The path at a glance
Yes, you can break into cybersecurity for free. It's one of the rare tech fields where hands-on practice matters more than a degree, and the best practice platforms (TryHackMe, plus free courses from Harvard and Microsoft) cost nothing to start. Begin with networking and Linux basics, learn how attackers think, then practise in real lab environments before earning an entry-level certification like Microsoft's SC-900. Information security analyst roles are growing far faster than average and pay well above the national median. A committed beginner can reach an entry-level, certification-ready point in 6 to 12 months of part-time study.
Information security analyst jobs are projected to grow 33% from 2023 to 2033, one of the fastest rates of any occupation, with a median annual wage of $120,360 (source: U.S. Bureau of Labor Statistics, https://www.bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm).
Follow in order
Start with TryHackMe's Pre-Security path. It covers networking, the web, and Linux from scratch, designed specifically for people with no prior security knowledge.
Pre-Security Path
50h · Free
Harvard's free cybersecurity course covers how attackers think, common vulnerabilities, and defensive principles. The lecture quality is unmatched and it comes with a free certificate.
CS50's Introduction to Cybersecurity
30h · Free
TryHackMe's Cyber Security 101 is the most beginner-friendly way to practice in real lab environments. You'll exploit systems, escalate privileges, and defend networks, all in a browser.
Cyber Security 101
60h · Free
Microsoft's SC-900 is a free certification-prep course covering security, compliance, and identity in cloud environments. It's a recognised entry-level credential and a strong résumé signal.
Microsoft Security, Compliance, and Identity Fundamentals (SC-900)
6h · Free
Security work leans hard on scripting: parsing logs, scanning networks, and building small tools. Harvard's CS50P teaches Python from scratch, the language most security engineers reach for when they need to automate a task or write a quick script.
CS50's Introduction to Programming with Python
36h · Free
Beyond the path
CybersecurityBeginner
Harvard's introduction to cybersecurity for technical and non-technical audiences. Covers threats, authentication, networking, system security, and operational security. Free to audit; certificate available via edX.
CybersecurityBeginner
TryHackMe's free Pre-Security learning path. Covers cybersecurity careers, basic networking, web fundamentals, Linux, and Windows. Designed for total beginners with no IT background.
CybersecurityBeginner
TryHackMe's flagship beginner path covering the breadth of cybersecurity: networking, web exploitation, cryptography, defensive security, and incident response. Mostly free with hands-on rooms.
CybersecurityBeginner
Microsoft Learn's path for the SC-900 certification. Covers security, compliance, and identity concepts, Microsoft Entra (Azure AD), and Microsoft security solutions. Free with an aligned cert.
CybersecurityIntermediate
freeCodeCamp's Information Security course teaches you how to build and defend secure web applications through five hands-on projects. You'll learn to implement authentication, encrypt sensitive data, scan for vulnerabilities like SQL injection and XSS, and apply secure coding practices with libraries like HelmetJS. After completing it, you can write production code that resists common attacks. It's ideal for developers who already know basic Python and JavaScript and want to add security skills to their toolkit. The limitation: it is project-heavy and time-consuming, not a quick overview.
CybersecurityIntermediate
Professor Messer's free CompTIA Security+ (SY0-701) course consists of 121 videos totaling roughly 15 hours, covering every exam objective: threats, identity and access, cryptography, network defense, and incident response. If you're planning to take the Security+ certification exam, this is the de facto industry-standard free study resource used by thousands. It's designed for IT professionals or students with networking knowledge already (Network+ level) pursuing the Security+ credential. The limitation: it is exam-prep-shaped and focuses on passing the test rather than building hands-on labs. The exam itself costs money.
FAQ
Other goals