How to become an ethical hacker: A 2026 roadmap

Update note: Originally published in August 2024, this article has been updated and expanded by additional contributors to reflect current ethical hacking practices, certifications, technologies and career paths.

Ethical hackers use the same curiosity and technical thinking as attackers, but they work with permission to find weaknesses, explain the risk and help organizations fix problems before those weaknesses are abused. If you are considering a career in cybersecurity and asking, “How do I become a hacker?” this guide gives you a safe, realistic path from beginner skills to your first relevant role.

You don’t need to master every programming language or earn every certification before you begin. The strongest path is to learn the foundations, practice in authorized environments, document what you can do and add specialized skills as your interests become clearer.

Editor's note: AI tools have altered the process of hacking forever. We made a FREE course and lab environment to help. Get it for free here: Learn how to hack and use AI.

View Free Course

Your seven-step ethical hacking roadmap for 2026

This roadmap will guide you to a career in ethical hacking. Each stage builds the skills and knowledge to get ready for the next one.

Step	Milestone	What to learn or do	Proof of progress
1	Learn the foundations	Networking, Linux, Windows, scripting, web technology and security basics.	Complete a networking or operating-system lab.
2	Build a safe practice environment	Use legal labs, virtual machines, cyber ranges, CTFs and intentionally vulnerable systems.	Document your lab scope and reset process.
3	Learn the pentesting workflow	Practice scoping, reconnaissance, enumeration, validation, controlled exploitation, reporting and retesting.	Write a sample penetration test report.
4	Add cloud and AI skills	Learn cloud identity, containers, APIs, AI-assisted testing and the security risks unique to AI-enabled systems.	Secure a cloud lab or evaluate an AI application.
5	Choose a specialization	Explore web, network, cloud, mobile, application security, AI red teaming or adversary simulation.	Finish a focused project in your chosen track.
6	Validate your skills	Use certifications, GitHub projects, lab reports and coordinated vulnerability disclosures cleared for public sharing to show your capabilities.	Publish a sanitized portfolio artifact.
7	Gain experience	Look for internships, adjacent IT roles, junior security jobs, open-source work and authorized bug bounty programs.	Tailor your resume to a specific target role.

What ethical hackers actually do

An ethical hacker identifies and tests a system’s vulnerabilities with permission. The work involves more than getting into a system. Ethical hackers start with written scope and rules, limit testing to approved targets and end with evidence, risk explanations and practical remediation guidance.

Understanding the following roles and responsibilities will help you to determine your ideal path:

• Ethical hacker: A general term for someone who uses offensive-security techniques with permission.
• Penetration tester: A professional who performs a scoped assessment to validate exploitable weaknesses and document the results.
• Red teamer: A practitioner who simulates a realistic adversary to test prevention, detection and response across people, processes and technology.
• Vulnerability or security researcher: A specialist who investigates weaknesses in products, protocols or systems and follows responsible disclosure practices.

Is learning to hack legal?

Yes, under certain circumstances. Hacking is generally legal if you practice on your own systems, on training platforms designed to help you build hacking skills or systems for which you have explicit authorization. But it's crucial that you understand the scope of what's allowed by each platform or service, as well as any applicable laws. Never scan, test or exploit a live system without permission.

1. Learn the foundations

Begin with the technologies you will assess later. You don’t need expert-level depth in every topic, but you should understand how a normal system works before trying to identify how it can fail.

Networking

Learn how systems communicate and how security controls affect that communication.

• TCP/IP and common ports
• DNS, HTTP and HTTPS
• Routing, switching, firewalls and VPNs
• Packet capture and basic traffic analysis

Operating systems

Most assessments involve Linux, Windows or both.

• Linux command line, processes, services and permissions
• Windows administration and PowerShell
• Active Directory fundamentals
• Virtual machines, containers and basic system hardening

Programming and scripting

Use code to automate repetitive tasks, understand application behavior and read what tools are doing.

• Python for automation, APIs and lightweight tooling
• JavaScript for browser and web application behavior
• SQL for database interaction and injection concepts
• Bash and PowerShell for operating-system automation
• Go, C or C++ later if you pursue tooling, reverse engineering or exploit development

Web and application fundamentals

Modern offensive security work frequently touches applications and APIs.

• Requests and responses, headers, cookies and sessions
• Authentication, authorization and access control
• APIs and common data formats
• Databases, deployment architecture and the software development lifecycle

Security fundamentals

Build enough defensive context to understand the impact and recommend fixes.

• Identity and access management
• Cryptography basics
• Vulnerability management and threat modeling
• Logging, monitoring and incident response
• Clear technical and executive reporting

Beginners don’t need to master every language before starting labs. Learn enough to understand and safely modify simple scripts, then deepen your coding skills as your projects require.

2. Build a safe practice environment

There isn’t a single correct route into ethical hacking, but rather, multiple methods to entry. Before you start practicing, consider the pathway that best suits your needs.

A degree, certifications, self-study or a combined approach can all lead to a successful career in the field. This will allow you to gain the structure to close knowledge gaps and the practice to build demonstrable skills.

Path	Best for	Advantages	Drawbacks
Degree	Learners seeking broad structure, internships or traditional recruiting access	Strong theoretical base, instructors and peer network	Extended timeline and significant cost
Certification	Career changers and working professionals	Defined objectives and recognizable milestones	Exam pass does not guarantee hands-on ability
Self-study	Disciplined learners with limited budgets or specific goals	Flexible and customizable	Risk of missing important fundamentals
Combined	Most ethical hacking career seekers	Combines structure, practice and guidance	Requires deliberate planning

Useful resources include official documentation, structured learning platforms, hands-on cyber ranges, Capture the Flag events, open-source projects and professional communities. Use community advice as a starting point, then verify technical claims against trusted documentation and practice only in authorized environments.

Building your practice environment

Hands-on work turns theory into ability. Start with authorized environments that can be isolated, reset and legally tested. You should have:

• A computer capable of running virtual machines or access to a hosted cyber range
• A hypervisor or approved cloud sandbox
• A Linux security-testing environment
• An intentionally vulnerable target
• An isolated network and clear reset process
• A note-taking system for commands, evidence and lessons learned
• Written rules defining exactly what you are authorized to test

Beginner practice

Command-line navigation, networking, simple web vulnerabilities and guided labs.

Intermediate practice

Enumeration, privilege escalation, APIs, Windows or Active Directory and complete report writing.

Advanced practice

Multi-system environments, cloud attack paths, adversary simulation and specialized research.

As you practice, avoid measuring progress only by flags captured or systems accessed. A job-ready beginner should be able to explain what happened, preserve evidence, describe the business risk and recommend a realistic fix.

3. Learn the pentesting workflow

Tools change quickly, but the assessment process remains largely the same. Practice the pentesting workflow so that your work remains controlled, repeatable and useful to the organization being tested.

1. Authorization and rules of engagement: Confirm written permission, communication channels, prohibited actions and emergency contacts.
2. Scoping: Define targets, dates, testing depth, assumptions and success criteria.
3. Reconnaissance: Collect approved information about the environment and its exposed services.
4. Enumeration and attack-surface mapping: Identify users, services, applications, trust relationships and potential weaknesses.
5. Vulnerability validation: Distinguish real, relevant findings from scanner noise.
6. Controlled exploitation: Demonstrate impact without causing unnecessary harm or moving beyond scope.
7. Privilege escalation and lateral movement: Perform only when authorized and needed to answer the assessment objectives.
8. Evidence collection: Record commands, timestamps, screenshots and affected assets.
9. Risk prioritization and reporting: Explain likelihood, impact, root cause and remediation in language the audience can act upon.
10. Retesting: Confirm that the reported finding is remediated and document any remaining risk.

4. Add cloud and AI skills

Modern ethical hackers increasingly assess cloud services and AI-enabled applications. Add these skills after you can work confidently through the core pentesting workflow.

Build foundations in:

• Cloud identity and access management
• Storage permissions and data protection
• Secrets and key management
• Network segmentation and private connectivity
• Logging, monitoring and incident response
• Containers and Kubernetes
• Infrastructure as code and CI/CD security
• Serverless functions and software supply chains

Common cloud assessment themes include excessive permissions, exposed storage, leaked credentials, unsafe trust relationships, metadata service risks, container misconfiguration and attack paths that combine several individually low-risk weaknesses.

Use AI-assisted pentesting responsibly

Artificial intelligence has become a practical assistant across the security testing lifecycle. It can reduce repetitive work and help practitioners navigate unfamiliar material, but it does not replace authorization, technical understanding or manual verification.

Use only organization-approved AI tools and permitted or sanitized data. Treat generated findings, commands and code as untrusted until a qualified practitioner reviews and tests them in an authorized environment.

Appropriate uses of AI include:

• Summarizing documentation, logs and large evidence sets
• Drafting assessment checklists and test cases
• Assisting with code review and explaining unfamiliar scripts
• Generating lab-only examples for review
• Organizing findings and drafting remediation language
• Automating repetitive analysis under human supervision

However, using AI responsibly requires understanding its limits. Key limitations and risks include:

• Hallucinated vulnerabilities or incorrect technical explanations
• Unsafe or unreliable generated commands and code
• Confidential-data leakage into unapproved third-party models
• Prompt injection or malicious instructions hidden in tool output
• Incorrect severity ratings and unsupported assumptions
• Autonomous actions that exceed scope
• Poor auditability when prompts, outputs and decisions are not recorded

5. Choose a specialization

By starting with a broad exploration, you can then develop depth in a track that matches your interests and the work you want to do.

Track	Starting point	Next steps	Proof of skill
Web and API pentesting	HTTP, JavaScript, SQL and authentication	API testing and secure code review	A web assessment with a polished report
Network and infrastructure	Networking, Linux and Windows	Active Directory and lateral movement	An internal network lab report
Cloud security	IAM, networking and one cloud platform	Containers, infrastructure as code and attack paths	A hardened cloud project
Mobile security	Application architecture and APIs	Android or iOS testing	A mobile application assessment
Malware and reverse engineering	Operating systems and programming	Assembly, debugging and behavioral analysis	A malware-analysis write-up
Red teaming	Pentesting and Active Directory	Adversary simulation, operational security and detection testing	A multi-stage lab report
AI red teaming	Web, API, cloud and threat modeling	Model behavior, agent security and evaluation design	An AI-system security evaluation

AI red teaming and AI-system security

AI red teaming is structured adversarial testing designed to uncover security vulnerabilities, harmful or unintended behaviors and misuse risks in AI systems. For applications that use models, retrieval systems, tools or agents, testing may include prompt injection, indirect prompt injection, sensitive-data leakage, excessive agency, unsafe tool use, access-control weaknesses, retrieval-augmented generation risks, model supply-chain risks and misuse testing.

This work requires a blend of application security, API security, cloud identity, machine-learning concepts, data governance and evaluation design. It is not an entry-level shortcut. Build web, API, cloud and identity fundamentals first, then add AI-specific testing methods.

6. Validate your skills

Certifications can validate knowledge, provide structure and help your resume pass an initial screen. They are most valuable when paired with a portfolio that demonstrates hands-on ability, sound judgment and clear reporting. Do not assume that every ethical hacker follows one fixed credential ladder.

Foundation stage

• CompTIA Security+ or an equivalent security foundation
• Networking or operating-system credentials
• Beginner cloud fundamentals

Beginner-to-intermediate offensive stage

• CompTIA PenTest+
• Certified Ethical Hacker (CEH), particularly when an employer or contract requests it
• A reputable, practical credential aligned to your target role

Advanced hands-on stage

• OffSec Certified Professional (OSCP/OSCP+)
• Specialized web, exploit-development, red-team or cloud credentials after relevant practice

Cloud-security stage

• AWS Certified Security - Specialty for experienced AWS security practitioners
• Current Microsoft security credentials aligned to your role; verify retirement and replacement dates before enrolling
• A current Google Cloud security credential

AI-security stage

• Combine application or offensive-security validation with cloud-security knowledge
• Complete AI-system security training and build a portfolio of documented evaluations

Build a portfolio that proves what you can do

A portfolio gives employers evidence of your capabilities beyond exam scores.

Note: Remove sensitive information before publishing and always follow platform rules.

A strong beginner portfolio might include:

• One web application assessment
• One internal-network or Active Directory lab
• One cloud-security project
• One small automation script
• One polished report with an executive summary and technical detail
• A short statement describing your legal and ethical testing practices

For each project, explain the scope, your approach, the evidence, the business impact, the remediation and what you would improve next time. A professional finding should contain enough detail to reproduce and fix the issue without exposing a live target.

7. Gain experience

Your first role doesn’t need to fall under the penetration tester title. As you work in the field, build relevant experience through adjacent technical or security roles, and develop a professional network that helps you learn, find mentors and discover opportunities. The following roles can lead to a pentester title further down the line:

• Cybersecurity or IT internship
• Junior security analyst or SOC analyst
• IT support, systems administration or network technician
• Application support or junior developer role
• Vulnerability-management role
• Cloud operations or cloud-security role
• Junior penetration tester or apprenticeship
• Open-source security contribution or authorized bug bounty work

When applying, tailor your resume to the role. Quantify projects where possible, name the technologies you used and link to sanitized evidence. Prepare to explain not only how you found a weakness, but also how you protected the environment and helped remediate it.

Build a professional network

A professional network helps you learn faster, find mentors and discover opportunities that may not appear in a public job listing.

• Find mentors: Local security groups, professional associations, alumni networks and structured communities.
• Learn in public: Sanitized write-ups, open-source contributions, talks and thoughtful technical discussions.
• Meet employers: Conferences, chapter events, career fairs and community volunteering.
• Stay current: Standards bodies, practitioner research, official vendor documentation and trusted newsletters.

Protect your reputation and other people’s systems. Never post client information, lab credentials, uncoordinated vulnerability details or evidence from a live environment without authorization.

Take the first step toward ethical hacking

You now have a seven-step roadmap: learn the foundations, build a safe practice environment, learn the pentesting workflow, add cloud and AI skills, choose a specialization, validate your skills and gain experience. The next step is to turn the roadmap into action.

Ready to start building your ethical hacking skills? Watch our free ethical hacking workshop to follow a guided attack, analyze the evidence and see how AI can support defensive investigation.

Frequently asked questions

Do I need a degree to become an ethical hacker?

No. A degree can provide structure, internships and access to some recruiting pipelines, but many employers also hire candidates who demonstrate relevant skills through experience, certifications and a strong portfolio.

Can I become an ethical hacker without coding?

You can begin learning security before you are an advanced programmer. However, scripting and code-reading become increasingly important for automation, web testing, tool validation and understanding application behavior.

Which programming language should I learn first?

Python is a practical first choice for automation and tool building. Add JavaScript and SQL for web application work, and Bash or PowerShell for operating-system automation.

Is AI replacing penetration testers?

AI can accelerate research, analysis, documentation and repetitive tasks, but it can also produce incorrect results and unsafe actions. Skilled practitioners are still responsible for authorization, scope, validation, judgment and communication.

What is the difference between a pentester and a red teamer?

A penetration test is usually a scoped assessment focused on finding and validating weaknesses. A red-team exercise simulates a realistic adversary to test prevention, detection and response across a broader environment.

What entry-level jobs can lead to ethical hacking?

IT support, systems administration, networking, application support, software development, SOC analysis, vulnerability management and cloud operations can all build useful foundations.