Cybersecurity
Cybersecurity is five different jobs sharing one name, and most bad advice about getting into it comes from treating it as a single ladder. This hub organises the field the way its own workforce framework does, by the kind of work rather than by tool or vendor, and points each reader to the door they can walk through first: a developer, an administrator and a manager each start somewhere different.
Outsiders picture security as one person in a dark room breaking into things. When the field describes its own labour, it looks more like a whole organisation: people who set direction and answer for risk, people who design and build systems that hold up under attack, people who run those systems from day to day, people who watch for intruders and throw them out, and a smaller group who investigate once a crime has happened. The US NICE workforce framework formalises exactly that split into five categories of work roles. It is the most useful map a newcomer can borrow, because it describes jobs rather than products. Products change every few years; the division of labour barely moves.
Five kinds of work, thirteen topics
The categories overlap at their edges, and several topics serve more than one. The table places each topic under the category whose practitioners spend most of their week on it, which is our judgement rather than a rule from the framework. Two placements tend to surprise people. NICE files incident response and digital forensics under protection and defence, next to threat analysis, and keeps its separate investigation category for criminal casework and evidence analysis. And security awareness belongs to governance, because deciding what staff must know and showing that they know it is a management duty, however technical the training material looks.
| Topic | NICE category it mostly serves | What the work looks like |
|---|---|---|
| Security fundamentals | All five | The shared vocabulary: confidentiality, integrity, availability, controls, risk |
| Network security | Implementation and operation | Firewall rules, segmentation, remote access, zero trust designs |
| Identity and access management | Implementation and operation | Accounts, sign-in methods, permissions and their removal |
| Cryptography | Design and development | Choosing algorithms, managing keys and certificates |
| Threats and attacks | Protection and defence | Recognising malware, phishing and attacker technique |
| Security operations | Protection and defence | Log collection, detection rules, alert triage, hunting |
| Incident response and forensics | Protection and defence; investigation | Containment, recovery, preserving evidence |
| Vulnerability management | Protection and defence | Scanning, prioritising and patching as a standing programme |
| Penetration testing and ethical hacking | Protection and defence | Authorised attacks that end in a written report |
| Governance, risk and compliance | Governance and oversight | Policy, risk decisions, frameworks, audit |
| Application security | Design and development | Threat models, secure build, testing code for flaws |
| Cloud security | Design and development; implementation and operation | Shared responsibility, cloud identity, posture checks |
| Security awareness | Governance and oversight | What every employee must do, and evidence that they do it |
What the exams certify, and what they cannot
Security has more certifications per job title than any other corner of IT, and they follow the same split. Security+ is the broad entry paper and tests the vocabulary of every row above at the level of recognising a situation and choosing a response. The specialist papers go deep on one row: CySA+ and Microsoft's SC-200 on operations, SC-300 on identity, PenTest+ and the CEH on offensive work. At the top, CISSP, CISM and CISA certify judgement across the whole table and are only awarded once years of documented experience have been checked. What none of them proves is that you can do the work under pressure on a network you have never seen. A multiple-choice pass shows you know which control fits which problem; an employer still wants to watch you configure one, and candidates who treat the pass as the finish line are the ones interviews expose fastest.
Where to begin depends less on ambition than on what you already do for a living. Security rewards adjacent experience more than almost any other field in IT, because most of its work is an existing job performed with an adversary in mind.
- Complete newcomers start with security fundamentals and threats and attacks, then try a free certificate such as Cisco's introduction to cybersecurity or Google's cybersecurity certificate to test their interest cheaply before committing months to Security+.
- Developers go straight to application security, then cryptography and identity. Flaws that reach breach reports sit disproportionately in code and in login flows, and a developer who can run a threat modelling session is rarer than one who knows another framework.
- System and network administrators start in network security and identity, which they are half doing already, and then move towards security operations, where knowing what normal looks like on a server is the scarcest skill in the room.
- Managers and auditors start in governance, risk and compliance. The technical topics still matter to them, at the depth needed to ask the right question of whoever owns the answer, which is precisely what CISM and CISA examine.
What the rest of the site adds
Each topic page links the glossary terms it depends on, and those entries do more than define: each takes a position on where practice usually goes wrong, from least privilege to how much data a SIEM should swallow. The certification pages carry the exam facts this hub leaves out on purpose, such as length, pass mark, prerequisites and retirement dates, each with the date we last checked it. Two neighbouring fields have pillars of their own: hosting and cloud covers the platforms that cloud security defends, and IT certifications explains how vendor credentials fit into a wider career. Security is never practised apart from the systems it protects, and the people who progress fastest in it usually understood those systems first.
The field, part by part
Each topic says why it exists and what it rests on; the order is the order a newcomer would take.
- Security fundamentalsEvery blueprint opens here: the CIA triad, control types and the threat, vulnerability and risk vocabulary (SY0-701 General Security Concepts, 12 %; CISSP domain 1).
- Network securityFirewalls, segmentation, IDS/IPS, VPNs and zero trust are where most defensive work starts (CISSP Communication and Network Security, 13 %; Network+ and CCNA security domains).
- Identity and access managementWho may do what is its own discipline with its own exam (SC-300) and a full CISSP domain (13 %): authentication, MFA, SSO, directories and least privilege.
- CryptographyEncryption, hashing, keys and PKI underlie every other topic; the exams test them as applied choices, not maths (CISSP Security Architecture and Engineering; SY0-701 domain 1).
- Threats and attacksThe second-largest Security+ domain (Threats, Vulnerabilities and Mitigations, 22 %; only Security Operations weighs more): malware, phishing, social engineering, ransomware and the attack techniques defenders must recognise.
- Security operationsMonitoring, detection and the SOC are the largest Security+ domain (28 %) and the whole of SC-200 and CySA+: SIEM, logging, alert triage, threat hunting.Includes Incident response, Vulnerabilities
- Penetration testing and ethical hackingAuthorised attack as a profession: scoping, reconnaissance, exploitation, reporting (PTES; PenTest+ and CEH). Also the most-searched security topic on the course side.
- Governance, risk and compliancePolicies, risk assessment, frameworks (NIST CSF, ISO 27001) and audit are the management half of the field: CISSP domain 1 (16 %), CISM, CISA, Security+ Program Management (20 %).
- Application securityA large share of breaches begins in software: secure design, secure build, security testing and the OWASP Top 10 (OWASP SAMM; CISSP Software Development Security, 10 %).
- Cloud securityShared responsibility, cloud identity and posture management are tested in every cloud exam (SAA-C03 Design Secure Architectures, 30 %) and in SC-900; the cloud silo owns the platforms, this topic owns the defence.
- Security awareness for everyoneMost incidents start with a person, not a port: what every employee and freelancer must know about phishing, passwords, MFA, backups and updates (NICE Oversight and Governance; the management side of every blueprint).
Concepts to know
Glossary entries of this field.
- Authentication
Authentication is the process of confirming that a user, device or service is who it claims to be, typically by checking something it knows, has or is.
- Encryption
Encryption transforms readable data into ciphertext with a key so that only someone holding the right key can turn it back, protecting the data while it is stored or in transit.
- Firewall
A firewall is a control that allows or blocks network traffic according to rules about its source, destination, protocol and, in modern forms, its content and the application it belongs to.
- Hashing
A hash function turns input of any size into a fixed-size fingerprint in a way that cannot be reversed, so that the fingerprint can verify data or store a password without holding the original.
- IAM
Identity and access management is the set of policies and systems that create, verify, govern and retire identities and decide what each one may reach.
- Incident Response
Incident response is the prepared, practised process by which an organisation detects a security incident, contains it, removes the cause, recovers, and learns from what happened.
- IDS/IPS
An intrusion detection system watches network traffic or host activity for signs of attack and raises alerts, while an intrusion prevention system sits inline and can block what it recognises.
- Least Privilege
Least privilege is the principle that every user, process and system should hold only the access required for its current task, and no more.
- MFA
Multi-factor authentication requires proof from at least two different kinds of factor, such as a password and a device-generated code, so that stealing one is not enough to log in.
- Penetration Testing
A penetration test is an authorised, scoped attempt by a skilled tester to exploit weaknesses in a system the way an attacker would, ending in a report the owner can act on.
- Phishing
Phishing is an attack that deceives a person into revealing credentials, approving a payment or running malicious content, usually through a message that impersonates someone they trust.
- PKI
A public key infrastructure is the system of certificates, certificate authorities and revocation mechanisms that lets a party verify which identity a public key belongs to before trusting it.
- Ransomware
Ransomware is an attack in which criminals gain access to an organisation's systems, encrypt or steal its data, and demand payment to restore access or withhold publication.
- SOC
A security operations centre is the team, tooling and process that monitors an organisation's systems for security events around the clock, triages alerts, and starts the response to those that are real.
- Security Risk Assessment
A security risk assessment identifies the threats to an organisation's assets, estimates how likely each is and how much harm it would do, and ranks them so that limited effort goes where it reduces the most harm.
- SIEM
A SIEM collects logs and events from across an organisation's systems into one searchable store, correlates them into alerts, and retains them for investigation and compliance.
- Threat Modelling
Threat modelling is the structured practice of asking what could go wrong with a system, who would make it go wrong and how, while the design can still be changed cheaply.
- VPN
A virtual private network carries traffic through an encrypted tunnel over a public network so that a remote device or site behaves as though it were connected to a private one.
- Vulnerability Management
Vulnerability management is the continuous process of finding weaknesses in systems, deciding which ones matter in context, fixing or mitigating them, and confirming the fix.
- Zero Trust
Zero trust is a security model in which no request is trusted because of where it comes from, so every access to a resource is authenticated, authorised and checked against policy each time.
Certifications that test it
Vendor exams and free certificates; facts, cost and the preparation path are on each page, and the certifications hub has them all.
- EC-Council · 312-50Certified Ethical Hacker (CEH)
- ISACA · CISMCertified Information Security Manager (CISM)
- ISACA · CISACertified Information Systems Auditor (CISA)
- ISC2 · CISSPCertified Information Systems Security Professional (CISSP)
- CompTIA · CS0-004CompTIA CySA+
- CompTIA · PT0-003CompTIA PenTest+
- CompTIA · SY0-701CompTIA Security+
- Google · Course completionGoogle Cybersecurity Professional Certificate
- Microsoft · SC-300Microsoft Certified: Identity and Access Administrator Associate
- Microsoft · SC-200Microsoft Certified: Security Operations Analyst Associate
- Microsoft · SC-900Microsoft Certified: Security, Compliance, and Identity Fundamentals
- IBM · Online exam, not proctored · freeCybersecurity Fundamentals
- Cisco · Online exam, not proctored · freeIntroduction to Cybersecurity
- Microsoft · Lab-based assessment · freeMicrosoft Applied Skills: Defend against cyberthreats with Microsoft Defender XDR
- Fortinet · Online exam, not proctored · freeNSE 1 in Cybersecurity
Neighbouring fields
- Programming and Software Development
Application security is the security field's topic and the developer's daily responsibility.
- IT Support, Networking and Infrastructure
Network security, identity and the service desk's incident handling are where IT operations and the security field overlap; the security hub owns the defence, this hub the plumbing.
- Cloud Computing
In the cloud, identity is the perimeter: this hub owns the platforms and their architecture, the cybersecurity field's cloud-security topic owns the defence.
Frequently asked
- Do I need a degree to work in cybersecurity?
- No. Many analysts and testers come from help desks, system administration or development without one. A degree helps with large employers, graduate schemes and some public-sector roles, and it can shorten the experience requirement for CISSP by a year. For most entry roles, evidence of hands-on work and a first certificate carry more weight.
- Is Security+ enough to get a first security job?
- It gets a CV past many screening filters, and seldom wins the interview by itself. Pair it with something an interviewer can inspect: a home lab you can talk through, a write-up of a practice incident, or a year in an IT role where you already handled accounts, patching or firewalls.
- Should I learn networking before security?
- Enough to explain how a request travels from a laptop to a server and back: addressing, ports, name resolution, what a firewall sees. You do not need a networking certificate first, but almost every security topic assumes that picture, and learning it later costs more than learning it now.
- Is penetration testing a good way into the field?
- It is a good destination and a hard entrance. Testing assumes you understand how systems are normally built and run, so most testers arrive after a few years in administration, development or a SOC. If offensive work is the goal, start in one of those and keep practising in legal labs on the side.
- How much programming does a security role need?
- It varies by category. Governance roles need almost none, operations roles need scripting and a query language, and application security needs real development experience. Across the field, being able to read code and automate a repetitive task in Python or PowerShell separates candidates more than any single tool certificate.
Courses in the directory
1,353 courses are filed here; the top 6 by our ranking, details and the provider link on each course page.
Last reviewed 26 September 2026 · Getting Digital