Cybersecurity Certification Roadmap 2026: Start for $439

Here's the honest answer: for most beginners, the roadmap is Security+ first, and everything else is either preparation for it or a follow-up to it. The exam costs $439, you can be ready in two to three months, and it's the one cert that entry-level security job postings in the US actually name.

Everything below is the long version: what to do before Security+ if you're starting from zero, what comes after, what the whole trip costs, and where the free study material lives.

The roadmap at a glance

This is the path I'd give a friend starting today, with prices as of CompTIA's June 2026 increase.

Stage	Cert	Cost (US retail)	Time
0. Optional on-ramp	Google Cybersecurity Certificate	About $294 ($49/mo)	3-6 months
0. Optional on-ramp	CompTIA A+ (two exams)	$548 ($274 each)	2-3 months
1. Foundation	CompTIA Network+	$399	1-2 months
2. The anchor	CompTIA Security+	$439	1-3 months
3. First job	SOC analyst / help desk / IT support	Free (you get paid)	6-12 months hunting and working
4. Year 1-2	CySA+ (blue team) or PenTest+ (red team)	$439 each	2-4 months
5. Year 5+	CISSP	$749	3-6 months study

You don't need everything on this table. Read on for what to skip.

Step 0: If you're brand new to IT

Can you explain what an IP address does, set up a home router, and talk through what happens when you type a URL and hit enter? If yes, skip to Security+. If that paragraph made you nervous, start here.

Option A: Google Cybersecurity Certificate (cheapest)

Google's certificate runs $49 a month on Coursera and most people finish in 3 to 6 months, so figure about $294 or less. It covers security fundamentals, Linux, SQL, and some Python, with hands-on labs. It won't impress a hiring manager on its own, but as a structured on-ramp before Security+, it's the best value going.

Option B: CompTIA A+ and Network+ (more thorough)

The traditional route. A+ is two exams at $274 each ($548 total) and covers hardware, operating systems, and troubleshooting — the stuff help desk jobs run on. If you want the full breakdown, our CompTIA A+ certification guide covers it end to end.

Here's my actual opinion, though: most people don't need A+ before Security+. There's no prerequisite, and A+ only earns its $548 if you have zero professional computer experience and need a help desk job as your entry point. Network+ at $399 is the better spend for security specifically, because security is applied networking, and people who skip networking fundamentals hit a wall in Security+ study.

Step 1: Security+ (the anchor cert)

CompTIA Security+ is the default entry security cert for a few concrete reasons. It's vendor-neutral. It's on the US Department of Defense's approved list, which matters for the huge world of government and contractor jobs. And HR filters look for it by name.

The current exam is SY0-701: one exam, 90 minutes, up to 90 questions including performance-based ones. It costs $439 retail as of June 2026 (up from $425), though authorized training partners routinely sell vouchers for about $370 to $395, so never pay full sticker. Our full Security+ guide breaks down the total budget, a week-by-week study plan, and how to handle the coming SY0-801 version change.

How long to study

With some IT background: 4 to 8 weeks at an hour or two a day. Starting from zero: 2 to 3 months, and do Network+ material first even if you skip that exam. The people who fail Security+ are almost always the ones who memorized practice questions instead of understanding ports, protocols, and how attacks actually work.

Step 2: Get a job before you get more certs

This is where most roadmaps lie to you. Stacking five certifications while unemployed is worse than getting one cert and a help desk job. Experience compounds; certificates alone don't.

Realistic first roles: help desk, IT support, junior SOC analyst, or a security-adjacent seat at a managed service provider. SOC analyst is the classic first pure-security job, and yes, the night shift openings are the easiest to land. Take them.

The money is why this grind is worth it. Per the Bureau of Labor Statistics, information security analysts earned a median of $124,910 in May 2024, the lowest 10% earned under $69,660, and employment is projected to grow 29% from 2024 to 2034 — about 16,000 openings a year. Entry-level security roles typically start around $60,000 to $75,000, and even help desk stepping-stone jobs beat most no-degree alternatives. For context on where the ceiling goes, see our list of the highest-paying certifications.

Step 3: After Security+, pick a lane

A year or so into your first job, specialize. Two natural next steps, both $439:

CySA+ (blue team)

Cybersecurity Analyst+ is defense: threat detection, log analysis, incident response. If you're working in a SOC, this is the obvious pick, because it certifies the job you're already doing and it's the smoother path to security analyst and incident responder roles. This is where I'd point most people; defense has far more jobs than offense.

PenTest+ (red team)

Penetration testing and vulnerability assessment. Pick this only if you're genuinely doing hands-on offensive practice on the side, because pentest jobs are fewer, competitive, and increasingly expect practical certs like the OSCP later anyway.

What about CEH and the other shiny certs?

You'll see the Certified Ethical Hacker advertised everywhere, and my honest take is that it's overpriced for what it teaches at this stage — the exam alone runs well over $1,000 once you're through EC-Council's hoops, and hiring managers outside of government checklists rate it below hands-on alternatives. If a job posting specifically requires it, fine. Otherwise, put that money toward lab time and practice exams.

Same logic for jumping straight at OSCP as a beginner: it's a respected cert, but it assumes skills you won't have until you've been working for a while. Sequence matters more than ambition here.

Step 4: CISSP, but not yet

CISSP is the management-track heavyweight, and it's an experience-gated cert: you need 5 years of cumulative paid work in at least 2 of its 8 domains, or 4 years with a qualifying degree or approved cert (Security+ counts as a waiver). The exam costs $749, plus a $135 annual maintenance fee once certified — details on ISC2's requirements page.

You can pass the exam early and become an "Associate of ISC2" while you accumulate the years, but honestly, there's no rush. CISSP pays off when you're aiming at senior and leadership roles, not before. It routinely tops salary surveys, which is exactly why people try to shortcut it and exactly why employers check the experience.

What the whole trip costs from zero

Path	What you pay for	Total exams/courses	Realistic timeline to first job
Lean	Google Cyber cert + Security+	About $733	9-14 months
Standard	Network+ + Security+	$838	6-12 months
Thorough	A+ + Network+ + Security+	$1,386	12-18 months

Add about $50 to $150 for practice exams and a good video course if you want one, and subtract $50 to $70 per exam by buying discounted vouchers from authorized resellers. Either way, you're breaking into a six-figure-median field for about the price of one college credit hour.

Free study resources that are actually good

You can keep training costs near zero. These are the ones worth your time:

• Professor Messer's complete Security+, Network+, and A+ video courses on YouTube, free, and genuinely the most-used study resource in the community
• CompTIA's official exam objectives PDFs, free downloads, and your literal study checklist
• TryHackMe's free tier for hands-on labs, because clicking through real terminals beats rereading notes
• The r/CompTIA and r/cybersecurity communities for exam experience threads and honest job-hunt reality checks

Spend money on exactly two things: exam vouchers and one set of quality practice exams. Everything else has a free version.

Bottom line

If you're brand new: spend 3 to 6 months on the Google Cybersecurity Certificate or Network+ material, then take Security+ for $439, then get any IT or SOC job you can and specialize with CySA+ a year later. Total damage: roughly $700 to $1,400 and 12 to 18 months from zero to employed.

Don't collect certs like trophies, and don't touch CISSP until the experience clock says you're ready. One anchor cert, one real job, then specialize. That's the whole roadmap.