I've been writing versions of this guide since 2008. The most recent big one was the 2019 update, which covers the full tactical ladder—education, building a lab, projects, bug bounties, certifications, conferences, networking—and I still stand behind most of it.

But when people ask me how to get into cybersecurity now, in 2026, I find myself giving a different answer. The tactics still matter, and I'll point you at them below. What changed is what sits above the tactics, because AI reset what this industry actually rewards.

So this is my current answer, pulled together from everything I've written about careers and skills over the last few years. It comes down to three things:

1. Deeply understanding how things work
2. Knowing how you want them to work differently, or what should exist that doesn't yet
3. Having extraordinary AI skills that make you better and better at both

I wrote about this trifecta in The Three Components of Becoming AI Antifragile, and the more time passes the more I think it applies to security careers specifically.

Deeply understand how things work ​

Security is a meta-discipline.

You're protecting systems, which means you have to understand the systems themselves—networking, operating systems, applications, code, and the businesses they live inside. In the 2019 post I said your foundation is networking, system administration, and programming. And that's still the foundation. The deeper the better, all the way down: hardware, memory, protocols, the whole stack.

This is also what good interviewers screen for. In my interview questions post I said the point of asking someone exactly how traceroute works is seeing whether they like to understand how things work, because that quality is crucial for anyone doing security.

AI actually raises the bar here, which surprises people. The further a topic is from your expertise, the smarter an AI sounds, which means the person who deeply understands a system is now the only one who can look at AI output about it and know whether it's brilliant or bullshit. And judging AI output is turning into a real part of the security job itself.

Deep understanding is the one thing you have to own yourself.

The way you get it is unchanged since I wrote Don't Study, Do: pick a project and build it. Break it. Use whitepapers as references. Walk around with questions in your head. The difference in 2026 is that you have a tireless tutor available for $20 a month, so the main thing between you and deep understanding is just time on the thing.

Want something to be different ​

The second piece is that you have to actually want something.

Look at how a system works today and have a reaction to it. That login flow is fragile. That permission model is going to get someone breached. That tool should exist and somehow doesn't. Security is a natural home for people who see the gap between how things work and how they should work—and feel personally annoyed by it.

So ask yourself: what do you look at in security and think that should work differently? If the answer is nothing, that's the first problem to fix, because this is the piece AI can least help you with.

This reframe also fixes your job search. I wrote Plan Your Career Around Problems in 2024, and I think it's the most useful single idea for someone starting out. Walking into an interview saying "I'd like to get into security, maybe pentesting" puts you in a pile with ten thousand identical resumes. Walking in saying "I'm fascinated by the problem of automating manual pentesting, and this is what I've built while obsessing over it" puts you in a much smaller pile.

Get fascinated by problems. That fascination leads to curiosity. That curiosity leads to work. That work leads to skill. And that skill over time leads to competence. Plan Your Career Around Problems (2024)

And I'll say the harsh version too, from the antifragile post: one of the worst situations you can be in right now is having skills but wanting nothing. AI is commoditizing skill. Wanting things—having opinions, having taste, having something you're trying to make real—stays human.

Get extraordinary AI skills ​

The third piece is capability—the ability to actually make things happen—and in 2026 that means AI skills above almost everything else. "Learn AI" has become kind of a meaningless phrase though, so I'll say exactly what I mean.

The core skill is articulating intent. I've been saying versions of this since 2023, and by now I think the scarcest skill in tech is being able to say what you actually want, clearly enough that it becomes verifiable. Models keep getting smarter, so the bottleneck keeps moving toward the human who has to describe what done looks like. And that's already a security skill: a pentest scope, a detection rule, a threat model—all of it is articulating exactly how a system should and shouldn't behave.

You should also still learn to code. Skipping code because AI writes it now is like skipping thinking because there are talk shows. Writing is thinking, coding is building, and AI multiplies the people who can do both.

Then use AI on everything, daily, as a force multiplier. Build your own tooling. Automate your own busywork. In security specifically, most of the actual work was always scaffolding—stitching up context on targets, building and maintaining tooling, formatting findings—and AI absolutely crushes exactly that.

So the rote grind that used to be the way in is evaporating, and I think that's actually good news for you, because the new way in—showing up already able to do the thinking part, with AI handling your scaffolding—is available to anyone willing to build in public for six months or so. The distance between wanting to do real security work and actually doing it is the shortest I've seen in 25+ years of doing this.

The uncomfortable math ​

I want to be honest about the market you're walking into, because I've been writing about the entry-level problem since long before AI made it sharper.

Security hiring has always demanded that you show up useful on day one—the patient train-you-from-zero job has mostly been a myth. And the bar is rising, because I think the new jobs AI creates will go to the top few percent of the smartest, most ambitious, and most AI-native people. And honestly, nobody knows how small that group will be.

The good news is what hiring managers actually look at. Degrees and certs are proxies—stand-ins for evidence that you can do the work. The industry is full of top talent with art degrees or no degree at all, and full of bottom talent with every credential. What beats a proxy every time is the thing itself: work you've already done, in public, that a hiring manager can go look at.

Don't ask if they have a degree: ask them how they think the world works. Don't ask them if they're an A student: ask them what they have built lately. The Cybersecurity Hiring Gap is Due to The Lack of Entry-level Positions (2018)

What I'd actually do ​

If I were starting today, this would be my sequence.

1. Pick a security problem that actually bugs you. Something you keep thinking about in the shower—problems first, then careers.

2. Learn the stack under it by building. Set up the lab, break the thing, rebuild it. Use AI as your tutor the whole way down, and go deeper than feels necessary.

3. Build the thing that expresses your opinion. The scanner that should exist, or the write-up that explains what everyone else got wrong.

4. Do all of it in public. GitHub, a blog, write-ups of your process. Your work is your resume, and writing clearly is still the uber-skill because clear writing requires clear thinking.

5. Get extraordinary at AI while you do the rest. Daily force multiplier, your own tooling, your own infrastructure. AI is what makes the other four go faster.

And when you want the full tactical layer—labs, bounties, certs, conferences, networking, mentors—the 2019 guide still holds up. Read it after this one.

Summary ​

1. The tactical ladder from the 2019 guide still works, but AI changed what sits above it.
2. Deeply understand how things work. It's the thing you have to own yourself, and it's what lets you tell brilliant AI output from confident garbage.
3. Want something to be different. Problems, opinions, and taste are the scarce human inputs now.
4. Get extraordinary AI skills—articulating intent, building your own tooling, still learning to code—because AI is the lever that turns understanding and desire into shipped work.
5. Show up useful on day one, in public, with work people can inspect.
6. The person who understands the system, wants it fixed, and can build the fix is the person this field has always wanted. AI raised the ceiling on what that person can do.

That's my answer for 2026. And I'll keep updating this as things change—probably sooner than the seven-year gap last time.

If you build something because of this post, send it to me. I'd genuinely love to see it.