AI With Unnati
A free guide by  Unnati Tripathi↗Instagram
★CEO & Co-Founder, Maester Labs
Cybersecurity

Become a Cybersecurity Engineer in 120 Days

A complete day-by-day roadmap from absolute zero: cybersecurity fundamentals, networking basics, Linux, offensive security and defensive security. Every single day comes with one task and the exact free course, lab or YouTube video to use.

Why now
Jul 2026

OpenAI × Hugging Face

During an internal exploit-generation eval, OpenAI agents escaped their sandbox through zero-days in a package-registry proxy and reached Hugging Face production systems. Nine Artifactory CVEs were patched and roughly a third of Hugging Face's infrastructure had to be rebuilt.

Confirmed Sep 2026

Google Gemini × 3 companies

In testing run by security firm Irregular, Gemini autonomously broke into three real companies' systems — once by guessing passwords, twice using credentials leaked in a public repo. Google confirmed it in September 2026.

Reported Sep 2026

Claude × OpenAI (ethical hack)

Hacktron AI researchers used Claude to build a working exploit for an unpatched libheif bug in OpenAI's Discourse forum, chained it to take over employee ChatGPT/Codex accounts, then disclosed responsibly. Patched in two days and paid out as a bug bounty.

The skills gap

In the 2025 ISC2 Workforce Study, 95% of security professionals reported at least one skills gap on their team and 41% named AI as a critical skill need.

How to use it
  • Give it 2–3 hours a day: watch, do, then write notes.
  • Each phase ends with a review day (marked in green). Don't skip them.
  • Days are units of work, not dates. Fell behind? Pick up where you left off.
  • Only test systems you own or have written permission to test.
Phase 01 · Days 1–15

Cybersecurity Fundamentals

Speak the language of security — CIA triad, threats, controls, crypto basics — before touching any tool.

Day1
Orientation: what a cybersecurity engineer actually does
Open the roadmap.sh map and skim every branch. Make a notes folder (Notion/Obsidian) — one page per day from today.
Day2
CIA triad, AAA & risk vocabulary
Watch CS50 Cybersecurity Lecture 0 (Securing Accounts). Write definitions: asset, threat, vulnerability, risk, control.
Day3
Passwords, MFA, passkeys & hashing
Finish Lecture 0 notes + the Week 0 problem set. Turn on MFA/passkeys on your own accounts.
Day4
Securing data: encryption at rest & in transit
CS50 Lecture 1 (Securing Data). Note symmetric vs asymmetric, public/private keys.
Day5
Hashing, salting & digital signatures — hands-on
Use CyberChef to hash a string with MD5/SHA-256, Base64-encode it and AES-encrypt it. Explain why hashing ≠ encryption.
Day6
Securing systems: malware, patching, least privilege
CS50 Lecture 2 (Securing Systems). List 10 malware types with one line each.
Day7
Securing software: injection, XSS (first look)
CS50 Lecture 3 (Securing Software). Note every attack named — you'll lab them on Days 70–76.
Day8
Privacy, tracking & data protection
CS50 Lecture 4 (Preserving Privacy). Summarise cookies, fingerprinting, and what 'PII' means.
Day9
Security+ Domain 1 — General security concepts
Professor Messer SY0-701 Section 1 videos: control types, zero trust, change management, PKI.
Day10
Security+ Domain 2 (part 1) — Threat actors & vectors
Messer Section 2.1–2.3. Make a table: threat actor → motivation → typical vector.
Day11
Security+ Domain 2 (part 2) — Attacks & mitigations
Messer Section 2.4–2.5: social engineering, indicators of malicious activity, mitigations.
Day12
Security+ Domain 3 — Security architecture
Messer Section 3: cloud models, segmentation, resilience, data protection.
Day13
Hands-on: TryHackMe Pre Security — intro modules
Create a free TryHackMe account and complete the opening Pre Security rooms.
Day14
Hands-on: how the web works
Pre Security 'How the Web Works' module — DNS, HTTP, websites.
Day15
Phase review
Re-watch anything fuzzy in the full CS50 course, then write a 1-page cheat sheet + 30 flashcards.
Phase 02 · Days 16–35

Networking Basics

You can't defend or attack what you don't understand — packets, ports, protocols and subnets.

Day16
What a network is: hosts, switches, routers
Practical Networking 'Networking Fundamentals' lessons 1–3.
Day17
OSI & TCP/IP models
PN OSI lesson + Messer N10-009 OSI video. Map one protocol to every layer.
Day18
IP, MAC & ARP — host-to-host communication
PN host-to-host lessons. Draw how ARP resolves a MAC address.
Day19
How packets travel through switches & routers
Finish the PN Module 1 playlist ('packet traveling').
Day20
Subnetting — day 1
Jeremy's IT Lab subnetting videos. Learn CIDR, network/broadcast addresses.
Day21
Subnetting — day 2
Do 20 subnetting problems by hand until you can do one in under a minute.
Day22
TCP vs UDP, the 3-way handshake & ports
Messer N10-009 transport-layer videos. Memorise 20 common ports (22, 53, 80, 443, 445, 3389…).
Day23
DNS deep dive
Messer DNS videos. Learn record types (A, AAAA, MX, TXT, CNAME) and run dig/nslookup.
Day24
DHCP, NAT, HTTP/HTTPS & TLS basics
Messer videos on DHCP, NAT and secure protocols.
Day25
VLANs & routing basics
Jeremy's IT Lab VLAN + static routing videos (do the Packet Tracer labs).
Day26
Firewalls, ACLs, VPNs & proxies
Messer network-security videos. Compare stateful vs stateless firewalls.
Day27
Wireless security: WPA2, WPA3, attacks
Messer wireless-security videos.
Day28
Wireshark — install & first capture
Capture your own browsing traffic. Follow Chris Greer's beginner videos.
Day29
Wireshark — filters & following streams
Practise display filters (ip.addr, tcp.port, http, dns) and 'Follow TCP Stream'.
Day30
Analyse a real malware PCAP
Pick one beginner exercise from Malware-Traffic-Analysis.net and answer its questions.
Day31
Nmap — scanning basics
Watch NetworkChuck's Nmap tutorial. Scan only your own lab or scanme.nmap.org (explicitly allowed).
Day32
Nmap — service detection & NSE scripts
Read the Nmap book chapters on -sV, -O and NSE. Save every command to your notes.
Day33
Hands-on: Pre Security networking modules
Complete the networking modules of TryHackMe Pre Security.
Day34
Cisco NetAcad Networking Basics
Work through the free course's key modules and quizzes.
Day35
Phase review
Draw your home network. Explain, step by step, what happens when you type a URL and press Enter.
Phase 03 · Days 36–55

Linux, Bash & Python

Every security tool lives in a terminal. Get comfortable, then automate.

Day36
Why Linux + set up your Kali/Ubuntu VM
Watch NetworkChuck Linux for Hackers EP1. Install a VM (VirtualBox/UTM).
Day37
Filesystem, navigation & permissions
TCM 'Linux for Ethical Hackers' — first sections.
Day38
Users, groups, sudo, chmod/chown
Continue the TCM Linux course. Explain rwx and 755 vs 644.
Day39
OverTheWire Bandit levels 0–5
Paste any confusing command into explainshell.
Day40
Bandit levels 6–12
find, grep, sort, uniq, base64, tr — write each into your notes.
Day41
Processes, services & logs
Linux Upskill Challenge lessons on processes, systemd and /var/log + journalctl.
Day42
Networking from the terminal
ip, ss, curl, dig, netcat — practise each on your VM.
Day43
Bandit levels 13–20
SSH keys, ports, netcat, SUID — the security-relevant levels.
Day44
Linux Upskill Challenge — server admin
Spin up a tiny server and follow the first lessons of the 21-day challenge.
Day45
Packages, cron & SSH hardening
Disable password auth, set up key-based login, configure a firewall (ufw).
Day46
Bash scripting — part 1
freeCodeCamp Bash Scripting Tutorial: variables, conditionals, loops.
Day47
Bash scripting — part 2 (mini project)
Write a script that counts failed SSH logins per IP from auth.log.
Day48
Bandit levels 21–27
cron jobs, git and scripting levels.
Day49
Python — basics
freeCodeCamp Learn Python: variables, data types, conditionals.
Day50
Python — files, loops & functions
Continue the course; write a script that reads a file line by line.
Day51
Python for security — port scanner
Build a simple socket-based port scanner for your own lab. TCM's free Python course helps.
Day52
Python — log parsing, regex & hashing
Parse a log with regex and compute SHA-256 of files with hashlib.
Day53
Windows fundamentals
TryHackMe Cyber Security 101 — Windows modules (registry, services, Event Viewer).
Day54
Active Directory concepts
Cyber Security 101 AD content: domains, Kerberos, GPOs, users vs computers.
Day55
Phase review
Push your Bash + Python scripts to GitHub with a README — your portfolio starts here.
Phase 04 · Days 56–85

Offensive Security

Learn how attackers think — legally, in labs, with written scope. This is what makes you a better defender too.

Day56
Ethics, scope & the pentest lifecycle
Start TCM's 12-hour Ethical Hacking course: rules of engagement, phases of a pentest. Never test anything you don't own or have written permission for.
Day57
Reconnaissance & OSINT
TCM course recon sections — passive info gathering.
Day58
Scanning & enumeration
TCM scanning sections + Nmap book. Enumerate SMB, HTTP, SSH on a lab box.
Day59
CVEs, CVSS v4.0 & the KEV catalog
Read how CVSS scores work and browse CISA's KEV — what gets exploited in the wild.
Day60
Exploitation basics with Metasploit
Cyber Security 101 offensive modules (Metasploit). freeCodeCamp pentest course as backup.
Day61
Shells: reverse vs bind, stabilising shells
freeCodeCamp network pentest course — shells section.
Day62
CTF practice
picoCTF General Skills + Forensics beginner challenges.
Day63
Linux privilege escalation
SUID, sudo misconfigs, cron. Use GTFOBins for every binary you find.
Day64
Windows privilege escalation
Services, unquoted paths, tokens. Learn LOLBAS binaries.
Day65
Active Directory attacks — part 1
TCM course AD section: LLMNR poisoning, SMB relay.
Day66
Active Directory attacks — part 2
Kerberoasting, pass-the-hash, BloodHound concepts.
Day67
Hack The Box Academy fundamentals
Do one free 'Fundamental' module (e.g., networking or web requests).
Day68
Web basics: HTTP, cookies, sessions + Burp Suite
Set up Burp Community. Start PortSwigger Web Security Academy.
Day69
OWASP Top 10:2025
Read all ten. Note what's new: A03 Software Supply Chain Failures and A10 Mishandling of Exceptional Conditions.
Day70
SQL injection — labs
PortSwigger SQLi apprentice labs.
Day71
SQL injection — UNION & blind
PortSwigger UNION-based and blind SQLi labs.
Day72
Cross-site scripting (XSS)
PortSwigger reflected, stored and DOM XSS labs.
Day73
Broken access control & IDOR (A01:2025)
PortSwigger access-control labs — the #1 risk in OWASP 2025.
Day74
Authentication vulnerabilities
PortSwigger authentication labs: brute force, 2FA logic flaws.
Day75
Server-side request forgery (SSRF)
PortSwigger SSRF labs. Relate it to cloud metadata endpoints.
Day76
Path traversal & file upload
PortSwigger labs for both topics.
Day77
Software supply chain (A03:2025)
Read the OWASP A03 page: dependency confusion, compromised packages, SBOMs.
Day78
API testing
PortSwigger API testing topic + labs.
Day79
Web LLM attacks — prompt injection
PortSwigger Web LLM attacks labs — the newest attack surface.
Day80
Prompt-injection game
Play Lakera Gandalf / Agent Breaker. Map each trick to OWASP LLM01.
Day81
Learn from the pros
Watch one IppSec walkthrough of an easy box. Pause and try each step yourself.
Day82
Your first full box
Root an easy Hack The Box / TryHackMe machine without a walkthrough.
Day83
Second box + John Hammond-style notes
Do another box. Watch a John Hammond video on a technique you got stuck on.
Day84
Pentest report writing
Write a professional report for your box: summary, findings, CVSS, remediation.
Day85
Phase review
Build your offensive cheat sheet using HackTricks + PayloadsAllTheThings.
Phase 05 · Days 86–110

Defensive Security

Most jobs are on the blue side. Detect, investigate, respond — and write it up.

Day86
SOC roles & alert triage
Start TryHackMe SOC Level 1: SOC tiers, triage, false positives.
Day87
Kill Chain, Pyramid of Pain & MITRE ATT&CK
Explore ATT&CK v19 — note the April 2026 split of Defense Evasion into 'Stealth' and 'Defense Impairment'.
Day88
Map an attack to ATT&CK
Take the box you rooted on Day 82 and map every step to an ATT&CK technique ID.
Day89
Log sources: Windows events & Sysmon
SOC L1 log modules. Memorise 4624, 4625, 4688, 4720, 7045.
Day90
SIEM — Intro to Splunk
Splunk's free 'Intro to Splunk' course.
Day91
SIEM — searching & fields
Splunk free 'Using Fields' + search-language practice.
Day92
Investigate with Splunk BOTS
Work through a Boss of the SOC scenario.
Day93
Phishing analysis
LetsDefend free content: email headers, SPF/DKIM/DMARC, URL analysis.
Day94
Phishing practice
Triage simulated phishing alerts on LetsDefend.
Day95
Network forensics lab
One CyberDefenders PCAP lab + one Malware-Traffic-Analysis exercise.
Day96
Endpoint forensics basics
13Cubed videos on Windows artefacts (Prefetch, ShimCache, event logs).
Day97
Memory forensics intro
13Cubed Volatility content + a CyberDefenders memory lab.
Day98
Incident response lifecycle
Read NIST SP 800-61 Rev. 3 (April 2025) — IR now mapped to CSF 2.0.
Day99
NIST CSF 2.0
Learn the six functions: Govern, Identify, Protect, Detect, Respond, Recover.
Day100
Detection engineering — Sigma
Read 10 Sigma rules in SigmaHQ and understand their logsource/detection blocks.
Day101
Write your own Sigma rule
Write a rule for something you did offensively (e.g., suspicious service creation).
Day102
Purple teaming
Run one Atomic Red Team test in your lab, then detect it in your SIEM.
Day103
Threat intelligence
Follow KEV daily for a week; read 3 vendor advisories and summarise TTPs.
Day104
Vulnerability management
Prioritise: CVSS + KEV + asset criticality. Write a patch-priority policy.
Day105
IDS: Snort/Suricata
SOC L1 network-security modules.
Day106
EDR & endpoint hardening
SOC L1 endpoint modules; harden your Windows VM.
Day107
Alert triage sprint
Close 10 alerts on LetsDefend with written notes for each.
Day108
Blue-team lab
Complete one full CyberDefenders lab start to finish.
Day109
Incident report writing
Write an IR report from your lab: timeline, scope, root cause, lessons learned.
Day110
Phase review
Finish remaining SOC L1 rooms; update your GitHub with detections + reports.
Phase 06 · Days 111–120

Cloud, AI Security & Career Launch

Where the 2026 jobs are heading — cloud identity and AI agents — then package yourself for hiring.

Day111
Cloud basics + flAWS levels 1–3
Shared-responsibility model, IAM, S3. Play flaws.cloud.
Day112
flAWS levels 4–6
Metadata endpoints, snapshots, overly permissive policies.
Day113
The Big IAM Challenge
Read and exploit misconfigured AWS IAM policies.
Day114
CloudGoat (your own AWS account only)
Deploy one CloudGoat scenario, exploit it, then destroy it.
Day115
AI security — OWASP LLM Top 10 (2025)
Read all 10: prompt injection, system prompt leakage, excessive agency…
Day116
Agentic AI security
Read OWASP Top 10 for Agentic Applications 2026, then re-read the three incidents at the top of this guide and map them to ASI risks.
Day117
MITRE ATLAS
Explore ATLAS tactics for attacks on AI/ML systems.
Day118
Pick your certification
Security+ V7 (SY0-701) is live; V8 is expected around 17 Nov 2026. Or start the Google Cybersecurity Certificate.
Day119
Portfolio & resume
Polish GitHub (scripts, writeups, Sigma rules, reports), LinkedIn headline, 1-page resume.
Day120
Capstone & next step
Build a home lab (attacker VM + Windows target + SIEM), attack it, detect it, write it up. Then start the 50-day interview guide.
Every link

The full resource library

All 65 resources from the roadmap in one place.

Fundamentals

Networking

Linux & scripting

Offensive security

Defensive security

Cloud, AI & career

Links checked October 2026. TryHackMe, HTB Academy and LetsDefend are free to start, but some advanced content needs a paid plan. Certification exams are paid. ISC2's free Certified in Cybersecurity offer closed to new sign-ups in May 2026, so it isn't included.

Follow for more

Get more free guides like this

I share free AI and tech career guides every week. Follow along and send this to a friend who's serious about breaking into cybersecurity.

Follow @aiwithunnati →