A Realistic Cyber Security Roadmap for Students in Pakistan

Search for a cyber security roadmap and you get an infographic with sixty logos on it. It is accurate and useless, because it tells you everything that exists and nothing about what to do on Monday.

This is an order of operations instead. It assumes you are a student, you have a laptop, and you have perhaps ten hours a week.

Months 1 to 3: the boring foundation nobody skips successfully

Every attack and every defence sits on top of networking and operating systems. People who skip this stage plateau quickly — they can run tools but cannot explain results, and interviews expose that in about four minutes.

• Networking. How a packet gets from your browser to a server and back. TCP versus UDP, what a port is, what DNS does, what NAT does, how HTTP requests are structured. You should be able to read a Wireshark capture and narrate what happened.
• Linux. Not memorised commands — the model. Users and permissions, processes, the filesystem layout, how services start, where logs live. Install it and use it as a daily machine for a month; nothing teaches it faster.
• A little scripting. Enough Python to parse a file, call an API and loop over results.

This stage is unglamorous and it is the one that separates people who are still in the field in three years from people who are not.

Months 4 to 6: pick a side

Offensive and defensive work share foundations but diverge in daily practice. Choosing early means depth instead of a shallow tour.

Offensive suits you if you enjoy puzzles, reading documentation to find the unintended path, and writing up what you found. Learn web application attacks properly — authentication, authorisation, injection, logic flaws — using a deliberately vulnerable application and an intercepting proxy.

Defensive suits you if you prefer pattern recognition, investigation and building things that stay built. Learn log analysis, what Windows event logs record, how a SIEM correlates events, and how to write a detection rule.

You can change later. Most people do. Choosing is still better than not choosing.

Months 7 to 9: build the thing you will be asked about

This is the stage that produces interviews, and it is the stage most people skip.

Build a lab on your own machine. For defence: a Windows virtual machine generating logs, a Linux machine collecting them, an open-source SIEM, and a few detections you wrote yourself after performing the attack they detect. For offence: a vulnerable application stack, and a written report of what you found in it as though a client were paying.

Document it publicly. A short write-up per milestone, in your own words, on any blog or repository. The write-ups are the portfolio. Nobody is checking whether the lab is impressive; they are checking whether you can explain your own work.

Months 10 to 12: prove it to someone else

Three things convert study into employment:

• Capture-the-flag events. Free, time-boxed, and they teach you to work under pressure. Solving one challenge is enough to be worth writing about.
• An internship. Even an unpaid or remote one. The gap between lab work and work with a deadline and a reviewer is the gap employers are nervous about.
• One certification, chosen deliberately. Certifications pass CV filters; they do not substitute for the lab. Take the one your target employers actually list.

What to skip in year one

Expensive certifications before you can explain a packet capture. Buying courses in six directions at once. Collecting tools rather than understanding one. Malware analysis, reverse engineering and exploit development — genuinely interesting, and far more approachable after the foundation rather than instead of it.

The honest part

This field has a wide entrance and a narrow one at the same time. There is enormous demand for people who can investigate an alert properly, and very little for people who have watched a lot of videos. The difference is entirely in whether you built, broke and wrote about something yourself.

A year of ten hours a week, spent in this order, is enough to be genuinely employable. Two months of panic before a deadline is not, regardless of what you paid for it.

Frequently asked questions