The more I learn about cybersecurity, the more I realise how much I don’t know.
I’m starting to think that’s normal.
When I first became interested in cybersecurity, I assumed my background in IT, websites, digital marketing and SEO would give me a decent head start.
And it has.
I already knew what DNS was. I understood HTTP and HTTPS. I’ve worked with websites, servers, CMS platforms, redirects, APIs, JavaScript and plenty of technical SEO problems.
Then I started properly learning cybersecurity and quickly discovered something:
Recognising the terminology is very different from understanding what’s actually happening underneath it.
So, is cybersecurity hard to learn?
Based on my experience so far, yes.
But not for the reasons I originally expected.
And importantly, I don’t think “hard” means “you shouldn’t try.”
I Didn’t Start Completely From Zero
I think it’s important to explain where I’m coming from.
My career is in SEO and digital marketing, not cybersecurity.
But my original academic background is in IT, and I’ve spent years working around websites and technology.
Technical SEO has also naturally exposed me to things like:
servers;
DNS;
HTTP status codes;
SSL certificates;
JavaScript;
APIs;
log files;
CDNs;
crawlers;
bots;
website migrations;
and occasionally websites behaving in ways nobody can immediately explain.
So when I started learning cybersecurity, some of the words were already familiar.
That gave me confidence.
Possibly too much confidence.
Because cybersecurity has a funny way of taking something you thought you understood and asking:
“Okay, but do you actually understand how it works?”
That’s where things started getting interesting.
Cybersecurity Isn’t One Thing
This was probably my first major realisation.
When people say:
“I want to learn cybersecurity.”
That’s a little like saying:
“I want to learn technology.”
Okay.
Which part?
Cybersecurity can take you into networking, operating systems, cloud security, application security, penetration testing, security operations, incident response, digital forensics, identity and access management, governance, risk, compliance, threat intelligence, malware analysis and plenty more.
Then each one of those areas has another layer underneath it.
You start learning networking.
Now you’re learning about TCP/IP.
Ports.
Protocols.
Packets.
Routing.
Firewalls.
Subnets.
DNS.
Then you realise networking itself is an entire career.
That’s probably one of the things that makes cybersecurity feel difficult at first.
The problem isn’t always understanding one concept. It’s realising how many concepts there are.
Networking Has Probably Humbled Me the Most
If I had to pick one area that has exposed gaps in my knowledge, networking would be high on the list.
I’ve used the internet practically my entire professional life.
I’ve worked on websites for years.
I know what an IP address is.
I know what DNS does.
I know what HTTPS is.
Then you start looking deeper.
What actually happens when my computer requests a webpage?
Where does the packet go?
What’s happening at each layer?
Which port is being used?
What’s the difference between TCP and UDP?
What exactly is the firewall checking?
How does network segmentation work?
What would suspicious network traffic actually look like?
Suddenly, concepts I’ve been using around the edges for years become much deeper.
And I actually like that.
It makes the internet feel less magical.
Instead of:
“I typed a URL and the website loaded.”
you start thinking about everything that had to happen for that website to appear.
For someone working in SEO, that’s fascinating because we spend our careers working on the web without necessarily understanding every layer underneath it.
Linux Has Been Another Adjustment
Linux is another good example.
I’ve encountered Linux before.
But there’s a difference between occasionally running a command and actually becoming comfortable operating in that environment.
When you’re used to graphical interfaces, the command line initially feels like the computer has removed all the helpful buttons just to make your life difficult.
You type something.
Error.
Try again.
Permission denied.
Change something.
Different error.
Google it.
Realise you were in the wrong directory.
Try again.
It works.
Then two days later you can’t remember the command.
That’s been part of the learning process.
But slowly, the terminal becomes less intimidating.
Commands start making sense.
Directories make more sense.
Permissions become less abstract.
You stop seeing the command line as this mysterious place developers disappear into.
You start seeing it as another way of communicating with the computer.
I’m definitely not a Linux expert.
But I’m much less intimidated by it than I was.
That’s progress.
Cybersecurity Has Made Me Think Differently About Websites
This has probably been the most interesting connection with my existing career.
As an SEO, I might look at a website and ask:
Can Google crawl it?
Can Google render it?
Is the page indexed?
Are redirects working?
Is the canonical correct?
Is JavaScript causing problems?
Is the server responding properly?
Is the content accessible?
Cybersecurity makes me look at the same website and ask completely different questions.
Who can access this?
What information is exposed?
What happens if someone sends an unexpected request?
Are permissions configured correctly?
What software is running?
Is it outdated?
What could be exploited?
What gets logged?
What would happen if the website were compromised?
Same website.
Different mindset.
That’s one of the reasons I’ve enjoyed learning cybersecurity so far.
I’m not throwing away what I already know.
I’m adding another lens to it.
The Google Cybersecurity Certificate Gave Me a Map
One thing that helped me was starting with structured learning rather than randomly watching cybersecurity videos.
I went through the Google Cybersecurity Professional Certificate because I wanted an introduction to the field rather than immediately trying to specialise.
It exposed me to areas such as security risks, network security, Linux, SQL, assets and vulnerabilities, incident detection and response, and Python.
I wouldn’t say finishing a course means I “know cybersecurity”.
Far from it.
What it gave me was something more useful at this stage:
A map.
Before, cybersecurity looked like one enormous subject.
Now I can at least see some of the different areas and understand how they relate.
That’s a very different type of progress.
The Hardest Part Is Moving From “I Understand” to “I Can Do”
Courses can create an interesting illusion.
You watch someone explain a concept.
It makes sense.
You answer a quiz question correctly.
Great.
You understand cybersecurity.
Then you’re given a practical problem.
Suddenly:
…
That gap is real.
I can read about logs and understand why they’re important.
That’s different from opening a large log file and identifying what looks suspicious.
I can explain what a firewall does.
That’s different from configuring one.
I can explain vulnerabilities.
That’s different from investigating one.
I can understand a Python example.
That’s different from opening an empty file and building the script myself.
This is why I’m increasingly convinced that my next stage of learning needs to involve more hands-on practice.
Labs.
Small projects.
Linux.
Networking exercises.
Python.
Log analysis.
Actually doing things.
Because eventually you have to move from:
“I’ve learned about this.”
to:
“I’ve done this.”
Python Is Giving Me the Same Beginner Feeling
I’m learning Python at the same time, which means I’ve apparently decided one beginner experience wasn’t enough.
The interesting thing is that Python keeps appearing in both worlds.
In SEO, I’m interested in using it for things like analysing URLs, combining datasets, checking metadata, working with APIs and automating repetitive tasks.
In cybersecurity, I keep seeing opportunities around processing files, analysing logs, working with data and automating security tasks.
That overlap gives me another reason to continue.
But again, AI makes it very easy to fool yourself.
I can describe a Python script to ChatGPT and get something usable almost immediately.
That doesn’t mean I understand Python.
So I’m trying to slow myself down enough to understand what the code is doing rather than measuring progress by how impressive the output looks.
AI Makes Cybersecurity Easier to Learn — and Easier to Fake Learning
This is something I think about a lot.
Learning technical subjects today is incredible.
I can ask AI:
“Explain this networking concept like I’m a beginner.”
Then:
“Okay, now explain it technically.”
Then:
“Give me an example.”
Then:
“Quiz me.”
Then:
“Why did I get question three wrong?”
That’s an amazing learning environment.
But there’s a danger.
AI can remove the struggle that sometimes creates understanding.
If every time something breaks I immediately ask AI for the solution, I can get very good at copying solutions without getting much better at solving problems.
So I’m trying to use AI as a tutor rather than an escape button.
Sometimes I need to sit with the problem.
Read the error.
Try something.
Get it wrong.
Try again.
Because cybersecurity seems to reward people who can investigate.
And investigation requires being comfortable not immediately knowing the answer.
I Also Had to Get Comfortable Being a Beginner Again
This might actually be harder than networking.
I’ve spent years working in SEO and digital marketing.
I’m comfortable having conversations about SEO strategy.
I can look at performance data and start asking useful questions.
I can crawl a website and understand what I’m looking at.
Then I open a cybersecurity lab, and suddenly I’m asking:
“Wait… which command was that again?”
That’s humbling.
But I think it’s healthy.
The further you progress in your career, the easier it becomes to stay inside the areas where you already feel competent.
Being a beginner threatens that comfort.
You have to ask basic questions.
You make silly mistakes.
You misunderstand things.
You occasionally spend twenty minutes troubleshooting something only to discover you’ve typed the command incorrectly.
That’s part of it.
I’d rather be temporarily uncomfortable learning something new than permanently comfortable knowing only what I already know.
Cybersecurity Doesn’t Require You to Know Everything
This is something I’m still teaching myself.
Because cybersecurity is so broad, it’s easy to look at everything you don’t know and conclude that you’re falling behind.
But nobody knows everything.
Someone might understand networks far better than I do but know very little about application security.
Someone else might specialise in cloud security.
Another person might spend their career in governance and risk.
Another might work in incident response.
Another might focus on penetration testing.
The goal isn’t to download the entire cybersecurity industry into your brain.
For me, the goal right now is much simpler:
Build strong fundamentals.
Understand networking better.
Get comfortable with Linux.
Keep learning Python.
Understand common security concepts.
Practise with labs.
Learn how to investigate.
Then see which areas naturally hold my attention.
I don’t need to decide today what kind of cybersecurity professional I would theoretically become years from now.
I’m still discovering what I enjoy.
Certifications Help, but I Don’t Want to Hide Behind Them
It’s tempting to make learning measurable through certificates.
Complete course.
Receive a certificate.
Add to LinkedIn.
Move to the next certificate.
There’s nothing wrong with certifications.
I’m doing them.
But I’ve become more interested in whether I can actually use what I’ve learned.
Can I explain the concept without looking at my notes?
Can I recognise it in a real situation?
Can I complete a lab?
Can I troubleshoot when something doesn’t work?
Can I build something?
Can I investigate something?
That’s harder to measure than completing another course.
But I suspect it’s much closer to actual competence.
So, How Hard Is Cybersecurity to Learn?
Hard enough to challenge me.
Not hard enough to make me want to stop.
The difficulty comes from the breadth of the subject, the technical depth underneath seemingly simple concepts and the gap between understanding theory and applying it.
But cybersecurity also becomes easier when you stop trying to learn cybersecurity and start learning individual things.
Today, understand DNS better.
Tomorrow, practise Linux commands.
Next week, learn what happens during a TCP connection.
Then analyse some logs.
Write a small Python script.
Complete a lab.
Break something safely.
Figure out why it broke.
One concept becomes another.
Then another.
Eventually, things that once looked completely unfamiliar start connecting.
That’s how SEO worked for me too.
I didn’t wake up one morning understanding technical SEO, content, analytics, local search and strategy.
It accumulated.
Years of problems.
Websites.
Mistakes.
Questions.
Google searches.
Experiments.
People teaching me things.
Cybersecurity will probably be the same.
I’m Still Very Much Learning
I want to make that clear whenever I write about cybersecurity.
These aren’t articles from someone claiming to be a security expert.
They’re notes from someone learning.
Six months from now, I might read some of my early cybersecurity posts and realise I misunderstood something.
Good.
That means I’ve learned more.
Part of the reason I’m writing about the journey now instead of waiting until I feel “qualified” is that I think there’s value in documenting the beginner stage.
Experts can tell you where the road leads.
Beginners can sometimes describe what the first few kilometres actually feel like.
Right now, cybersecurity feels enormous.
Occasionally confusing.
Frequently humbling.
But also incredibly interesting.
And every time something that previously made no sense finally clicks, the next difficult thing becomes slightly less intimidating.
So if you’re wondering whether cybersecurity is hard to learn, my answer so far is:
Yes.
But maybe that’s the wrong question.
A better one might be:
Is cybersecurity interesting enough that you’re willing to be bad at it for a while?
For me, the answer is also yes.
And right now, that’s enough reason to keep going.
