Free Tool
Certification Path Picker
Which certification should you get first? The honest answer depends on where you are starting from and where you want to go — and the guides that give one answer for everyone are the ones to distrust. Answer four questions about your background and your goal, and this picker builds an ordered plan for you, with the warnings that matter and no fee figures that would be out of date tomorrow.
No fees published, ever. Exam fees change, and sources disagree — published fees on this site would be wrong within months. The picker links you to the issuer's own site and tells you to check the current fee there before booking.
What this tool does
Certifications are the most-asked question in cybersecurity careers, and the most confusing. There are dozens of them, the comparison tables disagree with each other, and the fees quoted online conflict — the same exam is listed at five different prices on five different sites. What matters is not the list but the order: which certification fits your starting point, which one opens the next door, and which ones are traps for a beginner — such as advanced certifications that require years of experience you do not yet have.
This picker asks four questions and builds a plan from the answers. What is your background — no experience, IT support, a developer, or something else entirely? What is your goal — a SOC analyst job, penetration testing, governance and risk, or simply getting started? How much time can you study each week? And are you aiming for a first job, or for a change of direction inside a career you already have? The plan it gives is ordered — first, then, and only later — with a warning attached to each step, such as the experience requirement of the most advanced certifications.
The picker is deliberately honest about its limits. It does not promise a job, a salary or a timeline, because none of those can be promised. Timelines in the guides vary from six months to two years depending on hours per week and starting point, and the picker says so. It also tells you what certifications cannot do: they do not replace hands-on practice, and an employer who sees a certificate without a lab, a portfolio or a home project will notice. The careers guide linked below covers the full roadmap, with the honest timelines and the entry-pay split.
Try it
Answer four questions and get an ordered certification plan. No fees are published — check the current fee on the issuer's site before booking.
Waiting. Answer the four questions and press Build my certification plan.
How it works
The picker's logic follows the order that practitioners recommend, not the order that training companies sell. The first step is almost always a foundational certification — the one that proves you understand networks, security concepts and risk — because it is the prerequisite that employers look for and the base that the rest is built on. The second step depends on your goal: a SOC-focused certification for the analyst path, a networking or operating-system foundation for the penetration-testing path, a governance certification for the compliance path. The third step is where experience starts to matter, and the picker warns you about it: the most advanced certifications require years of verified experience, and taking one early wastes the attempt.
The picker also adjusts for time. With under five hours a week, the plan stretches and the advice is to do one thing properly rather than two things badly; with more than ten hours, it adds hands-on lab practice alongside the study, because a certificate without lab work is a weak signal to an employer. And it adjusts for background: a developer starts from a different place than someone with no IT experience, and the plan says so, rather than handing both the same list.
Two things the picker will never do: publish a fee, and promise a timeline. Fees change and sources disagree, sometimes by a hundred dollars for the same exam, so the only honest advice is to check the current fee on the issuer's own site — CompTIA, ISC2, ISACA, EC-Council, GIAC — before you book, and to check the exam version too, because exams are retired and replaced. Timelines depend on hours per week and on where you start, and the picker gives a range with those conditions, never a promise.
Limitations
This picker gives an ordered plan, not a guarantee. A certification does not promise a job, a salary or a timeline, and an employer will look at your hands-on practice — labs, a portfolio, a home project — alongside any certificate. The plan is a starting point for your own research, not a substitute for it, and the certifications guide linked below covers the details the picker cannot: the current exam versions, the experience requirements, and the issuer links you should check.
- Exam versions change. Some exams are retired and replaced — always verify the current version on the issuer's site before you book, and never study for a retired version.
- Fees are never published on this page. Check the current fee on the issuer's site, and check whether your region or employer offers a discount or a voucher.
- Advanced certifications require verified experience — commonly five years for the most senior one. Do not book one until you meet the requirement.
Examples
Example 1 — no experience, SOC analyst goal. Background: no IT experience. Goal: SOC analyst. Time: 5–10 hours a week. The plan: first, a foundational certification that covers networks and security concepts; then, hands-on lab practice with log analysis and the SOC simulator on this site; then a SOC-focused step. The warning: penetration testing is a destination role, not an entry role — it comes after SOC experience, not instead of it.
Example 2 — IT support, change of direction. Background: help desk. Goal: SOC analyst. Time: more than 10 hours a week. The plan: a foundational certification first, then a SOC step, with lab practice throughout — because help-desk experience already proves you can work with users and tickets, and the gap is security knowledge, not workplace skills. The timeline is shorter than for a complete beginner, but the picker still gives a range, not a date.
Example 3 — developer, penetration-testing goal. Background: developer. Goal: penetration tester. The plan: a foundational certification, then networking and operating-system depth, then a dedicated penetration-testing certification — with the honest warning that junior penetration-testing roles are scarce, and that most penetration testers arrive there through a SOC or a systems role first. The picker tells you the destination and the route, and it does not pretend the route is short.
Frequently asked questions
Which cybersecurity certification should I get first?
Usually a foundational one that covers networks, security concepts and risk — it is the base employers look for and the prerequisite for the rest. Which one exactly depends on your background and your goal, and this picker builds the order from your answers.
How much does a certification exam cost?
It changes, and sources disagree — so this site never publishes a fee. Check the current fee on the issuer's own website (CompTIA, ISC2, ISACA, EC-Council or GIAC) before you book, and check the exam version too.
Do I need a certification to get a cybersecurity job?
No, but it helps — especially the first one, which signals commitment and a baseline of knowledge. Employers also look at hands-on practice: labs, a portfolio, a home project. A certificate without practice is a weak signal.
How long does it take to get a first cybersecurity job?
It depends on your starting point and your hours per week. Published timelines range from about six months to two years, and the honest answer is a range with those conditions — never a promise. The careers guide on this site explains the range.
What is the experience requirement for advanced certifications?
The most senior certifications require years of verified experience — commonly five years for the leading management-level one. Do not book one until you meet the requirement, and check the issuer's own rules, because they change.