How to learn cybersecurity online without wasting a year
The field rewards demonstrated skill over collected certificates. Here is the order that gets you hired, and the detours that cost people a year.
Start with the boring foundation
Almost everyone who stalls in cybersecurity stalls because they skipped networking and operating systems. You cannot reason about an attack on a system you cannot describe. Before any security-specific course, you want to be comfortable with how TCP/IP works, what DNS does, how HTTP requests are structured, how Linux file permissions and processes behave, and what Active Directory is for.
That is roughly six to ten weeks of part-time study, and it is the single highest-return thing on this list. Skipping it is why people bounce off penetration-testing material and conclude they are not technical enough.
Scripting comes next. Enough Python to parse a log file and automate a repetitive check is sufficient to start; you are not being hired to write software.
Pick defence or offence, then commit
Blue team work, meaning security operations, incident response and detection engineering, is where most of the actual jobs are. It is also the easier door to walk through from a help-desk or sysadmin background.
Red team work, meaning penetration testing and offensive security, is the one people romanticise. It has fewer entry-level roles and expects a stronger foundation before anyone will take you seriously.
You can move between them later. What costs time is bouncing between both for a year and never getting deep enough in either to be employable.
Which certificates carry weight
CompTIA Security+ remains the certificate that clears HR filters for entry-level roles, and it maps cleanly to a few months of structured study. It is not a deep credential, but it is the one job postings name.
The Google Cybersecurity Certificate on Coursera is a reasonable on-ramp for complete beginners and covers the vocabulary well. Treat it as preparation for Security+ rather than a substitute for it.
Beyond entry level, the respected names get expensive and hands-on: OSCP for offensive work, CySA+ or vendor SOC certifications for defensive work, CISSP much later once you have the years of experience it formally requires. Do not start at the top of that list.
Coursera (9.5/10 in our testing) is the strongest option for the structured certificate route, while Udemy (9.2/10) is better value when you need one specific skill rather than a whole programme.
Hands-on practice is the part that gets you hired
Interviewers ask what you have broken and what you have defended. Course completions do not answer that; a home lab does. Build one: a hypervisor, a vulnerable target VM, a Linux box, and a Windows domain controller if you can spare the memory.
Then work through guided practice platforms with real machines rather than multiple-choice quizzes. The habit you are building is reading an unfamiliar system, forming a hypothesis, and testing it.
Keep notes as you go and publish them. A public write-up of how you found and fixed something is worth more in an interview than another certificate, because it shows how you think rather than what you memorised.
A realistic timeline
Two to three months on networking, Linux and basic scripting, part-time. Two more months on foundational security material and Security+ if you want the credential. Three to four months of consistent hands-on practice while you build write-ups.
That puts a career changer studying seriously in the evenings at roughly nine to twelve months from starting to being a credible junior candidate. Anyone promising ninety days is selling something.
If you already work in IT, halve it. The foundation is the expensive part and you already own it.
The detours that waste time
Collecting beginner certificates. After the first one, each additional entry-level credential adds almost nothing. Depth beats breadth here.
Buying courses during sales and never opening them. The bottleneck is study hours, not access to material, and a discounted course you do not finish costs more than a full-price one you do.
Chasing tool proficiency instead of concepts. Learning to click through one particular scanner teaches you that scanner. Understanding what it is testing for transfers to every job you will ever have.
Frequently asked questions
Can I get a cybersecurity job with only online courses?
Do I need a degree?
Which comes first, Security+ or a practical course?
Is Python necessary?
How much should I expect to spend?
See our best online learning rankings
Related reading
LearningGoogle Career Certificates in 2026: A Straight-Talking Guide
Google's Coursera-hosted certificates teach job-ready skills with genuine employer recognition, provided you treat them as a starting line, not a job offer.
LearningHow to Get LinkedIn Learning Free in 2026: Libraries and Employers
Before paying for LinkedIn Learning, check your library card and your employer, because one of them very likely already covers it.
LearningHow to Learn Project Management Online in 2026
Fundamentals, then agile fluency, then a certificate matched to your budget, all cemented by actually running a real project.