How long does it take to learn cybersecurity from scratch?

From beginner level to the skills of a job-ready defense analyst usually takes 6 months of consistent work — with 8–10 hours of practice per week. This period is enough to read logs, build a detection rule in a SIEM, and investigate an incident; going deeper continues with work experience.

Is knowing programming required for cybersecurity?

It is not required. The first stages of the defense direction are built on network traffic and system logs, and writing code is not required. At the automation stage, knowing PowerShell and simple scripting makes the work easier, but this is not an entry requirement.

Is learning cybersecurity difficult?

The topics are not difficult, they are voluminous. The hardest part is the transition from a single event to a chain of events — that is, correlation thinking. It forms through lab repetition; it does not form from only watching videos.

What are the fields within cybersecurity?

The main division is between the defense team (Blue Team) and the attack team (Red Team). Adjacent directions: SOC analytics, threat hunting, threat intelligence, incident response, DevSecOps, and Linux/infrastructure security.

Can you learn cybersecurity without knowing English?

Lessons can be conducted in Azerbaijani, but tool interfaces, log messages, and documentation are in English. That is why English at a reading level is a practical requirement; a conversational level, however, is not important.

Which is more suitable for someone starting from scratch — Blue Team or Red Team?

For someone starting from scratch, the defense team is more suitable, because the workflow is structured and the entry path is clearer. The attack team requires prior knowledge of networking, Linux, and Windows, so it is planned for the intermediate level.

What kind of computer do you need to learn cybersecurity?

To run virtual machines comfortably, a laptop with 16 GB of RAM and an SSD is enough. You can also start with 8 GB; it just becomes harder to run two machines at the same time. The operating system does not matter.

Can you get a job in this field without a university degree?

In this field, employers look at practical skill and a result you can show: lab work, the detection rules you have written, investigation reports. A degree is an advantage in some corporate vacancies, but international entry-level certifications such as CompTIA Security+ and a portfolio are also accepted proof.

Kiber təhlükəsizlik · 11 min read

Learning cybersecurity from scratch: a step-by-step plan

Starting from scratch is possible, and writing code is not required. The sequence goes like this: networking fundamentals → operating systems (Linux and Windows) → reading logs → correlation in a security information and event management (SIEM) system → incident response. Tie each stage not to theory but to a lab task. The defense team (Blue Team) direction is a clearer entry path for beginners, because the workflow is structured.

The sequence matters more than the list of topics: someone who does not understand networking cannot read logs.
The first tool is Wireshark, the first environment is a virtual machine. SIEM comes at the third stage.
The most common sticking point is the transition from collecting logs to correlation — this is the difference between a single event and a chain of events.
The defense side is a more structured entry for someone starting from scratch; the attack side requires prior systems and networking knowledge.
To measure what you have learned, run the same attack twice: before the playbook and after.

Is it really possible to learn cybersecurity from scratch?

Yes, it is possible. Most people who come into this field did not study security at university — they come from IT support, network and system administration, and sometimes from an entirely different profession. The reason is simple: defense work is mostly the ability to recognize a system's normal behavior and to spot what deviates from it.

The initial skills you actually need are a short list:

Comfort with a computer: the file system, installation, settings — opening a new window without fear.
Reading in English: tool interfaces, documentation, and log messages are in English. You need to read, not to speak.
Attention and patience: log analysis means staring at the same screen for a long time.
Steady time each week: 1–1.5 hours of consistent work per day is better than 8 hours once a week.

Realistic expectations matter too. In 6 months you can build beginner-level skills at the level of a security operations center (SOC) analyst — reading logs, building a detection rule, investigating an incident. Becoming an expert, however, comes with work experience, not with a course.

A frequent question in our courses

The most common question in our courses is this: "I don't get IT at all, can I still start?" The answer: yes. The training starts from scratch — the first two modules of the defense team program are built on reading network traffic and understanding system logs, and writing code is not required. Programming is needed later, at the automation stage, as a supporting skill.

In what order should you learn cybersecurity?

Finding a list of topics is easy; the hard part is learning them in the right order. The wrong sequence is the most common cause of wasted time: someone who jumps into a SIEM on day one does not understand what they see on screen, because they do not know network and system behavior. The five steps below are built on logical dependency, and each step uses the result of the previous one.

Networking fundamentals. TCP/IP, ports, protocol behaviors, the normal appearance of DNS and HTTP. Checkpoint: you can explain which session in traffic captured in Wireshark is ordinary and which is odd.
Operating systems. Users, permissions, processes, and audit policies in Linux (Red Hat) and Windows. Checkpoint: you find a failed login, the creation of a new user, and a permission change in Event Viewer and Auditd.
Reading logs. Recognizing log sources, building a timeline, reading event IDs. Checkpoint: you reconstruct from the logs when, under which account, and on which machine an event occurred.
SIEM and correlation. Streaming logs into Splunk, ELK, or IBM QRadar, writing queries, building a detection rule, reducing the false positive rate. Checkpoint: you write a rule that combines events from two separate sources.
Incident response and automation. Investigation steps, reporting, playbooks, security orchestration and automated response (SOAR) platforms. Checkpoint: you show that when the same attack is run again, the response executes automatically.

Each step must be tied not to theory but to a lab task. In this field there is a very big difference between "I read it, I understood it" and "I did it, it worked."

What exactly do you learn in the first 6 months?

The table below is based on the module structure of the defense team program and ties each stage to a tool and a skill. With this breakdown you know in advance which tool you will touch in which month.

Cybersecurity from scratch: stages, topics, and tools
Stage	What you learn	Main tools	What you should be able to do
Month 1 — Security and networking fundamentals	Attack and defense models, port and protocol behaviors, traffic analysis	Wireshark, tcpdump, Zeek	Find and explain an anomalous session in traffic
Month 2 — System security	Auditing in Linux and Windows, logging policies, permissions, process monitoring	Red Hat, PowerShell, SELinux, Event Viewer, Auditd	Find a vulnerability, harden system boundaries
Month 3 — SIEM analysis and monitoring	Log collection, correlation, building alerts, dashboard design	Splunk, ELK, IBM QRadar	Write a detection rule and reduce false positives
Month 4 — Endpoint and firewall defense	Endpoint agents, behavioral analysis, firewall policies	CrowdStrike, Cortex, ELK	Track and block a suspicious process on an endpoint
Month 5 — Threat analysis and intelligence	Phishing, malware, and APT analysis, collecting indicators of compromise (IOC) and tactics-techniques-procedures (TTP)	MITRE ATT&CK, MISP, VirusTotal, OpenCTI, Maltego	Name an attack at the technique level, build a threat hunting hypothesis
Month 6 — Incident response and automation	Investigation, playbooks, response scenarios, SOAR	Cortex XSOAR, Splunk SOAR	Take an incident all the way through and automate the response

Note: in the table, SIEM is in third place, not first. This is no coincidence — without the first two months, the third month is spent staring at meaningless lines on the screen.

Which tools should you learn to start with?

Assembling a list of tools is easy; ordering them by role is useful. At the start, going deep into one or two tools is better than getting acquainted with the interface of ten.

Traffic analysis (first of all): start with Wireshark, move to the command line with tcpdump, and leave Zeek for later, to structure network events.
System and audit (second): on the Windows side, Event Viewer and PowerShell; on the Linux side, Red Hat, Auditd, and SELinux. The goal here is to recognize log sources.
SIEM (third): pick one and go deep. Splunk is strong with its query language, ELK is an open ecosystem, IBM QRadar is often found in enterprise environments.
Endpoint (fourth): behavioral analysis and response operations in agents such as CrowdStrike and Cortex. These require prior process knowledge.
Threat intelligence (fifth): the MITRE ATT&CK framework is a common vocabulary of attack techniques; MISP is for sharing indicators, and VirusTotal is for checking files and domains.
Automation (last): Cortex XSOAR and Splunk SOAR. It makes sense to move to these only after you know the manual investigation process.

We single out MITRE ATT&CK because it is not a tool — it is an open database of tactics and techniques observed in real attacks. Tying your detection rules to this framework systematizes your learning.

Defense team (Blue Team) or attack team (Red Team) — which to start with from scratch?

This is the question that people starting from scratch get wrong most often. The attack side looks more attractive on social media, but it is a direction built on existing knowledge: to break a system, you first need to know how it works.

Comparing the defense and attack directions for someone starting from scratch
Criterion	Defense team (Blue Team)	Attack team (Red Team)
Prerequisite knowledge	Can start from scratch	Requires existing knowledge of networking, Linux, and Windows
Workflow	Structured: alert → investigation → response → report	Reconnaissance- and creativity-oriented, the scenario differs every time
Daily work	Log analysis, detection rules, incident response	Penetration testing, vulnerability exploitation, reporting
Learning curve	Rises gradually, each module builds on the previous one	Steep from the start: many topics are needed in parallel
Suitability for starting from scratch	High — the entry path is clearer	More suited to the intermediate level

There are adjacent directions too. Linux administration gives a strong base for moving to the defense side — without systems knowledge, log analysis stays shallow. DevSecOps, meanwhile, builds security into the software development process and makes sense for those already familiar with CI/CD. For someone coming in from scratch, the sequence is: systems → defense → then specialization.

Where do beginners starting from scratch get stuck most often?

Contrary to expectations, not in the first months. Although networking and systems topics look hard, in practice they settle in quickly. The real turning point comes at the third stage, in the SIEM module.

Our students' results

Our teaching observation is this: the hardest transition is from collecting logs to correlation. Streaming logs into Splunk and building a dashboard is easy for students. The difficulty is that you need to see how two ordinary events from two separate sources together mean an attack — for example, failed logins plus the creation of a new user. Separately, these two events are everyday occurrences. Together, however, they are the trace of an account takeover. It takes two or three lessons for a student to grasp the difference between an "event" and a "chain of events."

The typical mistakes that make this transition harder are these:

Only watching videos. Watching creates familiarity, not skill — if the tool was never opened, learning did not happen.
Not building a lab. Someone who does not create an event on their own virtual machine never sees what a log looks like.
Collecting a set of tools. Knowing the names of ten tools is weaker than writing a query in one.
Ignoring false positives. Writing a rule is easy; narrowing it to protect a company from a flood of alerts is the real skill.
Not taking an incident to the end. If the investigation does not end with a report, the work is unfinished.

How do you turn what you have learned into practice, and how do you test yourself?

A home lab is the main learning environment in this field. On an ordinary laptop, two or three virtual machines are enough: one Windows, one Linux, and one system that collects logs. Then you build a repeatable scenario.

Set up two virtual machines — one Windows, one Red Hat. Isolate the network.
Enable audit policies: on Windows, successful and failed logins; on Linux, Auditd rules.
Stream the logs into a SIEM (starting with ELK is free) and verify that the sources are arriving.
Run a simple attack scenario: a series of failed logins, then the creation of a new user.
Write a detection rule that combines the two sources and confirm that the alert fires.
Document the response steps as a playbook: whom you block, which machine you isolate, who gets notified.
Run the same attack again and measure the time — this is your measurable result.

How we do it in our lab

In our lab we do this in the final module like so: a suspicious authentication series appears in the SIEM. The student first tracks the event in Splunk or IBM QRadar, then lines up the response steps with Cortex XSOAR — blocking the account, isolating the endpoint from the network, notifying the responsible person. Once the playbook is ready, the same attack is launched again, and the student sees the response execute automatically: work that took 20 minutes by hand drops to a few seconds. That difference is a concrete result you can put on a résumé.

Learn on your own or at a training center? What is the difference?

Learning on your own is possible, and the volume of free material is sufficient. The difference is not in the material — it is in the sequence, the lab environment, and the feedback. If no one tells you why an incorrectly written detection rule is wrong, the mistake repeats.

The practical difference between the two learning paths
Criterion	On your own	Log Academy Blue Team format
Sequence	You build it yourself, gaps remain between topics	6 modules, a 6-month structure where each builds on the previous
Lab	Your own equipment, limited access to enterprise tools	More than half the program is tasks that simulate a real SOC shift
Feedback	Forum and community answers, delayed	A group of 8–12 people, direct feedback within the lesson
Format and start	Any time	Offline / online; new groups every month
Credential	None	Log Academy certificate + preparation for international certifications

The program's modules, duration, and format are described in detail on the Blue Team program page.

What is the first step to start learning?

Do not spend your first 30 days searching for topics. The plan below is for one month, and at the end you will have a result you can show.

Days 1–7: networking fundamentals. TCP/IP, ports, the normal behavior of DNS and HTTP. 1 hour a day.
Days 8–14: set up a virtual machine. One Linux, one Windows. Configure the network settings yourself.
Days 15–21: your first traffic reading with Wireshark. Capture your own browser traffic, find the DNS queries and TLS connections.
Days 22–27: stream logs into a SIEM. Deploy ELK, send Windows event logs, write your first query.
Days 28–30: build a simple alert that counts failed logins and record the result. This is the first page of your learning journal.

After a month, test yourself: if these steps felt interesting to you, the direction fits. If you want to discuss which direction matches your experience, you can book a free consultation with our program advisor.

How long does it take to learn cybersecurity from scratch?: From beginner level to the skills of a job-ready defense analyst usually takes 6 months of consistent work — with 8–10 hours of practice per week. This period is enough to read logs, build a detection rule in a SIEM, and investigate an incident; going deeper continues with work experience.
Is knowing programming required for cybersecurity?: It is not required. The first stages of the defense direction are built on network traffic and system logs, and writing code is not required. At the automation stage, knowing PowerShell and simple scripting makes the work easier, but this is not an entry requirement.
Is learning cybersecurity difficult?: The topics are not difficult, they are voluminous. The hardest part is the transition from a single event to a chain of events — that is, correlation thinking. It forms through lab repetition; it does not form from only watching videos.
What are the fields within cybersecurity?: The main division is between the defense team (Blue Team) and the attack team (Red Team). Adjacent directions: SOC analytics, threat hunting, threat intelligence, incident response, DevSecOps, and Linux/infrastructure security.
Can you learn cybersecurity without knowing English?: Lessons can be conducted in Azerbaijani, but tool interfaces, log messages, and documentation are in English. That is why English at a reading level is a practical requirement; a conversational level, however, is not important.
Which is more suitable for someone starting from scratch — Blue Team or Red Team?: For someone starting from scratch, the defense team is more suitable, because the workflow is structured and the entry path is clearer. The attack team requires prior knowledge of networking, Linux, and Windows, so it is planned for the intermediate level.
What kind of computer do you need to learn cybersecurity?: To run virtual machines comfortably, a laptop with 16 GB of RAM and an SSD is enough. You can also start with 8 GB; it just becomes harder to run two machines at the same time. The operating system does not matter.
Can you get a job in this field without a university degree?: In this field, employers look at practical skill and a result you can show: lab work, the detection rules you have written, investigation reports. A degree is an advantage in some corporate vacancies, but international entry-level certifications such as CompTIA Security+ and a portfolio are also accepted proof.