Last reviewed: 2026-10-03
A free, ordered path from no experience to your first security role. Each phase has a time estimate, a short list of free resources and a checkpoint, so you know when to move on.
AquilaCyber is a community-driven cybersecurity learning initiative for people across Africa and beyond. This repository is its Intro to Cyber programme. It is written with Nigerian learners in mind: low-spec laptops, limited data and local regulation. It works for anyone, anywhere.
Website: aquilacyber.org
Open the roadmap and begin with phase 1.
| Phase | What you do | Time at 8 to 10 hours a week | Move on when |
|---|---|---|---|
| 1. Foundations | Networking, Linux, core security concepts, basic scripting | 6 weeks | You can explain how a web request travels and work in a Linux terminal without help |
| 2. Hands-on | Build a lab, finish a guided path, write up what you solve | 10 weeks | You have finished one full guided path and published three write-ups |
| 3. Pick a track | Blue team, red team or GRC, or a specialist track: cloud, forensics, application security or identity | 12 weeks | You have two portfolio projects in one track |
| 4. Get hired | Portfolio, CV, certification, applications | Ongoing | You are applying and getting interviews |
Most people need six to nine months at that pace before they apply for entry-level roles. Some need longer. That is normal.
If you want a day-by-day schedule for the first three months, use the 90-day study plan.
- Security domains: eleven short introductions. Read them after phase 1 and before you choose a track.
- Lab setup: hardware you need, what to do without a laptop, how to save data.
- Ethics and law: read this before you run any scanning or attack tool.
- Nigeria guide: the regulators, the employers and the local rules that create demand for security work.
| Folder | Contents |
|---|---|
| roadmap/ | The four phases |
| domains/ | Short introductions to eleven areas of security: network, endpoint, cloud, IoT, cryptography, threat modeling, incident response, forensics, threat intelligence, offensive security and GRC |
| tracks/ | Plans for blue team, red team and GRC |
| guides/ | Lab setup, ethics, Nigeria, Linux, Windows and Active Directory, network security, the Defenders Portal, certifications, frameworks, glossary, FAQ, 90-day plan, checklist |
| templates/ | Write-up, penetration test report, risk register, NDPA gap checklist and CV |
| careers/ | Profiles of 37 security roles |
| resources/ | Short lists of books, courses, news, podcasts, YouTube channels and practice labs |
| reference/ | Large third-party lists kept for lookup. Not part of the beginner path |
AquilaCyber runs its own free capture the flag platform, the Defenders Portal. It has ten web security labs and a three-stage investigation. Register for an account on the site and start with the Defenders Portal guide, which gives a suggested order. Use it alongside the labs in phase 2.
Join through aquilacyber.org. The community page lists the WhatsApp community, X and LinkedIn, the Hack It Together mentorship programme and how to ask for help.
Found a dead link or a wrong fact? Open an issue. Want to add a resource or a page? Read CONTRIBUTING.md first. Credits for third-party material are in CREDITS.md.
Original content in this repository is released under CC BY 4.0. Third-party material under reference/ keeps the licence of its author. See CREDITS.md.