From Hacking the Workforce
Not sure which of these to start with?
Four taps and you get a personal roadmap: where you are, what's in your way, and three moves for the next 30 days.
Resources · The Plug
The Plug: free ways to learn cybersecurity, sorted for you.
91 courses, labs, podcasts, communities and standards our team actually recommends. Pick who you are and we'll show what fits, plus where we can help you go faster.
Last reviewed November 2026. Free offers change; check each site before you sign up.
ISC2 Certified in Cybersecurity (CC) (opens in a new tab)
The entry-level certification we point most beginners to first. Exam $199 plus $50 a year. The free-voucher program closed May 20, 2026.
Cisco Networking Academy: Introduction to Cybersecurity (opens in a new tab)
A short, free first course, with longer certification-aligned paths after it. Available in English, Spanish and more.
Google Cybersecurity Certificate (opens in a new tab)
Eight self-paced courses aimed at a first analyst job. Runs on a Coursera subscription; check the current price.
IBM SkillsBuild (opens in a new tab)
Free cybersecurity analyst learning paths with digital credentials.
Microsoft Learn: security training (opens in a new tab)
Free modules on identity, cloud and security operations in Microsoft environments.
Microsoft Azure Fundamentals (AZ-900) (opens in a new tab)
Free training, paid exam. A good first cloud credential.
From Hacking the Workforce
Too many tabs open? Study with us.
Our free study hall: a live call where people work through courses like these side by side.
Microsoft CISO Workshop (opens in a new tab)
Free videos and decks on running a modern security program. Useful for managers and aspiring leaders.
AWS Skill Builder (opens in a new tab)
Self-paced AWS training, including cloud security. Many courses are free.
AWS Workshops (opens in a new tab)
Step-by-step AWS workshops you run in your own account. Watch your bill and shut things down.
AWS Builder Center (community.aws) (opens in a new tab)
Community articles and project walk-throughs from people building on AWS.
Fortinet Training Institute (opens in a new tab)
Free self-paced network security courses, from awareness to firewall essentials.
Elastic training (opens in a new tab)
Courses on the Elastic Stack, a common SIEM in security operations. Several are free.
SANS free resources (opens in a new tab)
Free webcasts, posters, white papers, tools and cyber ranges from SANS.
SANS Cloud Diversity Academy (opens in a new tab)
Fully funded cloud security training and certifications for eligible applicants. Check eligibility and dates.
From Hacking the Workforce
Turn a pile of links into a plan
30 minutes with Dr. Safi. Bring your goal; leave with the three resources that matter for you and a 30-day plan. $75.
NICCS (CISA): careers map and training catalog (opens in a new tab)
See what each cybersecurity role does and search a national catalog of free and paid courses.
Cybrary (opens in a new tab)
IT and security courses with a free tier and paid labs.
freeCodeCamp (opens in a new tab)
Free coding lessons. Basic scripting makes every security job easier.
Hopper's Roppers (opens in a new tab)
A free, community-built set of beginner security courses.
Introduction to Software Security (University of Wisconsin) (opens in a new tab)
Free course on secure design, secure coding and vulnerability assessment.
APIsec University (opens in a new tab)
Free courses on API security, one of the fastest-growing attack surfaces.
AttackIQ Academy (opens in a new tab)
Free courses on threat-informed defense and MITRE ATT&CK, taught by practitioners.
CDSE cybersecurity catalog (opens in a new tab)
Free U.S. government security awareness and training: videos, games, posters and courses.
TryHackMe (opens in a new tab)
Guided browser-based labs from total beginner to advanced. Many rooms are free.
LetsDefend (opens in a new tab)
Blue-team practice: work alerts in a simulated SOC.
From Hacking the Workforce
Studying for an exam?
One-on-one tutoring with the Alcorn Method: your exam broken into small, checkable steps. $60 an hour.
PortSwigger Web Security Academy (opens in a new tab)
Free, high-quality web application security labs.
Hacker101 (opens in a new tab)
Free web security lessons and capture-the-flag levels from HackerOne.
PentesterLab (opens in a new tab)
Exercises from basic bugs to advanced vulnerabilities. Some free, most paid.
picoCTF (opens in a new tab)
A free capture-the-flag game from Carnegie Mellon, built for middle and high school students and great for adult beginners too.
HackerOne (opens in a new tab)
Bug bounty platform: find real vulnerabilities in programs that invite you, and get paid.
The Bug Hunter Handbook (opens in a new tab)
A free reference on bug hunting methodology.
Bug bounty methodology by XSSRat (opens in a new tab)
A practical introduction to getting started in bug bounty.
PenTips by CSbyGB (opens in a new tab)
Free pentesting notes, including API testing labs.
Labtainers (Naval Postgraduate School) (opens in a new tab)
Over 50 free Linux-based labs with automatic grading. Built for instructors.
CyberCIEGE (Naval Postgraduate School) (opens in a new tab)
A free network security simulation game for high school through graduate classes.
From Hacking the Workforce
Need training and the exam paid for?
ACCESS Granted: sponsored training, an ISC2 exam and a coach, then a registered apprenticeship. Join the waitlist.
Darknet Diaries (opens in a new tab)
True stories from the dark side of the internet. The podcast that gets many people hooked.
CyberWire Daily (opens in a new tab)
Daily cybersecurity news in about 20 minutes.
Hacking Humans (opens in a new tab)
Social engineering and scams, explained through real cases.
Risky Business (opens in a new tab)
Weekly security news and analysis for practitioners.
Security Now (opens in a new tab)
A long-running weekly deep dive into security news and how the technology works.
Smashing Security (opens in a new tab)
Security news with a sense of humor.
Malicious Life (opens in a new tab)
The history of cybersecurity, told as stories.
Unsupervised Learning (opens in a new tab)
Where security, technology and society meet.
Simply Cyber (Gerald Auger, PhD) (opens in a new tab)
Daily news briefs and career advice for people breaking into cyber.
Professor Messer (opens in a new tab)
Free full video courses for CompTIA A+, Network+ and Security+.
Josh Madakor (opens in a new tab)
Home labs and career advice for getting into cybersecurity.
HackerSploit (opens in a new tab)
Hands-on tutorials for penetration testing and blue-team tools.
From Hacking the Workforce
Ready for the next role?
60 minutes on your resume, LinkedIn and portfolio, interview practice, and a 90-day plan. $135.
Day Cyberwox (opens in a new tab)
Cloud security careers and projects.
KeepItTechie (opens in a new tab)
Linux and IT career content for people starting out.
Kevtech IT Support (opens in a new tab)
What help desk and IT support work really looks like.
TechTual Chatter (opens in a new tab)
IT and security career talk.
Zero to IT Hero (Master I.T.) (opens in a new tab)
Getting your first IT job, step by step.
IT Career Questions (opens in a new tab)
Answers to common questions about starting an IT career.
Women in Linux (opens in a new tab)
Linux, cloud and career content from a welcoming community.
Teach2Geek (opens in a new tab)
Beginner-friendly tech and security lessons.
Tech Gee (opens in a new tab)
Tech career journeys and advice.
Struggle Security (opens in a new tab)
Honest talk about breaking into security.
ProfessorBlackOps (opens in a new tab)
Cybersecurity for the people.
SekureNet (opens in a new tab)
Cybersecurity basics and career content.
From Hacking the Workforce
Free courses don't change staff behavior on their own
Our 4C digital self-defense workshops train your team live, in plain language, and leave you with a 90-day plan. Start with a free 30-minute call.
Ethically Hacking Space (opens in a new tab)
Security for space systems and satellites.
Bug bounty resources by Farah Hawa (opens in a new tab)
A video tour of the best free bug bounty learning resources.
Apprenticeship.gov (opens in a new tab)
The U.S. Department of Labor's search for registered apprenticeships, including cybersecurity.
Women in CyberSecurity (WiCyS) (opens in a new tab)
Membership community with conferences, scholarships and mentoring.
Blacks in Cybersecurity (BIC) (opens in a new tab)
Community and conferences celebrating Black professionals in cyber.
Cyversity (opens in a new tab)
Mentoring and community for underrepresented people in cybersecurity.
#ShareTheMicInCyber (opens in a new tab)
Amplifies Black voices in cybersecurity, with scholarships and events.
TransTech Social Enterprises (opens in a new tab)
Community, training and the TransTech Summit for trans and gender-nonconforming people in tech.
From Hacking the Workforce
Start with the 4C Quickstart
Four pages, one per practice, each with a 30-minute action. Free to use and share with your staff.
Out in Tech (opens in a new tab)
A large LGBTQ+ tech community with mentoring and job resources.
Lesbians Who Tech and Allies (opens in a new tab)
Community and scholarships, including the Edie Windsor Coding Scholarship. Check when applications open.
Cybersecurity Gatebreakers (opens in a new tab)
A nonprofit helping people close the gap into cybersecurity jobs.
Teneika Askew on LinkedIn (opens in a new tab)
Shares free training and job opportunities often. Worth a follow.
Awesome Security GRC (GitHub) (opens in a new tab)
A curated list of governance, risk, compliance and audit resources.
NIST Cybersecurity Framework (CSF) 2.0 (opens in a new tab)
The common language for managing cybersecurity risk. Start here for GRC.
NIST Risk Management Framework (opens in a new tab)
The federal process for selecting, assessing and authorizing controls.
NIST SP 800-30: Guide for Conducting Risk Assessments (opens in a new tab)
How to run a risk assessment, step by step.
From Hacking the Workforce
Bring cybersecurity to your school
The 4C model for schools: classroom activities by grade band, plus live sessions for students, staff and families.
NIST SP 800-53: Security and Privacy Controls (opens in a new tab)
The full federal control catalog. 800-53B (baselines) and 800-53A (assessment) are linked from the same page.
NIST SP 800-161: Supply Chain Risk Management (opens in a new tab)
Managing cybersecurity risk from vendors and suppliers.
CIS Critical Security Controls (opens in a new tab)
A prioritized set of safeguards. The Implementation Group 1 list is a strong starting point for small teams.
PCI DSS (opens in a new tab)
The security standard for anyone who stores, processes or transmits card data.
ISO/IEC 27001 (information security management) (opens in a new tab)
The international standard for an information security management system. Overview free; the standard is sold by ISO.
ISO 31000 (risk management) (opens in a new tab)
Risk management principles and guidelines. Overview free; the standard is sold by ISO.
ISO 22301 (business continuity) (opens in a new tab)
Business continuity management systems. Overview free; the standard is sold by ISO.
BSI IT-Grundschutz (Germany) (opens in a new tab)
Germany's free security standards, including 200-1 (ISMS) and 200-4 (business continuity).
From Hacking the Workforce
Plan a school session with us
A free 30-minute call to plan an assembly, class block or family night.
ISACA IT Audit Framework (ITAF) (opens in a new tab)
Professional practices for IT audit and assurance.
CISA Secure Our World (opens in a new tab)
Four plain-language habits for everyone: strong passwords, MFA, updates and spotting phishing.
Wizer Security Awareness Training (opens in a new tab)
Short awareness videos and quizzes for staff, with a free plan.
Amazon Security Awareness Training (opens in a new tab)
A free short course on phishing, passwords, data handling and physical security.
CYBER.ORG (opens in a new tab)
Free K-12 cybersecurity curriculum and teacher training, funded by CISA.
NCyTE Center curriculum (opens in a new tab)
Free cybersecurity curriculum for high school and college instructors.
From Hacking the Workforce
Something already went wrong?
The Cyber Clinic gives free, one-on-one help when you've been hacked, scammed or locked out.
CLARK Center (opens in a new tab)
A free library of peer-reviewed cybersecurity curriculum.
CodeHS Cybersecurity (opens in a new tab)
Cybersecurity courses for middle and high school classrooms.
Palo Alto Networks Cybersecurity Academy (opens in a new tab)
Free curriculum, labs and instructor resources for schools and colleges.
Nothing matches yet. Clear a filter, or build your roadmap and we'll point you to the right three.