Last updated 2026-06-16 — the article text's own revision date; dated evidence on this page carries its own check date. See the Citation Ledger at the foot for this page's sources.
If you want to move toward a cybersecurity analyst role, you do not need to spend thousands before you begin. The honest path is to build IT and networking fundamentals, then security fundamentals, using genuinely free resources. The only hard cost is the exam fee if and when you choose to certify. Certifications are optional milestones that mark progress, not requirements to get hired. This study plan leads with free learning, frames time as a range based on your background and weekly hours, and keeps every claim grounded in occupation context, not promises.
Key takeaways
- Learn in order: IT and networking fundamentals first, then security fundamentals, then deeper analyst skills later.
- Free resources like Professor Messer, freeCodeCamp, CISA Learning, and a home lab can carry most of your studying.
- Your only hard cost is the exam fee; a self-study floor across the path is about $838 in exam fees ($399 Network+ plus $439 Security+).
- Certifications such as Network+, Security+, and later CySA+ are optional milestones, never a hiring requirement.
- Time to readiness is a range that depends on your starting point and weekly study hours, not a fixed timeline.
What to learn, in order
Start with the fundamentals that everything else builds on: how computers, networks, and the internet actually work. Networking concepts (addressing, protocols, ports, the OSI model) come first because security depends on understanding what you are protecting. From there, move to security fundamentals: risk, common controls, threats, and basic incident response. Reading comprehension, critical thinking, and active listening are core skills for the cybersecurity analyst role, so practice explaining concepts in your own words. A common sequence is networking fundamentals (Network+ objectives), then security fundamentals (Security+ objectives), then analyst-focused study (CySA+) later. Treat each cert's published objectives as a free, structured syllabus.
Can I study cybersecurity for free, and what does it cost?
Most of your learning can be free. Professor Messer offers complete free Network+ and Security+ video courses; freeCodeCamp has free fundamentals; CISA Learning provides free cybersecurity training; and a home lab built from spare or virtualized machines costs little to nothing. The official exam objectives are free to download and make an excellent checklist. The only hard cost is the exam fee if you decide to certify. As a self-study floor across this path, exam fees total roughly $838, with the Network+ exam around $399 and the Security+ exam around $439. Paid instructor-led training exists, often roughly $1,295 to $2,790, but it is optional, not the plan.
How long it takes (it depends)
There is no honest one-size week-by-week timeline, because how long it takes depends on your background and how many hours you study each week. Someone already comfortable with IT may move through networking fundamentals quickly, while a complete beginner reasonably needs longer. More weekly hours generally shorten the calendar; fewer hours stretch it out. Rather than chasing a deadline, aim for steady, consistent sessions and use the exam objectives to measure readiness. Practice in a lab so the concepts stick. Certifications are checkpoints you reach when your knowledge is ready, not dates you must hit, and they are never required to start applying for entry roles.
Frequently asked questions
Do I have to pay for a training course to study cybersecurity?
No. You can learn the core material with genuinely free resources: Professor Messer's free Network+ and Security+ video courses, freeCodeCamp, CISA Learning, the official exam objectives as a free syllabus, and a home lab. Paid instructor-led training does exist, often roughly $1,295 to $2,790, but it is optional. The only hard cost in a free-first plan is the exam fee itself if you choose to certify.
Which certification should I get first?
A common, sensible order is networking fundamentals first (Network+), then security fundamentals (Security+), with CySA+ later if you target an analyst role. That said, certifications are optional milestones, not requirements to get hired, and the right first step depends on your goals and what you already know. Use the free objectives to study; certify when your knowledge is ready rather than rushing to a credential.
How long does this study plan take?
It depends on your background and weekly study hours, so we will not invent a fixed timeline. People with prior IT experience often move faster through the fundamentals; complete beginners reasonably take longer. More hours per week shorten the calendar; fewer stretch it out. Measure progress against the published exam objectives and practice in a lab, then sit an exam only when you consistently meet those objectives.
Can I really do this for free?
Almost entirely, yes. The learning itself can be free through Professor Messer, freeCodeCamp, CISA Learning, the official objectives, and a home lab. The one unavoidable cost is the exam fee if you decide to certify; as a self-study floor across this path, exam fees total roughly $838 ($399 Network+ plus $439 Security+). You can study as long as you like for free and only pay when you choose to take a proctored exam.