Skills to learn first
Learn IP addressing, DNS, Linux, Windows, and basic scripting. Practise documenting your work. You can learn these skills before taking a certification exam.
What offensive security work involves
Offensive security teams test systems with permission, identify weaknesses, and recommend fixes. Practise in an isolated lab or an authorised training environment. Define the scope and document your findings.
Start with junior penetration testing, then specialise in network or application testing. Red team roles usually require further practical experience.
FOUNDATION
Learn networking and operating systems
Learn networking, Windows and Linux, authentication, HTTP, and basic scripting. Build a small lab and explain normal behaviour before investigating weaknesses.
Practice task: Diagram a lab, record its scope, and explain how identity and network boundaries work.
PRACTITIONER
Complete a basic security assessment
Practise defining the scope, investigating a system, confirming a finding, and recommending a fix. An entry-level practical certification can help you assess these skills.
Practice task: Write a lab assessment with evidence, impact, a fix, and a retest. Keep credentials and personal data out of the report.
ADVANCED
Develop penetration testing skills
Practise with different lab scenarios and write clear reports. Choose a certification based on your target role and budget.
Practice task: Deliver a clear technical report and a short stakeholder debrief from an authorised lab assessment.
SPECIALISE
Choose an advanced topic
Choose an advanced topic based on your target role. The options below are separate specialisations.
Practice task: Choose one area and explain a root cause, a practical remediation, and the evidence that the fix works.
Suggested portfolio project
Take one intentionally vulnerable training application in an isolated lab. Describe the rules of engagement, reproduce one permitted issue, explain its impact, propose a fix, and retest it. Include your method, findings, recommended fix, and test results in the report.
Official certification information
Reviewed on 25 October 2026. The study order and projects are suggestions. Check the provider’s website for required exams, eligibility, fees, and renewal rules. Choose the certifications relevant to your goal.