A Complete Guide to Learning Cybersecurity from Scratch: A Three-Stage Framework from Beginner to Practitioner

The Current State of Cybersecurity: Talent Gap and Career Opportunities

As digitalization accelerates, cloud adoption becomes mainstream, and AI technology sees widespread application, the importance of cybersecurity is being elevated to unprecedented heights. A recently published 100-episode cybersecurity tutorial series on Bilibili has attracted considerable attention from zero-experience learners. Its core argument is: Not only is now still a good time to enter the cybersecurity field — it may actually be a critical window where opportunity and challenge coexist.

This assessment is well-founded. According to the 2023 Cybersecurity Workforce Study published by ISC² (International Information System Security Certification Consortium), the global cybersecurity talent gap has reached nearly 4 million, with the Asia-Pacific region facing the most severe shortage. Domestically, data from China's Ministry of Industry and Information Technology shows that the country's cybersecurity talent gap exceeds 1.4 million. With the implementation of the "three-law framework" — the Cybersecurity Law, Data Security Law, and Personal Information Protection Law — compliance-driven security positions continue to expand. The Cloud Migration trend has dissolved traditional network perimeters, and new directions like zero-trust architecture and cloud-native security are creating a wealth of new roles. Meanwhile, the proliferation of AI large language models has introduced entirely new attack surfaces such as prompt injection attacks and model poisoning, further amplifying the structural shortage of security talent.

From an industry perspective, the security talent gap has persisted for years, especially in hands-on roles like web security and penetration testing, where professionals with a complete knowledge framework and practical skills remain in high demand. For tech enthusiasts looking to make a career transition, the value of a systematic learning path is therefore more apparent than ever.

Interestingly, the tutorial's author re-examined the field from the perspective of a "cybersecurity beginner." After spending a month browsing various cybersecurity tutorials, he concluded that the available content was "a mixed bag — hard to digest and even harder to summarize." This observation precisely highlights a pain point in current security education — information overload combined with a lack of systematic structure. Zero-experience learners often face a sea of resources without knowing where to start, ultimately falling into the trap of inefficient, fragmented learning.

A Three-Stage Framework for Systematic Cybersecurity Learning

The most valuable aspect of this tutorial series is its decomposition of cybersecurity knowledge into three progressive stages: Fundamentals, Intermediate, and Practical Application. This layered structure serves as a useful reference for anyone looking to enter the security field.

Fundamentals: Lab Environment Setup and Core Concepts

The foundational stage focuses on setting up a cybersecurity lab environment and understanding basic concepts, common attack methods, and defense strategies. This step may seem simple, but it is critically important. Without a secure local lab environment, learners can easily conduct unauthorized activities on real networks, crossing legal boundaries.

Therefore, starting with virtual machines and practice range environments — and establishing a mindset of "isolated practice" — is the responsible way to begin. The two most commonly used tools are DVWA and Kali Linux. DVWA (Damn Vulnerable Web Application) is a PHP/MySQL-based web application intentionally built with multiple security vulnerabilities, including SQL injection, XSS (cross-site scripting), file upload, command injection, and over ten other common vulnerability types. It offers four security levels — Low, Medium, High, and Impossible — allowing learners to progressively understand vulnerability principles and exploitation techniques. Kali Linux is a Debian-based Linux distribution specifically designed for penetration testing, maintained by the Offensive Security team, and pre-loaded with over 600 security tools covering the entire workflow from information gathering (e.g., Nmap) to vulnerability scanning (e.g., Nikto), password cracking (e.g., John the Ripper), and wireless attacks (e.g., Aircrack-ng). Using both together within a local virtual machine (typically VMware or VirtualBox) to build an isolated network creates a complete "attacker machine + target machine" lab environment that is both safe and efficient.

Intermediate: Protocol Analysis, Vulnerability Discovery, and Cryptography

After mastering the fundamentals, the intermediate stage covers network protocol analysis, system vulnerability discovery, and cryptography. These three areas represent the "internal martial arts" of security expertise:

• Network protocol analysis helps you understand how data flows across networks and forms the foundation for packet capture analysis and traffic auditing. Specifically, protocol analysis involves capturing and parsing network packets to understand the interaction between communicating parties, data formats, and potential security risks. The most commonly used tool is Wireshark, which can capture all traffic on a network interface in real time and decode it layer by layer according to the OSI seven-layer model or the TCP/IP four-layer model. In security contexts, protocol analysis can detect man-in-the-middle attacks (MITM), DNS hijacking, ARP spoofing, and other threats. It is also a core daily skill for intrusion detection system (IDS) operators and security operations center (SOC) analysts. A deep understanding of protocol details — such as the TCP three-way handshake, HTTP request-response flow, and TLS handshake process — is a prerequisite for traffic auditing and anomaly detection.

• System vulnerability discovery is the core skill of penetration testing and requires deep knowledge of operating systems and web applications. Vulnerability discovery generally follows two main paths: white-box auditing and black-box testing. White-box auditing involves code review with access to source code, identifying logic errors, input validation flaws, and access control vulnerabilities using static analysis tools such as Fortify and SonarQube. Black-box testing simulates an external attacker's perspective, using techniques like fuzzing, port scanning, and fingerprinting to find exploitable attack surfaces without knowledge of the system's internal implementation. Notably, the OWASP (Open Web Application Security Project) Top 10 vulnerability list is the authoritative reference in web security. The 2021 edition placed Broken Access Control as the top threat, dethroning injection-class vulnerabilities that had long held the number one position — reflecting the evolving attack landscape.

• Cryptography determines whether you can understand the underlying security mechanisms of encryption, decryption, and authentication. Cryptography provides the mathematical foundation of cybersecurity, covering symmetric encryption (e.g., AES-256), asymmetric encryption (e.g., RSA, ECC — Elliptic Curve Cryptography), hash functions (e.g., SHA-256), and digital signatures. Symmetric encryption is fast but faces the key distribution problem; asymmetric encryption solves the key exchange challenge but incurs higher computational costs. In practice, both are typically used in combination — for example, the TLS handshake in HTTPS first uses asymmetric encryption to negotiate a session key, then uses symmetric encryption for data transmission. Understanding cryptography not only helps in analyzing the security of encryption protocols but also serves as the foundation for understanding cutting-edge technologies like blockchain, digital certificates, and zero-knowledge proofs. In recent years, Post-Quantum Cryptography has become a research hotspot. NIST officially published its first batch of quantum-resistant encryption standards in 2024, which will profoundly impact the architectural design of future security systems.

From an educational perspective, the intermediate stage is often where learners get "stuck." Knowledge density increases sharply, and abstract concepts multiply. The tutorial author mentions providing accompanying mind maps to aid learning, which is indeed an effective strategy for tackling complex knowledge systems — using visual structures to reduce cognitive load.

Practical Application: From Penetration Testing Theory to Monetizable Skills

The practical stage includes network attack-and-defense exercises, security detection, data encryption and decryption, and other hands-on operations. The tutorial emphasizes "transforming theoretical knowledge into practical application" and even mentions "monetization" as a goal.

For security professionals, practical ability is indeed the core competitive advantage for employment and career development. Whether it's internal security operations, outsourced penetration testing, or Bug Bounty programs, solid hands-on skills are essential.

Bug bounty programs are mechanisms where enterprises publicly authorize independent security researchers to test their systems within a defined scope, offering cash or other rewards for valid vulnerabilities discovered. The world's best-known bug bounty platforms include HackerOne and Bugcrowd, and tech giants like Google, Microsoft, and Apple also operate their own bounty programs. According to HackerOne's data, as of 2023, the platform has cumulatively paid out over $300 million in bounties, with single critical vulnerability rewards reaching tens or even hundreds of thousands of dollars. In China, the Butian Vulnerability Response Platform and Vulbox are the primary vulnerability submission channels. Bug bounty programs are not only a "learn by doing" income source for security practitioners but also an important way to accumulate real-world experience and build industry reputation.

Additionally, CTF (Capture The Flag) competitions are the most mainstream skill contests in the cybersecurity field and serve as an important platform for validating practical abilities. Participants solve a series of challenges spanning web security, reverse engineering, cryptography, digital forensics, binary exploitation (Pwn), and other domains to capture flags. Internationally renowned competitions include DEF CON CTF and Google CTF, while domestically, notable events include the Qiangwang Cup, XCTF League, and Huwang Cup. CTF competitions are not only a stage for testing security skills but also a highly recognized credential in the job market — many security companies directly scout and recruit talent at CTF events.

The closed loop between theory and practice is the critical leap from "having learned" to "being able to apply."

Evaluating Cybersecurity Learning Resources and Support Materials

This course series also provides supplementary materials, including lab environment setup resource packages, a zero-to-one learning plan, e-books, courseware, and more.

From a learning methodology perspective, a complete set of supplementary resources can significantly improve learning efficiency. For beginners, video content alone is often insufficient — they also need reproducible environments, a clear roadmap, and documentation they can reference repeatedly. This also reminds us that when selecting any introductory cybersecurity tutorial, we should focus on evaluating:

1. Whether it provides hands-on practice range environments;
2. Whether it offers a clear learning path;
3. Whether it includes accompanying notes or knowledge maps to aid retention.

A Realistic Perspective: Easy to Start, Hard to Master

It should be pointed out objectively that any tutorial claiming to "easily turn you into an expert" warrants a healthy dose of skepticism. Cybersecurity is a field with both depth and breadth. A single summer break can be enough to build a solid foundation and establish a framework, but truly becoming an expert requires long-term practical experience and continuous learning.

More importantly, there are legal and ethical boundaries to respect. All security techniques should be applied only in legally authorized scenarios, such as internal enterprise testing, CTF competitions, and authorized penetration testing. Attacking someone else's system without authorization — regardless of how skilled you are — is illegal. In China, Article 285 ("Crime of Illegally Intruding into Computer Information Systems") and Article 286 ("Crime of Destroying Computer Information Systems") of the Criminal Law provide clear provisions on this matter, with violations potentially resulting in prison sentences of three years or more. This point should be repeatedly emphasized in any introductory tutorial.

Conclusion: Choosing the Right Cybersecurity Learning Path

The cybersecurity field presents both opportunity and barriers to entry. The value of this Bilibili tutorial series lies not in any promise of "fast-tracking" your career, but in providing a systematic, progressively layered learning framework — from environment setup to core technologies, and finally to practical application and monetization. For learners who are genuinely committed to entering this field, choosing a learning path that is well-structured, practice-oriented, and compliance-focused is far more important than chasing the label of "the most comprehensive tutorial."

The value of technology ultimately depends on the intent of the person using it. May every learner master their skills while holding firm to ethical principles, becoming a true "white hat" professional in every sense of the word.