Which cybersecurity certification should you take first?

Nov 3, 2026 · 7 min read

"Which cert should I get first?" is the most common question in cybersecurity, and the honest answer is that it depends on where you are standing. A first certification for a career changer, a help desk technician, and a network administrator are three different answers. Here is the map for each starting point.

Starting point 1: no IT or security experience

Take ISC2 Certified in Cybersecurity (CC) first. It was designed for exactly you: per ISC2, no work experience is required, and the only prerequisite is agreeing to the ISC2 Code of Ethics. The exam covers security principles, governance, access control concepts, network and cloud concepts, and security operations at a conceptual level. You do not need to have touched a firewall. ISC2 has also periodically offered free training and exam vouchers for CC, which makes it the lowest-risk first step in the field.

What CC does for you: it proves vocabulary and intent, gets you past "no certs at all" resume screening, and tells you whether you actually enjoy this material before you spend real money. What it does not do: get you hired by itself. Treat it as the on-ramp, then move to Security+ once you have some IT fundamentals, and build hands-on skills in a home lab along the way. Our ISC2 CC guide walks through the domains and study approach.

Starting point 2: help desk or IT support

Take CompTIA Security+ first. You already know how computers, accounts, and networks behave when they break, which is half the battle. Per CompTIA, Security+ (SY0-701) has no formal prerequisites, and it is the baseline credential in the most entry-level security job postings, including the many roles tied to U.S. DoD 8140 requirements. Roles it targets: SOC analyst, security analyst, and security-flavored systems administration.

One honest caveat: Security+ assumes networking knowledge it does not teach. If terms like subnet, VLAN, and DNS make you nervous, spend a few weeks on Network+ material first, even if you never sit that exam. Candidates who skip the networking foundation tend to stall in the architecture and operations domains. The Security+ guide lays out the five domains and a six-week plan.

Starting point 3: the network track

Take Network+ first, then CCNA. If you want to build your career on networks, or you are aiming at network security, infrastructure, or a NOC, this is the classic ladder. Network+ (N10-009) is vendor neutral. CompTIA's official objectives cover networking concepts, implementation, operations, security, and troubleshooting, with troubleshooting as the heaviest domain. It proves you understand how networks work without tying you to one vendor.

Cisco's CCNA (200-301) then goes deeper with Cisco gear and hands-on skills: real subnetting speed, switching and routing configuration, and lab simulations on the exam. Employers treat CCNA as proof you can actually operate a network, not just describe one. Many security professionals pair CCNA with Security+ afterward, and that combination, network depth plus security baseline, is one of the strongest early-career profiles you can build. See the Network+ guide and the CCNA guide for formats and study plans.

Starting point 4: already in security, aiming up

If you already hold Security+ and work in the field, your next cert should follow the work you want more of. Analysts who want deeper blue team credibility take CySA+. Those drawn to offensive work take PenTest+ or CEH; PenTest+ is the more hands-on and report-focused of the two, while CEH is the more recognized name on HR filters. Moving into cloud security points to CCSP once you have some years behind you, and moving toward audit and assurance points to CISA. CISSP and CISM wait at the end of this road, not because the exams are impossible earlier, but because the credentials themselves require five years of verified experience to hold, per ISC2 for CISSP and ISACA for CISM. Our CISSP vs CISM comparison helps you pick between them when you get there.

A suggested order, start to senior

1. ISC2 CC if you are brand new, or skip it if you already work in IT.
2. Network+ if your networking is weak or you are network bound.
3. Security+, the baseline almost every security path runs through.
4. CCNA for the network track, in place of or alongside Network+.
5. Specialize: CySA+ for SOC and blue team work, PenTest+ or CEH for offensive security, CCSP when you move into cloud security, CISA if you land in audit.
6. CISSP or CISM once you have the years: both require five years of verified experience to hold, though you can pass the exams earlier.

Mistakes to avoid

• Starting with CISSP. Without the experience requirement met, you cannot hold the credential, and the exam assumes years of context. It is a capstone, not a door opener.
• Collecting certs with no target role. Five unrelated certifications read worse than two that point at the job you want.
• Skipping hands-on skills. Every cert on this page gets easier with a home lab, and every interview gets harder without one.
• Paying twice for the same signal. Network+ and the networking half of Security+ overlap. Sequencing beats stacking.

Still unsure which lane is yours? A cert finder quiz is in the works here; in the meantime, the study guides give you the format, cost, and difficulty of all 11 certifications in one place, and the free practice questions on this site are the fastest way to find out whether an exam feels like a fit. Ten questions will tell you more than ten articles.

Sources

Facts above are from the official vendor sources: ISC2 (isc2.org), the Certified in Cybersecurity (CC) certification page; CompTIA (comptia.org), the Security+ and Network+ certification pages; Cisco (cisco.com), the CCNA certification page.