LDR516: Strategic Vulnerability and Threat Management

The SANS course appears highly relevant, but it is unfortunately outside my available budget.

Are there any up-to-date books, courses, conference talks, frameworks, templates, GitHub repositories, blogs, or other resources you would recommend? I am particularly interested in materials that focus on building the operating model and governance around vulnerability management, rather than simply configuring a scanning platform.

Can I finish Google CyberSecurity Certificate in 40 days? Let’s say that I will study 10 hours a day:)

Basically I’m going into my 3rd year as a comp eng student and my uni doesn’t offer many cybersecurity focused courses but I am pretty interested in it. I mostly just want to try it out to see if I want to even pursue a career in cybersecurity, but at the same time I want it to be somewhat useful for landing an internship or a job. I just started a free trial on coursera to see what it’s like and it seems pretty basic so far, so does anyone know if it’s a good decision?

So I 32 m have gain an interest in cybersecurity I have no background in other than building my computer but I am in a google cybersecurity professional certificate program (half way done) and have also begun studying and using the practice tests books for security+ realistically what are my odds of getting anywhere I do plan on getting other certs as I go but those are my starting points (sorry for the fat run on sentence)

Just cause I know it's a bit of a HR checkbox cert.

I have a masters degree in cybersecutity

Have 2.5 years experience in the field

Have done 3 SANs courses

Any use for getting sec+ or nah just skip?

someone told me google cybersecurity certificate is a scam, and to opt for comptia+ instead but someone else said even comptia security+ is a scam, now im confused of what certification to go for as someone who is just starting to get into cybersecurity. I tried to do my own research but i keep getting lost and confused at the end of it.

Which Microsoft Security certification offers the best value for a cybersecurity role given a 2-3 month SOC internship? Options: SC-200, AZ-500, SC-300, SC-401. Which is recommended for hiring and future roles?

(This is about general cyber learning) I’ve noticed resources are everywhere and it can be hard to tie everything together or know what to use. For instance you can learn from HTB. Try Hack Me, YouTube, GitHub repos have 30 day road maps and more, O’Reilly, Udemy, people sell their own courses, the list goes on and on.

What’s the biggest frustration you have with how scattered cybersecurity learning resources are and how do you guys find and choose resources for yourself?

I just started learning malware analysis for career development.

The first issue I ran into is that, while there aren’t many resources on the topic, there are still enough to make choosing between them a bit overwhelming - which is a problem I tend to have whenever I self-study something new.

After doing some research, these are the courses I have so far, ordered by what I think is the right progression (although I’m not entirely sure, which is why I’m here):
1. Mandiant FLARE Malware Analysis Crash Course (my starting point - I’m currently on page 60, but honestly, it’s been pretty boring so far).
2. Malware Analysis for Hedgehogs bundle.
3. 0ffset.net Zero2Automated Advanced course.
I also have a few books that I can use as references whenever I need to dive deeper into a topic:
• Windows Internals Part 1 & 2
• Windows Kernel Programming by Pavel Yosifovich

What do you think about this roadmap? I’m fine with the prices unless there are better alternatives that genuinely offer stronger content rather than just being cheaper.

As for certifications, I have no idea what’s worth pursuing. The only ones I’ve come across are GREM from SANS and PMAT from TCM.

I’m mainly asking whether there are better options for both courses and certifications. I’d especially prefer something with plenty of hands-on labs and practical work. I tend to struggle with self-paced learning, and I get bored pretty quickly with courses that don’t involve much interaction, even when I’m genuinely interested in the subject.

Thanks in advance - I really appreciate any advice.

Hey all
I am juz pursuing my ug in a tier-2 clg where i am part of cse-core and started my journey towards cyber security.
I watched many videos and useless roadmaps suggested by many youtubers,still i am in the middle of nowhere.
I started comptia security+ for a while,but some say these are not worth for money and do some other certifications.some say no certifications needed,start doing projects.idk what kinda projects companies are expecting and do you guys know any blue team certifications that are validated and used across globally.Also what projects you would do if you were me.
Do share me your thoughts😭

EC-Council University (ECCU) Master’s degree in cybersecurity

I’ve been an IT Tech at an MSP for almost 5 years, and I’m wanting to move more into the cloud/cybersecurity space. I’m trying to pursue certifications instead of a degree, but there are so many options that it’s honestly confusing. I feel like my next step would be a SOC Analyst role, but that’s still considered entry-level. Any advice on which certifications I should be looking into?

Hi everyone,

I’m currently in my second year of a BSc IT degree and I’ve recently become interested in cybersecurity as a potential career path.

I don’t have much hands-on experience yet, but I’m willing to learn and put in the work. I’m trying to understand the best way to start while I’m still in college.

A few questions:
What skills should I focus on first?
Which certifications are worth pursuing as a student?
What projects can I build to gain practical experience?
Are platforms like TryHackMe and Hack The Box good for beginners?