Curriculum · 42 levels · contiguous 1–42
One authoritative progression for Learn. Stages follow dependency-aware bands — Foundation → Expert — with no hidden jump past levels 25–27. Pair with Learning paths for career packaging.
Stage labels come from level numbers (not competing topic dumps). IDs and prerequisites are unchanged — only grouping was corrected.
01 · L1–6
Foundation
Computers, networking, OS, scripting, web
02 · L7–8
Core Security
Security principles, cryptography
03 · L9–17
Offense & Defense
Web, system, AD, pentest, SOC, IR, malware
04 · L18–24
Specialization
Cloud, mobile, red/blue, threat intel, DevSecOps
05 · L25–27
Advanced
Advanced exploitation and architecture
06 · L28–42
Expert
API, IAM, Kubernetes, IoT, GRC, AI, enterprise security
Integrity: contiguous numbers, unique ids, known prerequisites
Each lane samples levels from the curriculum + a downloadable interview kit.
Entry–mid analyst roles
Triage alerts, write tickets, talk SIEM — hire-ready in months with labs + kit.
Bounties + AppSec junior
Web vulns, reports, ethical scope — monetise skills legally with programs + interviews.
Junior pentester track
Method + report language employers expect. Pair courses with the pentest interview kit.
Cloud sec / DevSecOps path
IAM, logging, hardening — higher ticket roles after fundamentals.
Every level: unique id, prerequisites, objectives, lessons, assessment, completion criteria. Use the searchable lesson index below — Topics is no longer a separate nav destination.
Levels 1–6
Shared vocabulary and systems literacy — every later level assumes this.
Level 1 · cyber-fundamentals
What cybersecurity is, the CIA triad, threat actors, and how the industry is organized.
Level 2 · computer-fundamentals
Hardware, operating systems, processes, memory, file systems and virtualization.
Level 3 · networking
TCP/IP, OSI, IP addressing, ports, DNS, HTTP and how data moves across networks.
Level 4 · os-fundamentals
Command line, users, permissions, services, logs and the registry on Linux and Windows.
Level 5 · programming
Python, Bash and PowerShell scripting for automation, parsing and tool building.
Level 6 · web-fundamentals
HTML, JavaScript, HTTP, cookies, sessions, APIs and how web apps are built.
Levels 7–8
Controls, AuthN/AuthZ, and crypto — why defenses exist.
Level 7 · security-fundamentals
Authentication, authorization, defense in depth, logging, hardening and security frameworks.
Level 8 · cryptography
Hashing, symmetric and asymmetric encryption, PKI, TLS and common crypto failures.
Levels 9–17
Attack literacy + blue-team response in one continuous band (no Defense fork).
Level 9 · web-security
OWASP Top 10:2025, injection, XSS, access control flaws, SSRF and secure coding.
Level 10 · system-security
OS hardening, privilege escalation concepts, patching, EDR and endpoint security.
Level 11 · active-directory
Domains, Kerberos, NTLM, Group Policy, AD attack paths and AD hardening.
Level 12 · ethical-hacking
Methodology: reconnaissance, scanning, enumeration, exploitation and reporting — legally.
Level 13 · vuln-assessment
Vulnerability scanning, CVSS, prioritization and remediation workflows.
Level 14 · forensics
Evidence acquisition, disk, memory and network forensics, timelines and chain of custody.
Level 15 · incident-response
IR lifecycle: preparation, detection, containment, eradication, recovery and lessons learned.
Level 16 · soc
SIEM, log analysis, detection engineering, alert triage and SOC workflows.
Level 17 · malware-analysis
Static and dynamic analysis, sandboxing, reverse engineering basics and YARA.
Levels 18–24
Pick a lane — still before deep exploitation and architecture.
Level 18 · cloud-security
IAM, shared responsibility, cloud misconfigurations, logging and posture management in AWS, Azure and GCP.
Level 19 · mobile-security
Android and iOS architecture, OWASP MASVS, app analysis and secure storage.
Level 20 · pentesting
Professional, scoped engagements across network, web and AD with high-quality reporting.
Level 21 · red-teaming
Adversary emulation, C2 concepts, OPSEC and objective-based operations.
Level 22 · blue-teaming
Defensive architecture, detection, hunting, hardening and resilience.
Level 23 · threat-intel
Intelligence lifecycle, IOCs vs TTPs, ATT&CK mapping and intel sharing.
Level 24 · devsecops
Threat modeling, SAST, DAST, SCA, secrets scanning and secure CI/CD.
Levels 25–27
Exploit depth, security architecture, professional practice — was mis-hidden under Expert.
Level 25 · advanced-exploitation
Memory corruption, buffer overflows, mitigations (ASLR/DEP), and exploit development in labs.
Level 26 · security-architecture
Zero Trust, secure network design, identity architecture and risk-based design.
Level 27 · professional
Leadership, research, certifications, community and continuous learning.
Levels 28–42
Optional specialist depth — not a second foundation. Requires prior stages.
Level 28 · api-security
REST, GraphQL, OAuth/OIDC, JWT hardening, rate limits, and API gateway patterns.
Level 29 · identity-security
IAM, PAM, federation, SAML/OIDC, MFA, Zero Trust identity, secrets and service accounts.
Level 30 · advanced-devsecops
Deep CI/CD, IaC scanning, SAST/DAST/SCA, SBOM, secrets detection, supply-chain gates.
Level 31 · container-security
Image scanning, K8s RBAC, network policies, runtime detection, admission control.
Level 32 · wireless-security
Wi‑Fi architecture, WPA2/WPA3, wireless auth, Bluetooth/BLE, RFID/NFC basics.
Level 33 · iot-ot-security
IoT/embedded, firmware, ICS/SCADA, OT segmentation, critical infrastructure.
Level 34 · grc-compliance
GRC, ISO 27001/27002, SOC 2, NIST CSF/RMF, CIS, PCI, GDPR, Indian DPDP Act.
Level 35 · threat-modeling
STRIDE, attack surface, secure SDLC, design reviews, control validation.
Level 36 · detection-engineering
Sigma, ATT&CK mapping, hunting, purple team loops, SOAR concepts.
Level 37 · enterprise-security-architecture
Enterprise-scale reference architectures, Zero Trust design, documentation.
Level 38 · ai-security
LLM apps, prompt injection, RAG, vector DBs, OWASP LLM Top 10, AI governance.
Level 39 · agentic-security
AI agents, tool permissions, multi-agent threats, OWASP agentic Top 10.
Level 40 · supply-chain-security
Dependencies, SBOM, signing, provenance, dependency confusion, build pipeline integrity.
Level 41 · purple-team
Adversary emulation, purple exercises, detection improvement loops.
Level 42 · enterprise-security
Enterprise SOC, NDR, email security, asset management, IR at scale.
Searchable titles across all 42 roadmap levels (237 lessons). Detail pages stay at deep links for sharing — this index lives here.
237 lesson titles · part of Roadmap (not a separate Topics destination)