When I started taking cybersecurity more seriously, one of the first things I noticed was the sheer number of certifications.
CompTIA Security+.
Google Cybersecurity Certificate.
ISC2 Certified in Cybersecurity.
Cisco certifications.
Microsoft certifications.
Then you start seeing people talk about CySA+, CEH, OSCP, CISSP and a collection of acronyms that mean absolutely nothing when you’re new.
It doesn’t take long before learning cybersecurity starts feeling like learning the cybersecurity certification industry.
I didn’t want that.
I’m coming into cybersecurity from SEO and digital marketing. I already have a career. I’m not trying to collect certifications or convince myself that completing a course suddenly makes me a cybersecurity professional.
I wanted somewhere sensible to start.
So instead of asking:
“Which cybersecurity certification looks best on my CV?”
I’ve been more interested in:
“Which one will actually help me understand cybersecurity?”
Those are not necessarily the same question.
First, I Had to Figure Out What I Was Actually Trying to Do
This made choosing a starting point easier.
I’m not currently trying to leave SEO and apply for an entry-level cybersecurity job.
I’m learning because I want to understand technology more deeply.
Working in SEO has already pushed me toward websites, servers, DNS, HTTP, JavaScript, crawling, APIs and increasingly AI.
Cybersecurity felt like another layer underneath many of those things.
I wanted to understand networks.
Threats and vulnerabilities.
Linux.
Authentication and access.
Security controls.
Incident response.
Logs.
Risk.
And eventually, I wanted to do more hands-on work rather than just read about these things.
That meant my first certification didn’t need to be the most prestigious one.
It needed to give me a clear map of what I should learn.
Google Cybersecurity Professional Certificate
This is where I decided to start.
The Google Cybersecurity Professional Certificate appealed to me because it wasn’t built around the assumption that I already understood security.
It introduced cybersecurity from the ground up and gave me exposure to several areas rather than immediately pushing me toward a specialisation.
That was exactly what I needed.
The learning path covered areas such as security risks, networks and network security, Linux and SQL, assets and vulnerabilities, incident detection and response, and Python.
I liked that range.
Before going through it, I’d encountered some of these concepts individually through my work in tech.
I’d used Linux.
I understood HTTP.
I knew what DNS was.
I’d worked around servers and websites.
But knowing individual terms isn’t the same as understanding how they connect inside a security context.
The certificate started helping me connect those dots.
And perhaps more importantly, it showed me how much I still didn’t know.
I consider that a good outcome.
ISC2 Certified in Cybersecurity
Another certification that caught my attention was ISC2’s Certified in Cybersecurity, usually shortened to CC.
What interested me about CC was its beginner positioning.
When you’re new to cybersecurity, it’s easy to look too far ahead.
You see people with CISSP after their names and immediately start researching how to get one.
Then you discover that some certifications are designed for professionals who already have substantial industry experience.
That’s not where I am.
CC made more sense as something designed around foundational security knowledge.
For someone trying to understand cybersecurity concepts and explore whether they want to go deeper into the field, that’s much closer to what I’d be looking for.
It’s one I would consider as part of building stronger foundations rather than trying to jump several stages ahead.
CompTIA Security+
Security+ was almost impossible to avoid when I started researching entry-level cybersecurity certifications.
It appears everywhere.
Job descriptions.
Reddit discussions.
YouTube videos.
Cybersecurity roadmaps.
Training platforms.
Certification recommendations.
And I can understand why.
Security+ covers a broad range of security knowledge and seems to sit at an interesting point between beginner education and more professional security knowledge.
For me, though, there was a question of timing.
Would I learn more by immediately studying for another certification?
Or would I learn more by taking what I’d already studied and actually using it?
That’s something I’m still thinking about.
Security+ remains interesting to me, but I don’t want my cybersecurity roadmap to become:
Course → exam → certificate → next course → exam → certificate.
At some point I need to open a terminal.
Cisco Also Caught My Attention
Networking has been one of the areas that has made me realise how much deeper I need to go.
You can understand websites reasonably well at a practical level without having a particularly deep understanding of networking.
Cybersecurity makes that much harder.
IP addresses.
Ports.
Protocols.
Packets.
Firewalls.
Routing.
DNS.
TCP.
Network segmentation.
Suddenly, things I’ve encountered throughout my career have another layer underneath them.
That’s why Cisco’s learning and certification ecosystem caught my attention.
I don’t necessarily know whether a Cisco certification will become part of my formal certification path.
But networking absolutely needs to become part of my learning path.
That’s an important distinction.
Not everything I learn needs to end with a certificate.
Then There Are the Certifications I’m Not Ready For
Once you start exploring cybersecurity, it’s very easy to get distracted by advanced certifications.
OSCP is a good example.
I can read about penetration testing and think:
That sounds interesting.
And it does.
But being interested in something doesn’t mean I’m ready for it.
The same applies to certifications aimed at experienced security professionals.
CISSP might be highly respected, but that doesn’t make it the logical place for a beginner to start.
I’m trying to resist the temptation to build my learning roadmap around what sounds impressive.
There’s no point having an advanced certification roadmap if I can’t comfortably explain what is happening on a network.
I would rather have strong fundamentals than advanced acronyms.
Certifications Aren’t the Same as Skills
This is probably the biggest thing I’m trying to keep in mind.
Passing an exam proves something.
It shows that you’ve studied a body of knowledge and met the requirements of that certification.
That’s useful.
But it doesn’t automatically mean you can investigate an incident.
Secure a Linux system.
Analyse suspicious traffic.
Read logs effectively.
Identify a misconfiguration.
Write a useful Python script.
Explain why something is vulnerable.
Or know what to do when the neat examples from a course become messy real-world problems.
Those skills require practice.
This reminds me a lot of SEO.
You can complete an SEO course and understand title tags, canonical tags, crawling and keyword research.
Then someone gives you a website with 500,000 URLs, broken JavaScript, three years of migration history and declining traffic.
Suddenly, knowing the definitions isn’t enough.
Cybersecurity seems similar.
The certificate gives you knowledge.
You still have to turn that knowledge into capability.
That’s Why Hands-On Learning Matters to Me
My cybersecurity roadmap is gradually moving toward doing more.
Linux is part of that.
Networking is part of it.
Python is part of it.
Labs are part of it.
Reading logs is part of it.
Breaking things safely and figuring out why they broke is part of it.
I want to reach a point where concepts I currently recognise become things I can actually work with.
For example, it’s one thing to know what a firewall does.
It’s another to configure rules and understand why traffic is or isn’t getting through.
It’s one thing to learn about logs.
It’s another to look through them and notice something unusual.
It’s one thing to learn Python syntax.
It’s another to write a script that helps you process security data.
That’s the gap I’m more interested in closing.
I’m Also Trying Not to Rush Into a Specialisation
Another thing I noticed early was how quickly people ask:
“Which area of cybersecurity do you want to go into?”
I don’t know yet.
And I think that’s okay.
Maybe I’ll become particularly interested in defensive security.
Maybe security operations.
Maybe cloud security.
Maybe application security.
Maybe something that overlaps with websites, search and the work I already do.
Maybe I’ll discover that I enjoy networking much more than I expected.
I don’t want to choose a specialisation based on which job title currently sounds coolest.
I’d rather learn enough of the fundamentals to understand what the different paths actually involve.
Then I can make a better decision.
If I Were Starting Again, I’d Still Start Broad
Looking at the entry-level cybersecurity certifications I considered, I think starting broad was the right decision for me.
The Google Cybersecurity Certificate gave me somewhere accessible to begin.
ISC2 CC makes sense to me as another foundational option.
Security+ is something I’d consider when I want to formalise and deepen that broader security knowledge.
And networking deserves serious attention regardless of whether I eventually attach a Cisco certification to it.
But I wouldn’t try to do all of them just because they’re available.
There will always be another certification.
The harder question is whether I’m becoming more capable.
My Cybersecurity Roadmap Isn’t a Certification Roadmap
That’s probably the biggest change in how I’m thinking about this.
When I first started researching cybersecurity, certifications seemed like convenient milestones.
Complete this.
Then this.
Then this.
Eventually become “good at cybersecurity”.
I don’t think it works like that.
My roadmap now looks more like:
Learn the fundamentals.
Understand networking properly.
Get more comfortable with Linux.
Keep learning Python.
Practise with labs.
Work with logs.
Explore defensive security.
Build small projects.
Document what I learn.
And use certifications where they genuinely support that journey.
I’m still at the beginning, so this roadmap will probably change.
I expect it to.
That’s part of why I’m documenting it.
A year from now, I want to be able to look back at what I thought cybersecurity was, compare it with what I’ve learned, and see where my interests took me.
The goal isn’t to collect enough certificates to look like I know cybersecurity.
The goal is to eventually know enough cybersecurity that the certificates are evidence of something I’ve actually learned.
