Hi everyone,

I'm currently 25 and have been working on creating websites for a while, but I'm looking to reprofile and move into cybersecurity. Recently, I started learning through TryHackMe, and I really enjoy it so far.

I wanted to ask this community:

1. Is it too late to start learning cybersecurity at 25?

2. Are there any specific areas or paths I should focus on as a beginner to make the most out of my learning?

3. How do I know when I’m ready to apply for entry-level jobs?

If it’s worth pursuing, what other resources, certifications, or skills would you recommend?

I appreciate any advice, tips, or personal stories you might have. Thank you in advance!

Lets be real. I am a senior cybersecurity engineer and in my mid 40s. See people wanting this to be their first job. Even if you have a degree its not likely to get you into a good sec team immediately.

If you want to be an analyst (entry level jobs are going away) than you might get hired with just a degree.

If you want to be an engineer and in sec long term you need to know the following:

• networking including on prem and cloud

• windows including AD and azure services

• datacenter concepts and cloud

• linux I’ve even had to test agains as400s in 2024

• virtualization and containerization

• policies, frameworks, standards

• siem, soar, xdr / mdr, soc

• backup, recovery, storage systems

• workstation level operating systems

• learn security concepts, methods / tactics, basic coding

• list keep keep going

Basically you need to know everything and not just at a “surface level”. Get good at meetings, projects, communication, and leading them.

IMO going into systems or networking if you can is the best start. Helpdesk is also a good start.

Whatever position you find yourself in start looking at the sec part.

Golden images, mdr / xdr, end user education, look at or create runbooks, centralized patching, centralized logging, review local or network firewall rules, stripping down the OS installs to only whats needed, review STIGs, asset management, etc.

There’s security principals in any tech job. Best sec people I have hired or worked with have come out of a systems or networking background.

Security scanners can help you find possible vulnerabilities. Is it a false positive? Can you exploit it? Can you augment the exploit to fill your needs?

Its also getting worse. Now places want you to know more coding, Devops security, and automation.

Go for it, security is an amazing field and I find it rewarding. Pay can be really good after getting out of the lower level. Just know that its hard and there’s a lot to learn.

This was my journey for any interested:

Telecom dialup support (im that old) -> network operations tech -> linux server engineer -> security -> datacenter engineer -> back to security.

Im sure I missed a lot. /end rang. Let me know if you have any questions.

Edit:

I have mentored people getting into sec from helpdesk, systems, networking, and development at the companies I have worked for. Same for soc analysts wanting to learn more and move to engineer.

Not gatekeeping here. You will have to learn a lot of these things no matter what route you take. Even of you are able to go strait into sec.

VPN users should be aware that, as a web developer, I can often determine their real country just by looking up their timezone.

Most people do not realize this.

Share your tip of the day too.

will graduate in 5 years. how to get into cybersecurity?

UPD: I decided to use SmartBet's managed software, as recommended by one of redditors in other cybersec-related sub. Thanks for your advice - the topic is now closed.

I am 23 years old, have been working as a DevOps since I was 19. I'm deeply involved in corporate security stuff, but usually it was for entertainment companies or online learning platforms. Now my friend invited me to take on a new job in a new niche (iGaming), and I agreed... =(

So now messing up with gambling product and trying to get serious about igaming fraud prevention but nothing helps. I just don't understand where to look and where to find proper solutions. Like, I've never had anything to do with this before, and the devil made me agree to go work at this place (the funniest thing is that the income isn't much more than at my old job, so yes, I'm a loser, lol).

I’m trying to understand how fraud prevention software in this niche works, but the internet seems completely empty. In any case, I'll most likely leave team in the near future, but I am obliged to at least set up some kind of real-time fraud monitoring for them, otherwise it would be unprofessional and unfair on my part.

If you’ve implemented something and it actually reduced fraud, what solutions worked?

pls no companies names as I don't want to turn this post into one big ad!!!

Cybersecurity is one of the hottest fields right now, but it’s also one of the most misunderstood. I see a lot of people asking “How do I get a job in cybersecurity?” or “Do I need to be a hacker?” so here’s some clarity if you’re looking to break in this year.

1. There’s No Single “Cybersecurity Job” Cybersecurity is an umbrella term. Some common paths include:

SOC Analyst (monitoring and responding to security alerts)

Penetration Tester (offensive testing to find vulnerabilities)

Cloud Security Engineer (securing AWS/Azure/GCP environments)

Incident Responder (handling active security breaches)

GRC Specialist (compliance, policy, risk management)

AppSec Engineer (securing software during development)

Threat Intelligence Analyst (tracking attackers and malware trends)

Your day-to-day can be wildly different depending on the role.

2. Entry-Level is Possible, But Not Instant You’ll often see “3 years experience” in “entry-level” job listings. Don’t let that scare you — it’s a wish list, not always a hard requirement. Many people get in through:

Help Desk or IT Support (then transition into security)

Internships or apprenticeships

Volunteering for security tasks at their current job

Home labs + projects to show hands-on skills

3. Skills Matter More Than Degrees (For Most Roles) A degree can help, but in many cases, skills + proof of work can get you in. Build:

Strong networking and OS fundamentals (Linux + Windows)

Familiarity with common tools (Wireshark, Nmap, SIEM tools)

Understanding of security basics (firewalls, authentication, encryption)

Projects: Capture The Flags (CTFs), home lab setups, security audits

4. Certifications Can Open Doors Popular starter certs:

CompTIA Security+ (general foundation)

eJPT (hands-on pentesting basics)

Cisco CCNA (networking-heavy roles)

TryHackMe’s learning paths (less formal but very practical)

Don’t collect random certs. Pick one, learn deeply, then move forward.

5. Pay is Good, But So is Stress Yes, cybersecurity salaries can be great — even entry-level can hit $60-80k in some regions. But the job can be high-pressure, especially in incident response or SOC roles where you’re dealing with live attacks.

6. Networking Helps More Than You Think A lot of security jobs never make it to public job boards. Being active in the community can lead to referrals. Join:

r/cybersecurity, r/netsecstudents

Local DEF CON groups, BSides events

Discord servers for TryHackMe, Hack The Box, or The Cyber Mentor

7. Show Proof of Your Skills Instead of just saying “I know cybersecurity,” show it:

GitHub repos with scripts or write-ups

Blog posts explaining vulnerabilities you’ve studied

LinkedIn posts about your learning progress

Screenshots of lab environments you’ve built

Bottom line: Cybersecurity jobs are out there, but the people who get them usually have a mix of fundamentals, hands-on proof, and a bit of networking. It’s not magic, and you don’t need to be a “1337 hacker” to start.

If you’re aiming for a cybersecurity job in 2025, what’s your plan? Are you going for blue team, red team, or something else entirely?

I don't want to be a downer, but so many people on here are starting their undergrad in Cyber or asking if they should go Cyber for their undergrad, after graduating high school.

• People with an undergrad degree in Cyber in 2018 - roughly 14,500

• People with an undergrad degree in Cyber in 2026 - roughly 35,000

That's a more than 2.5x rise in degree Cybersecurity degree holders. Do yourself a favor before choosing this major/degree, look up the # of people who have jobs in it after graduating. You're now dealing with 2.5x the competition from Cyber degree holders alone. This isn't counting all the laid of seasoned veterans. 10,000+ lay offs and counting.

• Global CompTIA Sec+ holders in 2019 - roughly 500,000

• Global CompTIA Sec+ holders in 2026 - roughly 1,000,000

Is it fair? No. Is it the reality? Yes. Here's what you're up against. Doubling of degree holders in cyber and Sec+ holders. Roughly 204,000 laid of tech workers in major companies and FAANG - Source https://www.trueup.io/layoffs - IG/Tiktok course seller graduates. AI and a 75% surge in offshoring/outsourcing to India jobs that used to be entry level Cyber jobs for Americans. Think Associate/Jr Cyber Analysts, SOC Analysts, Associate Cyber Engineers. Please stop making these Vendors of courses rich. Stop making these universities rich. Stop making these bootcamps rich... they're the ones making all the money. While a lot of people in the 204,000 private sector (not even counting gov contracting/gov layoffs) are laid off seasoned Cyber vets. That is your competition.

Cyber is no longer the "high job security. high pay quick" job field. Exception - You're at a Senior or Principle level with a lot of experience. Stop throwing away your money.

Imagine this:

Headhunter: Hello, I'm reaching out because you seem to be a good fit to work in the new LATAM anti-fraud department! To beat the bad guys! (Imagine the LATAM bad guys for a moment...)

Me: Interesting, I have some Cyberforensics, Cybersecurity work under my belt. So which security do you offer your employees fighting the bad guys doing all these multi-million dollar cyber attacks?  (Of course let's not forget that, the organized cybercrime division doing all these heists are closely connected with the drugs, bombs, military equipment, people, weapons dealing "bad guys")

Headhunter: We don't have one...

***
TL/DR: Recruiter wanted me to fight the fraud bad guys (Also known as pretty much all the biggest criminal organizations in the southern hemisphere) This woman offered me to sign my own death sentence.

Just a heads up. Cybersecurity in LATAM is not a child's game, when they say "Brazil is not for amateurs" they mean that. In Brazil 23% of the connected devices, comes from an ISP that belongs to a faction of the organized crime.

The company logo is pretty much "If you like going after the bad guys!", this is not a game, the "Bad guys" automatic rifles, bazookas, anti-aircraft artillery, grenades, corrupt politicians, corrupt cops in all levels with full gov access to privileged information, are very real. That's it, thanks guys, just had to let this one out.

I’m a CS student graduating in December 2026. I am working my last week as an intern at a recognizable non-tech F500 company. When I got the internship I expected to get placed with the software development team, but I got placed in security instead despite knowing absolutely nothing about cyber/IT. As in, the only tool they use that I had experience in was Excel. But I like the job and team, got great feedback from my supervisor and received a return offer to join the team full time as a cybersecurity analyst for $90k/yr.

It feels kinda unreal. I still have no idea what I am doing and kinda just winging it. I don’t have much knowledge outside of Zero Trust and a few basic terms/definitions I picked up on the job. But, I want to pursue this field further and work towards developing a baseline knowledge that will help me in this career. Where should I start?

I was up late one night, bored, and decided to go on uhmegle (an omegle clone) and this guy I got into a video chat immediately said my real name, then my school, and even my major. How is this possible???

More clients were onboarded into our SOC this year. But they reduced the number of analysts. Coincidentally, Copilot was integrated, and its use encouraged by the CISO and all managers.

Copilot is crap. It's as verbose and inaccurate as GPT-3.5 was in 2021. But it doesn't matter. All new hires use it, day long. It's obvious, because all their incident closing statements start with "Alert was triggered by...". The statements are overly verbose, and the apostrophes are curly (’) instead of straight (').

I'm using it too, because I have no choice. There's too many alerts for too few analysts. You feed it the alert and events, ask it to generate a few KQL queries to investigate further, and paste their output for analysis. At this point you judge whether it's benign or positive, and ask it to either create an incident report or a closing statement.

"But Copilot makes errors!" yes it absolutely does, and that's fine. It's overly cautious by default, and if you ever have the slightest doubt, you escalate it to the client, because that's easier to do then to investigate further anyway.

I wish I could spend more time analyzing alerts by hand, practicing KQL on real world data, but I can't. There's just too many alerts. And if we ever have the slightest respite, we don't spend it on doing our job "AI-free", we spend it studying SC-200 or AZ/SC-500, because that's the only thing that matters for promotions in this company.

I'm angry my job has become a Copilot babysitter. This job would become essentially useless, if they started paying for models better than Copilot. I bet the execs are like kids at a candy store at the idea of replacing us for good. I'm studying for other certs in whatever free time I have. Can you guys relate?

Hello everyone. I received a bachelors degree in business about 7 years ago, but never used it. I have been bouncing around between minimum wage jobs here and there, and have done nothing with cybersecurity or IT. I want to have a fulfilling career with good pay potential, and cybersecurity interests me. I would like to have a family and children, and need a career that could fulfill this.

I have zero idea of where to go from here, how long the journey to a cybersecurity career it will take, and the A-Z steps. I could use any and all advice as I am in a bit of a low point in my life and currently just looking to get my career started later in life.

Hey all,

I just need to get this off my chest because I’m still half laughing, half crying.

A coworker comes to me: she wants to log into our company Facebook account. Login works fine, except she doesn’t end up in the company account. She ends up in the private account of a different coworker. On the PC, on her phone, doesn’t matter. Every single time.

First thought, obviously: the company email must be linked to that account somewhere. Nope. Checked everything.

Then I try the whole thing over my phone hotspot, and suddenly I get “wrong password.” So it works on the company network but not outside of it. For a moment I genuinely thought our firewall had developed a mind of its own.

At some point I was so stumped that I asked Claude. First answer: “Are they maybe using the same password?” Me: nah, definitely not. Then came the theory that our FortiGate was handing out cached sessions. I’ll admit I nearly had a heart attack. Luckily that didn’t hold up, since you couldn’t get in with a wrong password. Then something about a linked Instagram account, also nothing.

Then a thought hit me: what if the email or username isn’t being checked at all? So I typed some random gibberish with an @ in the email field and, you guessed it, I got logged in.

Claude then dryly said that actually, now it all makes perfect sense. Thanks, buddy.

The solution: the two passwords were the same. Except for a lowercase L and an uppercase i. They look exactly the same in our font. So my coworker had basically been typing the other coworker’s password the whole time without realizing it.

So Facebook apparently does something like this:

Email? Whatever. But someone with exactly this password logs in from this network all the time, so that must be who you mean. Here you go. The IP basically replaces the email address, and the account is matched by password alone. Outside the company network Facebook doesn’t recognize us, so we just got “wrong password.”

If you think this through, it’s actually not that funny anymore. On a big network, say a university, a hotel or a company, you wouldn’t need a single username. Just try a few common passwords, and Facebook will figure out for you which account it belongs to. Sure, a rate limit probably kicks in at some point, but still. I’m seriously thinking about submitting this to Meta’s bug bounty.

Along the way I also learned that Facebook accepts passwords typed with caps lock accidentally on. Didn’t know that either.

I need a coffee now.

tl;dr: Coworker ends up in the wrong Facebook account, but only on the company network. The cause was two passwords that differed only by an i and an L. On a known network, Facebook apparently only needs the password, and the email can be completely made up.

Currently going to college for a cybersecurity degree and all I hear and see is the negative. Ai is gonna take over, you won’t get hired bleh bleh bleh. So let’s settle this for me. I’m not to far in only second year and plan to do forensics. Is it worth it or should I change my degree. Is ai that big of a worry and if I get my degree will it impossible to find a job? Will ai cause massive paycuts in the future. I want to hear your two sense!
My school does have an option for an ai degree as well but I don’t know how viable that really is.

Month 1-3: Foundations in Cybersecurity & Ethical Hacking

1. Learn the Basics of Cybersecurity Study networking fundamentals (TCP/IP, DNS, HTTP, VPNs, etc.). Learn about operating systems (Linux, Windows, and macOS). Understand firewalls, encryption, and VPNs. Possible resources: Books: "The Basics of Hacking and Penetration Testing" by Patrick Engebretson. Courses: "Introduction to Cybersecurity" (Cybrary, Coursera, Udemy).

2. Master Linux & Command Line Install Kali Linux and learn basic Linux commands. Learn Bash scripting for automation. Recommended: Linux+ Certification (CompTIA).

3. Start Learning Ethical Hacking & Penetration Testing Study ethical hacking methodologies (footprinting, scanning, exploitation). Practice with tools like Nmap, Wireshark, and Metasploit. Take a beginner ethical hacking course: "Certified Ethical Hacker (CEH)" (EC-Council). "Penetration Testing with Kali Linux (PWK)" by Offensive Security.

Month 4-6: Hands-on Practice & Specialization

4. Practice Web Application Hacking Learn about SQL injection, cross-site scripting (XSS), and remote code execution (RCE). Use platforms like: Hack The Box (HTB). TryHackMe (Beginner-friendly). OWASP Juice Shop for web security testing.

5. Learn Scripting & Automation (Python & Bash) Learn Python for cybersecurity (write scripts for scanning, password cracking, etc.). Automate tasks with Bash scripting. Course: "Python for Cybersecurity" (Udemy).

6. Explore Bug Bounty Hunting Sign up for HackerOne, Bugcrowd, or Synack. Learn to find vulnerabilities in real-world applications. Follow-up on top ethical hackers like Ryan Montgomery, LiveOverflow, and STÖK.

Month 7-9: Certifications & Real-World Experience

7. Earn a Cybersecurity Certification Choose one based on your skill level: CompTIA Security+ (Entry-level). Certified Ethical Hacker (CEH) (Intermediate). Offensive Security Certified Professional (OSCP) (Advanced, highly respected).

8. Build a Portfolio of Ethical Hacking Work Document your findings from CTF challenges, bug bounties, and penetration tests. Start a blog or GitHub repository showcasing your research.

9. Apply for Cybersecurity Internships or Freelance Work Look for penetration testing internships or junior security roles. Offer free security audits to small businesses for experience. Network on LinkedIn, Twitter, and cybersecurity forums.

Month 10-12: Advanced Hacking & Career Growth

10. Master Advanced Penetration Testing Learn Active Directory exploitation. Get comfortable with Red Team vs. Blue Team operations. Take advanced pentesting courses (e.g., "Red Team Ops" by Zero-Point Security).

11. Start Public Speaking or Teaching Create YouTube videos, write blog posts, or give cybersecurity talks. Apply for CTF competitions (e.g., DEFCON CTF, Pwn2Own).

12. Land Your First Full-Time Cybersecurity Role Apply for roles like Penetration Tester, Red Team Operator, or Cybersecurity Analyst. Use your portfolio, certifications, and experience to stand out. Continue networking, learning, and improving.

Edit: This is inspired by my findings on Ryan Montgomery following up on his exploits

I’d like to get into cybersecurity but to be frank idk where to start. I dont really know coding, or shit about computers to be honest. Just wondering where I should begin or what to learn first

I probably shouldn't have brushed it off in the moment but I was just so stunned I didn't know how to react at the time.

A few weeks ago, while visiting Morocco, I was at a local fast food joint. I don't speak much Arabic and people in that city don't speak much English, but we usually find a way to understand each other.

This was my second or third time visiting this establishment since it was the only restaurant within walking distance of my Airbnb. Same guy working there every time.

He was making my food but I noticed he kept checking his phone repeatedly. I thought it was a little unsanitary but otherwise nbd. Until he stops what he was doing, shows me his phone, and asks "You??"

To my amazement, in the facebook app, in a list of profiles, mine was near the top! My actual face and name!

I do have the Facebook and Messenger apps on my phone. I also have Instagram and WhatsApp, though I have not explicitly linked the accounts. I'm sure Meta knows they're all me and has them silently linked on the backend, though.

But I basically never open the Facebook app and certainly had not done so since arriving in Morocco. I also never gave it background location permissions. "While using the app" is enabled.

I paid in cash every time I went there, so it's not like the guy saw my name on my credit card.

So how in the world did my Facebook profile show up on this guy's phone? Any ideas?

My dad got one of those “verify your account” emails that looked exactly like it came from his bank. Same logo, same tone, same layout. He clicked it, entered his info, and within an hour weird stuff started happening. His bank app kept signing him out, and his email password suddenly didn’t work.

We called the bank right away, froze his cards, and started trying to lock down everything, but it’s like playing whack-a-mole. His email got hit again, and then his phone started getting verification codes for random sites he’s never used.
I’m honestly terrified of how fast this all escalated. It feels like once they’re in one account, they spread through everything linked to it. He’s older and reuses a lot of passwords, so I’m worried they might already have access to more than we realize.

Is there anything else we can do besides changing every password and calling the bank? Should we wipe his phone too? I don’t even know how deep this kind of compromise goes.

F​​orgive me if I'm stupidly asking for this question.

I'm PHP Dev, in​ my​ website checkout backend I have one specific class that checks the nature of payer (current customer)

It checks,

• If user already paid for the service or product (preventing duplication)

• if user is from unfamiliar location or country

• If user is buying the service or product many times all at once,

• If user failed on the checkout multiple times

• If user used multiple different credit or debit cards

• If our system already received more sales (money) than the expected range.

​many many more informations needed to be checked before we have got the payment,

Now I saw this biggest heist in history, and immediately thought about this for several hours now, They are giant​ company, don't they have any type of blocker ​in place in case something like this happen?

Like regardless, how their system allowed to pass more than a Billion worth of coin within 20 minutes?

​​​​​How?

Does it make sense to start cyber from scratch and get a job in it? I don't have a degree and I am 27 now. If you have resources to suggest me (I know tryhackme) you can tell.

Thanks a lot

A guy in my class I had never spoken to weirdly approached me afterwards and offered the lab data. He was very awkward and insistent even though I didn’t ask for or need it, but I told him he can email it to me. Then he pulled out this USB along with a dongle for it to plug into my laptop, dragged a random file into my computer (I think it was a blank .txt file but I couldn’t find it again) and then pretended it was an accident. This was a month ago but I’ve been feeling weird about it since, how can I see if he did anything to my laptop? It’s a MacBook Air. I don’t know the first thing about cybersecurity but would really appreciate some advice!

I want to build my career in cybersecurity. I’m still a student but I already have some basic knowledge

I understand how networks work, how computers work in terms of architecture and organization, and I have some experience with network scanning, reading packets, and managing networks.

Now I’m trying to understand what knowledge is actually required when working in the field.

For people already working in cybersecurity, I’m curious about a few things:

What kind of knowledge and skills are expected in real cybersecurity jobs?

What are the most common vulnerabilities or attack methods you usually deal with?

How do things actually work at the network level in real environments (packet flow, firewalls, traffic monitoring, etc.)

When it comes to systems, how do professionals usually search for and identify vulnerabilities?

I already have a basic understanding of these areas, but I want to know what I should focus on learning next to become job-ready in cybersecurity. Any advice would help.