Security Certifications Roadmap: CEH, OSCP, CompTIA Security+, and Which to Get First

Understanding security certifications roadmap is the foundation of this guide. Below we break it down step by step so you can act with confidence.

Cybersecurity certifications validate your skills to employers, help you pass HR filters, and often come with significant salary increases. But with dozens of certifications available, choosing the right ones in the right order is crucial — some are entry-level requirements while others are meaningless paper without real skills.

This lesson maps out the certification landscape and gives you a clear roadmap based on your experience level and career goals.

Security Certifications Roadmap: Entry-level certifications: where to start

If you are new to cybersecurity, these certifications establish credibility and teach fundamentals:

• CompTIA Security+ (SY0-701) — the industry standard entry-level certification. Required by many government and corporate jobs. Covers risk management, network security, cryptography, identity management. Cost: ~$400. Study time: 2-3 months.
• CompTIA Network+ — covers networking fundamentals. Not strictly necessary if you know networking, but valuable if you do not. Often paired with Security+.
• ISC2 Certified in Cybersecurity (CC) — free entry-level certification from ISC2 (the CISSP organization). Good first step, less recognized than Security+ but costs nothing.

Week 1-2:  Threats, attacks, and vulnerabilities (24% of exam)
  → Study: malware types, social engineering, application attacks
  → Lab: analyze malware samples in a sandbox, practice phishing identification

Week 3-4:  Architecture and design (21%)
  → Study: network architecture, cloud, virtualization, secure coding
  → Lab: configure firewalls, set up a DMZ, review cloud IAM

Week 5-6:  Implementation (25%)
  → Study: cryptography, PKI, wireless security, identity management
  → Lab: configure VPN, implement MFA, set up certificate authority

Week 7-8:  Operations and incident response (16%)
  → Study: incident response, forensics, log analysis
  → Lab: analyze log files, practice incident response scenarios

Week 9-10: Governance, risk, and compliance (14%)
  → Study: risk management, regulations (GDPR, HIPAA), policies
  → Practice: take practice exams (Professor Messer, Dion Training)

Resources: Professor Messer (free YouTube), CompTIA CertMaster,
           Jason Dion Udemy course, official CompTIA study guide

Mid-level: offensive and defensive specialization

After getting your foundation, specialize based on your interests:

• Offensive (Red Team / Penetration Testing):
• CEH (Certified Ethical Hacker) — widely recognized but mostly theoretical. Good for HR checkboxes. ~$1,200.
• eJPT (eLearnSecurity Junior Penetration Tester) — practical, affordable, good first pentest cert. ~$250.
• OSCP (Offensive Security Certified Professional) — the gold standard for pentesters. 24-hour hands-on exam. Extremely respected. ~$1,600.
• Defensive (Blue Team / Security Operations):
• CySA+ (CompTIA Cybersecurity Analyst) — threat detection, SIEM, incident response. ~$400.
• BTL1 (Blue Team Level 1) — practical blue team skills. Hands-on exam. ~$400.
• GCIH (GIAC Certified Incident Handler) — advanced incident response. ~$2,500.

For penetration testing careers: eJPT → OSCP. For SOC/analyst careers: CySA+ → BTL1.

Advanced certifications and the OSCP

The OSCP deserves special attention because it is the most respected offensive security certification:

Prerequisites (complete BEFORE starting OSCP):
✅ Linux command line fluency
✅ Basic scripting (Python, Bash)
✅ TCP/IP networking
✅ Web application attacks (SQLi, XSS, LFI)
✅ 20+ HackTheBox/TryHackMe machines completed

Preparation timeline (3-6 months):
Month 1-2: HackTheBox — complete 30+ machines (Easy→Medium)
  Focus: enumeration methodology, privilege escalation
  Track: TJ Null's OSCP-like HTB list

Month 2-3: TryHackMe offensive paths
  Focus: buffer overflow, Active Directory attacks
  Complete: Jr Penetration Tester path, Offensive Pentesting path

Month 3-4: Proving Grounds (PG Practice) by OffSec
  Focus: OSCP-style machines, time-boxed practice
  Complete: 20+ PG machines, write reports for each

Month 4-5: OffSec PEN-200 course material
  Focus: read all modules, complete all exercises
  Complete: the lab machines (do 50+ minimum)

Month 6: Practice exam attempts
  Focus: time management, methodology refinement
  Rule: if you cannot root 3/5 machines in 24 hours, keep practicing

Exam: 24 hours to compromise machines + 24 hours for the report.
Passing = 70 points out of 100.

Certification vs. skills: what actually matters

The hard truth about certifications:

• Certifications open doors (pass HR filters, meet job requirements), but skills keep you employed.
• A certification without practical skills is obvious in interviews — expect hands-on technical questions.
• For bug bounty and freelance work, certifications are irrelevant — results (disclosed bugs, reports) matter.
• For corporate employment, Security+ + one specialization cert + a portfolio of labs/CTFs is the winning combination.
• CISSP is a management certification (5+ years experience required) — do not pursue it early in your career.

When evaluating security certifications roadmap, start with the fundamentals: what problem it solves, who it serves, and how it compares to the alternatives buyers consider first.

Start with the fundamentals. Define who you are serving, the single outcome you want, and the budget you are comfortable committing before you compare any options.

A practical rule is to favour clarity over cleverness. The choice that is easiest to understand, spell, remember and act on tends to win over the long run.

Context changes the answer. What is optimal for a fast-moving startup is rarely optimal for an established brand, so weigh your own stage, market and ambitions.

Avoid the common mistakes: rushing the decision, copying competitors blindly, and ignoring the total cost of ownership beyond the very first year of use.

Think in terms of trade-offs rather than a single perfect answer. Every option trades memorability, cost, reach and flexibility in a slightly different mix.

Document your reasoning. Writing down why you chose one path makes it far easier to revisit the decision later and to explain it to partners and investors.

Test with real people. A quick check with a handful of your actual customers will surface problems that no amount of internal debate ever reveals.

Plan for growth. The option that fits today should still make sense when your audience, catalogue or team is several times larger than it is right now.

Finally, revisit the decision periodically. Markets, tools and best practices move quickly, and a choice that was ideal last year may deserve a fresh look today.

Frequently asked questions

Which certification should I get first?

CompTIA Security+ for most people — it is the broadest entry-level cert, required by many employers, and teaches the vocabulary of the field. If you are sure you want offensive security, eJPT is a great alternative first cert.

Are certifications worth the cost?

Security+ pays for itself with the first salary increase (certified professionals earn 10-15% more on average). OSCP practically guarantees a penetration testing job. CEH is the weakest value — expensive for a mostly theoretical exam. Consider employer-sponsored certification programs.