How to become a penetration tester in 2026: the realistic path

Short answer: expect 12 to 24 months from zero. Learn networking, Linux, Windows and Active Directory, and Python first — then attack techniques. Most people are hired on demonstrated work: a home lab, a handful of documented engagements against legal targets, and one report a stranger can read. A degree is not required; the ability to write is.

Offensive security attracts people for good reasons — the work is technical, useful, and well paid — and for bad ones, sustained by videos where somebody "hacks the Pentagon" in three minutes. This is the path as it actually looks, including the parts that are slow.

What does a penetration tester actually do?

Roughly 40 percent of the job is finding vulnerabilities. The other 60 percent is scoping the engagement, staying inside the authorised perimeter, taking notes that will survive a dispute, and writing a report that a developer and an executive can both act on.

That ratio surprises people, and it explains why the best-paid testers are rarely the ones who know the most exploits. They are the ones whose reports cause things to actually get fixed.

Three adjacent roles get confused constantly:

• Penetration tester — simulates attacks inside an authorised scope, on a schedule, to produce findings the client can remediate.
• Red teamer — emulates a real adversary across the whole attack surface, including people and physical access. Longer engagements, stealthier, and far fewer positions.
• SOC analyst / blue team — detects and responds to real attacks, continuously. Often the actual door into the industry, and a much better teacher than any course.

Many beginners aim straight at red teaming. That is like aiming for surgery before general medicine: possible, rarely the fastest route.

The foundations that cannot be skipped

Attack techniques make no sense without these, and this is where the year goes:

Networking. TCP/IP, routing, NAT, DNS, HTTP, TLS. You must be able to read a packet capture. Without it, half of an Nmap output is noise you cannot interpret. Our Wireshark course is free with an account and exists precisely for this gap.

Linux. Command line, permissions, processes, services, SUID, cron. A tester spends the day in a terminal.

Windows and Active Directory. Most internal engagements are Windows estates. Authentication protocols, ACLs, tickets, LSASS, GPOs. This is the single highest-value area in the whole list, because it is where most real compromises happen — and where most beginners are weakest. Windows Fundamentals covers the ground before the attacks do.

One language, and it should be Python. To automate, to read a public exploit before running it, and to modify tooling instead of waiting for someone else to.

Budget six months to a year for this if you start from zero. It is not lost time: it is the part that makes you useful once hired.

Then, and only then, attack techniques

With the foundations in place, the offensive layer goes quickly:

1. Methodology. Scoping, reconnaissance, enumeration, exploitation, post-exploitation, reporting. A repeatable process is what separates a professional from someone running tools. The free penetration testing course walks the full cycle, from the legal scoping of an engagement to the report handed to the client.
2. Reconnaissance and enumeration. This is where engagements are won. Nmap in depth is free with an account, and depth here pays more than any exploit.
3. Web. The OWASP Top 10 with real payloads, then the layer above it — authentication chains, SSRF, access control at scale. Web Hacking is the structured version.
4. Active Directory. Kerberoasting, AS-REP roasting, ACL abuse, delegation, DCSync. Active Directory Attacks covers the chains as they appear in real internal tests.
5. Post-exploitation and pivoting. Getting a shell is the beginning of the engagement, not the end.

How long does it take?

Where you start	Time to junior pentester
Sysadmin, network or support background	12 to 18 months
Developer	12 to 18 months — web comes fast, infrastructure does not
IT helpdesk	18 to 24 months
No technical background at all	24 to 36 months, and go through IT or a SOC first

The variable that moves these numbers is not intelligence. It is hours per week and whether you finish what you start.

Do I need a degree or certifications?

No degree. Offensive security is one of the least credential-bound corners of the industry, and hiring managers look at what you can demonstrate.

Certifications are a different matter, because they get you past the filter before a human sees anything. The ones that carry weight are the hands-on ones — exams where you compromise machines and write a report, not multiple-choice papers. We compared them in detail in OSCP vs CEH vs PNPT; the short version is that a practical exam plus a portfolio beats three theory certificates.

What the portfolio should contain

Three things, and none of them require an employer:

A home lab you built and broke. A domain controller, two workstations, a vulnerable web application, a segmented network. Attack it, then defend it. Being able to say "I detected my own Kerberoasting in the event log" is worth more in an interview than any badge — and it is the reason Infrastructure Defense is free here alongside the offensive courses.

Documented engagements against legal targets. Practice platforms, deliberately vulnerable applications, and public bug bounty programs are all legal. Anything else is not, and one impulsive scan against a company you do not have written permission to test can end the career before it starts. If you are unsure where that line sits, read how to practise hacking legally before your first scan.

One real report. Executive summary, methodology, findings with severity and business impact, reproduction steps, remediation. Written for two audiences at once. This document is the single best hiring artefact in the field, and almost nobody produces one.

What do penetration testers earn?

In North America, junior roles typically land between 70,000 and 95,000 US dollars, mid-level between 100,000 and 135,000, and senior consultants between 140,000 and 180,000, with specialists in cloud and red team work above that. In Europe the figures are lower in absolute terms and vary enormously by country. Consulting firms pay less than product companies and teach far more in the first two years, which is usually the right trade early on.

The four mistakes that cost a year

Collecting tools instead of understanding protocols. Anyone can run a scanner. Interpreting the output is the job.

Chasing red team work first. The roles barely exist at junior level, and the skills are built in ordinary testing.

Ignoring the writing. Findings nobody acts on are findings that did not happen. Practise writing before you need to.

Testing something you were not authorised to test. No result is worth this. Authorisation is the entire legal basis of the profession, and the document that grants it is worth understanding line by line — see Rules of Engagement, which is in French.

Frequently asked questions

How long does it take to become a penetration tester?

Twelve to eighteen months from an IT, network or development background, and two to three years starting from nothing technical. Most of that time goes into networking, Linux, Windows and Active Directory rather than into attack techniques, which come quickly once the foundations hold.

Do I need a degree to become a pentester?

No. Offensive security hires on demonstrated ability: a home lab, documented practice against legal targets, and a report someone can read. A degree helps with some corporate HR filters and with visas, but it is not a requirement in most of the market.

Which certification should I take first?

A hands-on one where you compromise machines and write a report, rather than a multiple-choice exam. OSCP is the best known, PNPT and CPTS are cheaper and closer to real consulting work. One practical certification plus a portfolio beats three theory certificates. See the full comparison.

What programming language should a pentester learn?

Python first, for automation and for reading public exploits before running them. Add Bash and PowerShell because you will land in those shells constantly, and enough JavaScript to understand web application behaviour. C is useful later, when binary exploitation becomes relevant.

Can I get into penetration testing without an IT job first?

It happens, but it is the slow route. Helpdesk, system administration or a SOC role teaches you how organisations actually work, which is what makes findings useful. Many strong testers spent two years on the defensive side first and consider it an advantage rather than a detour.

Where can I start learning today for free?

The complete penetration testing course here is free with an account — thirteen modules from legal scoping to the final report, with labs and a verifiable certificate — and so are the Nmap, Wireshark and infrastructure defence courses that cover the foundations. Start the free pentest course.

Where to go next

Start with the free penetration testing course for the methodology, and fill the foundations with Nmap and Wireshark, both free with an account. The roadmap shows the whole sequence, from first scan to specialisation.