This is general advice for students getting into cybersecurity. I’ve tried to compile my advice based on questions that I have been asked, or think is important to make others aware about.
Mindset
Learn how to learn. This is the real skill. Classes, books, videos, streamers, documentation, and online communities are all just delivery mechanisms. The people who do well in this field are the ones who can pick an unfamiliar topic and steadily get to the bottom of it. Figure out how you learn best and lean into it.
Also, finding joy in the process of learning makes it easier for me. It’s slow and tedious, but over the years the amassed knowledge sneaks up on you and surprises you.
For me, I find that extensive note taking and actively building projects best suites my style of learning. Note taking helps preserve the things I’ve experienced, allowing me to go back and study them again.
Failure is part of the process. I fail at something almost every day. Each failure teaches you where your understanding was thin, builds experience, and makes the next attempt better. Do not let a bad grade, a lost competition, or a rejected application stop you.
Question your first answer. When you’re working through a problem, ask yourself what else you could be asking. Am I missing context? Are there other solutions I haven’t thought about? Be confident in yourself, but don’t be overly confident with your first solution. (You get better over time!)
What to learn
These do not have to happen in order. Do whatever gets you started. Security is barely an entry-level field anymore: the openings that exist are getting rarer. It’s still possible, but either way the fundamentals set you up strong for any career in technology.
Networking. Learn the OSI model, how a packet actually gets from one machine to another, and how to read one in Wireshark. Learn how the common protocols work: IP, TCP and UDP, and then HTTP/HTTPS, DNS, DHCP, SSH, and TLS. Learn subnetting, IP and MAC addresses, and what routers, switches, firewalls, and load balancers each do.
Operating systems. Understand what an OS is made of: the kernel, processes, memory, the file system, drivers, and access control. Learn the differences between Linux, Windows, and macOS and why you would pick one over another. Learn how each is hardened: patching, least privilege, strong authentication and MFA, disk encryption, disabling exposed services, and backups. Live in the command line as much as you can and learn to script it with Bash and PowerShell.
Programming. Start early. Python is the most useful first language for security work; Bash, PowerShell, JavaScript, and Go are all worth knowing later. A good first project is a small web app with an HTML/CSS/JavaScript front end and a Python back end that pulls data from a public API. You’ll set yourself up for many more opportunities if you learn to code.
Security fundamentals. Learn the common attack types (malware, phishing and social engineering, network attacks, web attacks like SQL injection and XSS). Learn the core principles: least privilege and defense in depth. Learn the basics of cryptography (encryption, hashing, digital signatures and certificates), identity and access management, risk management, and incident response. Then pick a direction that interests you and go deeper.
Artificial intelligence. Learn about the different models and capabilities that exist. Learn about the drawbacks of LLMs, how they fail and how to notice their failures. Research the different types of attacks against LLMs. Build and use your own LLM harness. Learn how to prompt and create skills. To actually learn, you have to embrace the grind and not let AI do everything for you. But you should absolutely use AI as a learning tool: have it walk you through documentation, codebases, and your own understanding. Over time you’ll see its weaknesses. Always assume it’s wrong and test its assumptions.
Learn by building
Courses and books teach you concepts. Building something teaches you how the concepts actually behave, and gives you something concrete to talk about in an interview.
A homelab is the classic choice. It can be one old computer with a hypervisor on it. I recommend running virtual machines with different operating systems, then running real services on them: a website, centralized logging from your other devices, a media server, a game server, or deliberately vulnerable VMs to practice offensive operations against. Put your device behind a firewall you configure yourself, set up VLANs, and try collecting logs. You will learn operating systems, networking, system administration, security, and automation all at once.
Keep the work in small pieces, follow tutorials and documentation, and let the project sit unfinished whenever it needs to. Doing anything is better than doing nothing.
Networking and opportunities
Soft skills matter as much as technical skills. People want to work with people who are easy to work with: who listen, ask good questions, share what they know, and stay calm when things go wrong. Start practicing this now.
Find people to learn from. If you can find a mentor, do it. If you cannot, find role models online and follow their work. Do not be afraid to reach out to people, including people well above you. The worst case is that they do not reply.
Prioritize experience over money early, but know your worth. In your first few years, what you learn compounds. If one option pays more but another will teach you more and grow your career faster, the learning is usually the better bet. That changes later; it is good advice for the start.
Certifications
Any opportunity that pushes you to learn is worth taking, regardless of its direct career value. A certification, in my opinion, is useful mostly as a structure that makes you study a topic thoroughly. Some employers still care about specific certs; check the job descriptions for the roles you want. Worst case, you learn something.
What matters to employers is the knowledge you’ve built and how you use it to deliver on your job.
University
I do not have a single answer. I went, and the extracurricular security club that took me to competitions and CTFs was the most valuable part, more than the classes. University is one path to the network of professionals, the projects, and the first internship, but it is not the only one. Talk to people on both sides of that choice before you make it.