Related: Learning AI itself? Start with the AI beginner to expert roadmap, then come back here to learn how to secure what you build.
Most advice on how to learn cybersecurity starts with a list of tools. Install a security-focused Linux distribution, download a scanner, follow a video where someone breaks into a practice machine. Two weeks later you can run commands you cannot explain, and the first time a real system looks different from the tutorial you are stuck.
There is a better order. Security is the study of how ordinary computing goes wrong, so it makes sense to learn how ordinary computing works first: what a program is, how a computer decides who may open a file, how a web request travels. Once those pieces are solid, each vulnerability class becomes one small, understandable mistake rather than magic.
This roadmap follows that order. It is the structure of a free course on AgentBeam, built by the explainx.ai team: Learn cybersecurity from zero to AI agents, nine levels and 68 short lessons, each teaching one idea and using only what earlier lessons covered. Below is the whole path, why it is ordered this way, how AI changes the picture and how to study without wasting months.
The roadmap at a glance
| Level | Topic | Lessons | What you can do afterwards |
|---|---|---|---|
| 0 | Computer foundations | 11 | Explain how a program runs, read file permissions, use a terminal, read a log |
| 1 | The security mindset | 7 | Build a threat model, read a CVE record, explain why patching fails |
| 2 | Identity, access and secrets | 6 | Spot broken authentication and missing authorization, find leaked secrets |
| 3 | Web vulnerabilities | 9 | Recognise path traversal, SQL injection, XSS, SSRF and command injection in code |
| 4 | Systems and memory | 7 | Explain buffer overflows, use-after-free, privilege escalation and sandboxes |
| 5 | Networks and defense | 7 | Reason about TLS, segmentation, denial of service, detection and incident response |
| 6 | Software supply chain | 5 | Read an SBOM, spot a malicious package, understand build and CI compromise |
| 7 | AI agent security | 10 | Explain prompt injection, config poisoning and MCP risk, and the controls for each |
| 8 | Agent operations and red-teaming | 6 | Threat-model an agent deployment, write policies, run an authorised evaluation |
Every lesson has the same shape: a plain-language explanation, a real case where one exists, a section on how AI changes the idea, a safe lab on your own machine and a short self-check. Nothing asks you to attack anyone else's systems.
Why you start with computers, not hacking
It feels slow to spend a week on files and terminals when you came to learn security. It is the fastest route, for a simple reason: a large share of real vulnerabilities are not exotic. They are ordinary mistakes about who is allowed to do what.
Take file permissions. On macOS and Linux every file answers three questions for three audiences: can the owner, the group and everyone else read it, change it or run it. The notation looks like -rwxr-xr--, and once you can read that string you understand why an SSH client refuses to use a private key that other users can read, and why "just make it 777" is the start of many incident reports.
You can feel this directly in the lab below. Flip the switches and watch the string and the chmod number change.
The same logic applies to a running program. A program has no permissions of its own; it borrows those of whoever started it. That one sentence explains why running an unknown installer is dangerous, why a process started as an administrator is far more valuable to an attacker, and why a coding agent that runs commands on your behalf can read everything you can. Level 0 builds this picture in eleven lessons, from how a computer runs a program through processes, accounts, the network, DNS, HTTP and logs.
Level 1: think like a defender
Before any specific bug, learn the vocabulary and the habits. Level 1 covers the three goals security protects, which are confidentiality, integrity and availability, how to ask who would attack something and how, and how to shrink the attack surface.
It also teaches you to read a vulnerability record, which is a skill that pays off for your whole career. A CVE entry gives a numbered identifier, a weakness category (a CWE), a severity score (CVSS), and for the worst ones a flag from CISA's Known Exploited Vulnerabilities list saying attackers are using it now. The lesson walks through a real record end to end: the Openfire path traversal, CVE-2023-32315, published in May 2023 and fixed in Openfire 4.7.5 and 4.6.8.
The level closes on a lesson that surprises people: patching. CVE-2017-0144, the SMBv1 flaw behind the 2017 WannaCry outbreak, had a fix available two months before the outbreak, and the machines that were hit were the ones nobody had updated. Security is often a maintenance problem wearing a technical costume.
Level 2: identity and secrets
If level 0 is about who may touch a file, level 2 is about who you are claiming to be. Passwords and hashing, multi-factor authentication, sessions and cookies, and the two failures that cause the most real damage: broken authentication, where the login check can be skipped, and missing authorization, where a logged-in user can reach things they should not. The course uses real records for both, a Microsoft SharePoint authentication flaw (CVE-2025-49706) and a JFrog Artifactory authorization flaw (CVE-2026-42016), taking only what the public records say.
The last lesson is about secrets in the wild: API keys in git history, .env files, shell history, logs and chat windows. It is the most practical lesson in the level because you can run a safe lab on a throwaway repository and watch a "deleted" key still sitting in history.
Level 3: the web bugs everyone should recognise
Level 3 is where most beginners expect to start, and by now you are ready for it. One lesson per bug class: path traversal, SQL injection, cross-site scripting, OS command injection, server-side request forgery, unsafe deserialization and file upload flaws, each with a tiny vulnerable-versus-fixed code pair, the root cause and the fix. The lessons teach recognition and repair, not working attack payloads, and every demonstration runs on files you create yourself.
A first lesson, "never trust input", gives the single idea underneath nearly all of them: data from outside your program must never be allowed to become a command, a path or a query. The level ends with Log4Shell and Spring4Shell (CVE-2021-44228 and CVE-2022-22965), two cases where a library nobody chose became the biggest hole in the building.
Levels 4 and 5: below the application and around it
Level 4 goes beneath the application into memory. Buffer overflows, use-after-free, and landmark cases: Heartbleed (CVE-2014-0160), a bug in OpenSSL that let a client read memory it should not, Shellshock (CVE-2014-6271) and the Polkit privilege escalation known as pwnkit (CVE-2021-4034). It then covers sandboxes and containers, the walls we build around code and the ways they leak. No exploit development: the goal is to understand the mechanism and the fix.
Level 5 zooms out to the network: TLS and certificates, firewalls and segmentation, how a worm moves from machine to machine, denial of service, detection and logging, incident response and the forgotten routers and appliances that sit at the edge unpatched for years. If you want a defensive career, this is the level where it starts to look like a job.
Level 6: you run more code than you wrote
Modern software is mostly other people's code. Level 6 covers dependencies and SBOMs, malicious packages (typosquats, takeovers and install scripts), build and CI compromise, trust stores and certificate authorities and a closing lesson on reading real campaigns from the monthly attacks tracker. Pair it with explainx.ai's coverage of an open-source supply chain arrest and the Bumblebee supply chain scanner to see the same ideas in the news.
Levels 7 and 8: security for AI agents
This is the level that did not exist in older roadmaps and is the reason this one was written.
An AI coding agent reads text, decides what to do and runs commands, often with your permissions. Each step is an attack surface:
- Reading. Anything the agent reads can carry instructions. That is prompt injection, covered in depth in explainx.ai's guide to indirect prompt injection.
- Configuring. A project file can configure the attacker's tool, which is config poisoning.
- Connecting. Every tool you attach through the Model Context Protocol is code you are trusting.
- Acting. An agent can delete the wrong thing correctly. The Claude Code rm -rf incident and sandbox guide shows what that looks like.
- Extending. Plugins and agent skills are trust decisions, which is why pinning and hash checks matter.
Level 7 gives each of these a lesson, tied to a real incident and to the control that addresses it: sandboxing, monitoring and judging actions, and policies with audit and role-based access. Level 8 turns that into operations: threat-modelling an agent deployment, writing rules that block the bad without blocking the work, running an authorised red-team evaluation and responding when an agent goes wrong. It ends with a capstone where you harden a repository of your own, run an evaluation and write the report.
If you are comparing tooling for this layer, the market overview in AI agent security platforms 2026 is a good companion, and the Claude Code security-guidance plugin shows one approach inside the coding tool itself.
How AI changes learning cybersecurity
Every lesson in the course has a section titled "How AI changes this", because three things are true at once:
- Attackers can move faster. AI can help write convincing phishing at scale, automate the boring parts of scanning and speed up turning a published fix into a working attack. The fundamentals did not change, but the window to fix things is shrinking.
- Defenders can use it too. Triage, log reading, code review and patch drafting are all places a model helps, as long as a person checks its work. Knowing the fundamentals is what lets you check.
- Agents are a new thing to protect. A system that runs commands as you, reads untrusted text and holds credentials is a new kind of asset and a new kind of insider. Most older security curricula never mention it.
A practical consequence for learners: use an AI tutor, but treat it like a smart colleague who is sometimes confidently wrong. Ask it to explain a lesson a second way, to quiz you or to review a lab you wrote. Do not accept a CVE detail, a version number or a command you have not checked against the record or the documentation.
A study plan that works
- Thirty to forty-five minutes a day beats a weekend binge. The material is built in small pieces so that a lesson fits one sitting.
- Do the lab every time. Reading about permissions is not the same as breaking and fixing one yourself.
- Keep one notebook of mistakes. The things you got wrong are your own best flashcards.
- Stay in order for levels 0 to 2, then branch. After that, web (level 3), systems (level 4) and defense (level 5) can be taken in the order your interest pulls you, but do level 1 before any of them.
- Only practise on what you own. Your own laptop, a throwaway container, a repository you created. Written permission or nothing.
Where to start today
Open the first lesson, what cybersecurity actually is. It is ten minutes, needs no tools and ends with a short exercise that becomes your first threat model. The full outline is at agentbeam.com/learn, and every term the course uses is defined in the AgentBeam security dictionary.
If you run AI agents on real machines and want something watching what they do, AgentBeam is the agent security platform from the explainx.ai team. It sits at the layer levels 7 and 8 teach.
Related reading
- How to learn AI: beginner to expert roadmap (2026)
- What is indirect prompt injection? A guide for AI agents
- What is MCP (Model Context Protocol)? The complete guide
- What are agent skills? The complete guide
- Claude Code rm -rf incident: a sandbox guide
- AI agent security platforms in 2026
- Bumblebee supply chain security scanner
- Claude Code security guidance plugin
Details such as lesson counts, CVE records and tool behaviour are accurate as of October 24, 2026, and the course grows over time. Check the linked pages for the current state.