Road Mates EnterHow to become an Ethical Hacker, phase by phase: what you do in each one, how long it takes, and the proof that shows you're done.
6 phases2–4 years15 resources
Studying how networks, Linux, Windows, and the web actually work: TCP/IP, DNS, HTTP, permissions, Active Directory basics, and scripting in Python or Bash. By the end you can set up a home lab of virtual machines and explain how traffic moves between them.
You're done when you can show
A GitHub repo documenting your home lab setup and a few automation scripts you wrote.
Resources
Working through guided platforms like TryHackMe, Hack The Box, and PortSwigger Web Security Academy, exploiting intentionally vulnerable machines and web apps. You build a repeatable methodology for recon, enumeration, exploitation, and privilege escalation, and you write up what you did.
You're done when you can show
A public profile showing 50+ completed machines or labs, plus several published writeups.
Resources
Preparing for and passing a practical, exam-based certification such as OSCP, PNPT, or eJPT under timed conditions. You prove you can compromise multiple hosts and produce a professional penetration test report on your own.
You're done when you can show
A verifiable certificate link for OSCP, PNPT, or an equivalent practical exam.
Resources
Hunting bugs in authorized bug bounty programs or vulnerability disclosure programs, and competing in CTFs, on real targets within defined scope. You learn rules of engagement, responsible disclosure, and how to write reports that a client actually acts on.
You're done when you can show
A bug bounty platform profile with at least one accepted or triaged valid report.
Resources
Building a portfolio of writeups and reports, applying to junior penetration tester, SOC, or security analyst roles, and doing technical interviews and practical take-home tests. You end with a paid position where you perform authorized security testing or assist on engagements.
You're done when you can show
A signed offer letter for a security testing or analyst position.
Resources
Running scoped engagements for real clients: scoping, testing networks and applications, documenting findings, and presenting risk and remediation to stakeholders. You build a track record of completed engagements and start specializing, such as web, cloud, or red teaming.
You're done when you can show
A sanitized sample penetration test report you authored, approved for portfolio use.
Resources
Walk this road with people on it.
Track each phase, post your proofs, and get matched with people in the same phase.