Resources
Free resources I actually recommend
Hand-picked courses, labs, news and frameworks. Nothing here is sponsored, and every link was checked in October 2026.
Start here
Three steps, in this order
1
Learn the foundations
Pick one free course below and finish it before starting another.
2
Practise every week
Add one lab platform and spend an hour a week on it. Skills come from doing.
01 · Learn
Free courses and learning paths
Structured starting points for people new to security or moving across from IT.
Free certification course
ISC2 Certified in Cybersecurity (CC)
Official self-paced training for ISC2’s entry-level certification, with the exam voucher included.
isc2.org
Beginner · Certificate
Cisco: Introduction to Cybersecurity
A short self-paced course on threats, networks and the basics of protecting them.
netacad.com
Beginner · Badges
IBM SkillsBuild
Guided learning paths with digital badges. Filter the catalog by cybersecurity.
skillsbuild.org
Beginner
EC-Council free courses
Short introductions to network security, cloud basics and how attacks work.
eccouncil.org
Library
Cybrary free content
A large free library covering fundamentals, Linux, networking and certification prep.
cybrary.it
Webcasts · Cheat sheets
SANS free resources
Free webcasts, posters, cheat sheets and white papers from SANS instructors.
sans.org
02 · Practise
Hands-on labs and CTFs
Safe, legal environments to attack, defend and investigate. Pick one and stick with it.
Guided · Beginner friendly
TryHackMe
Browser-based rooms that walk you from zero to junior analyst. No setup needed.
tryhackme.com
Offensive
Hack The Box
Compromise vulnerable machines. Starting Point and some Academy modules are free.
hackthebox.com
Blue team · SOC
CyberDefenders
Investigate real attack data: SIEM, logs, DFIR and threat hunting, as a SOC analyst would.
cyberdefenders.org
CTF · Carnegie Mellon
CyLab Security Academy
The new home of picoCTF: free challenges from beginner to advanced.
cylabacademy.org
Cyber range
RangeForce Free Edition
Realistic incident simulations and defensive labs in the browser.
rangeforce.com
Linux · Wargames
OverTheWire
Free command-line wargames. Start with Bandit to get comfortable with Linux.
overthewire.org
03 · Stay current
News, research and podcasts
Security changes daily. One source from each column is plenty.
News
- The Hacker NewsBreaking news
- BleepingComputerMalware and incidents
- Krebs on SecurityInvestigations
- Dark ReadingIndustry analysis
- SANS NewsBitesCurated, with expert comment
Research blogs
- Microsoft Security BlogThreat intelligence
- Google Cloud Security & IdentityCloud security
- Google Threat Intelligence (Mandiant)APT research
- CrowdStrike BlogAdversary tracking
- IBM Think: SecurityExplainers
Podcasts
- Darknet DiariesTrue hacking stories
- Risky BusinessWeekly news and analysis
- SANS Internet StormcastDaily, five minutes
Prefer one email?
The Monday Brief does the reading for you
Patches, active threats and UAE & GCC regulation news, every Monday in ten minutes.
04 · Lead
Frameworks for managers and CISOs
The references I use to structure security programmes and explain risk to boards.
Framework
NIST Cybersecurity Framework 2.0
The common language for structuring a programme and reporting risk to leadership.
nist.gov
Controls
CIS Critical Security Controls
A prioritised list of safeguards. The best place to start when budget is tight.
cisecurity.org
Standard · Guide
ISO/IEC 27001: a practical introduction
My plain-English guide to the controls, requirements and implementation.
cybermentor365.com
Threat model
MITRE ATT&CK
How real attackers operate, technique by technique. Map your detections to it.
attack.mitre.org
Patch priority
CISA Known Exploited Vulnerabilities
CVEs exploited in the wild. If it is on this list, patch it first.
cisa.gov
Architecture
Microsoft Zero Trust guidance
Principles and a practical path to zero trust for modern environments.
microsoft.com
UAE & GCC
Local regulation
Regulator
UAE Cyber Security Council
National strategy, policies and guidance from the UAE’s cyber security authority.
csc.gov.ae
Privacy
UAE data protection laws
Official overview of the PDPL and the free-zone data protection regimes.
u.ae
Free toolkit
UAE IAS readiness checklist
My self-assessment against the UAE IAS control families, free with the Monday Brief.
cybermentor365.com
05 · Home lab
Free tools to build and break things
Use them only on networks and systems you own or are allowed to test.
Network analysis
Wireshark
See exactly what crosses the wire. Essential for learning protocols and spotting attacks.
wireshark.org
Threat hunting
Security Onion
A free Linux distribution for network monitoring, hunting and log management.
securityonionsolutions.com
Live threat maps for presentations and classrooms: Check Point Live Threat Map · Kaspersky Cyberthreat Map.
Not sure where to start?
Tell me your role and goal, and I will suggest a path
Career changers, analysts and new security managers all start in different places.