Beginner, SOC, pentest, governance or cloud: which certifications to target at each stage in 2026, with the prerequisites and experience to plan for.
In 2026, a cybersecurity certification path is built in three stages: shared foundations (networking and general security), then a specialization tied to your job (defense, pentesting, governance or cloud), and finally an expert-level certification once your experience allows it. There is no universal order, but each profile follows a fairly consistent logic. This guide sets out a roadmap by profile, with the prerequisites and experience requirements to plan for.
Before you choose: three questions to ask yourself
A certification is valuable when it matches a target role and builds on real-world practice. Before you register, clarify three points.
Which role are you aiming for in the next two or three years: network operations, SOC analyst, auditor, penetration tester, security manager, cloud architect?
What experience can you document today? Several advanced certifications require a set number of years of documented experience, verified after the exam.
Is your environment tied to a vendor (Microsoft, Fortinet, Palo Alto, Check Point, AWS)? If so, a vendor certification is a useful complement to a vendor-neutral one.
Also bear in mind that exam objectives change. Several exams move to a new version in 2026, which may influence when you sit the exam.
Beginner: laying the foundations
If you are just starting out or coming from IT support, the goal is to master networks, systems and the basics of security.
CompTIA Network+: networking fundamentals, useful before any specialization.
Cisco CCNA: a more infrastructure-oriented alternative, relevant if you work with Cisco equipment.
CompTIA Security+: the general entry-level security certification. CompTIA recommends holding Network+ and having around two years of administration experience with a security component. The SY0-701 exam has a maximum of 90 questions (multiple-choice and performance-based) in 90 minutes. CompTIA has announced a V8 version for around November 17, 2026, and the English version of SY0-701 is due to retire on June 11, 2027.
Microsoft SC-900: an introduction to security, compliance and identity concepts in the Microsoft ecosystem.
At this stage, focus on a single general certification and spend the rest of your time on hands-on labs.
Network and security administrator
For an administrator who manages firewalls, VPNs and segmentation, two tracks complement each other.
A vendor-neutral track: EC-Council's CND (Certified Network Defender) covers network defense using a protect, detect, respond and predict approach. The 312-38 exam has 100 questions in 4 hours.
A vendor track: Fortinet, Palo Alto Networks or Check Point certifications validate expertise on a specific platform. To structure this side, see our article on Fortinet certifications in 2026 and our PCNSE guide.
Security+ remains a good starting point if you do not yet hold any security certification.
SOC and blue team
The SOC analyst role requires the ability to detect, triage and handle incidents. The typical path progresses as follows:
Level 1: Security+ or Cisco's CCNA Cybersecurity (exam 200-201), focused on security operations.
Level 2: EC-Council's Certified SOC Analyst (C|SA), then the Microsoft SC-200 certification if your SOC uses Microsoft Sentinel and Defender. Microsoft has announced an update to the English version of the SC-200 exam on October 21, 2026; check the study guide before you start preparing.
Level 3: CompTIA CySA+, whose CS0-004 version has been available since June 23, 2026. CompTIA recommends around four years of experience as a SOC analyst or vulnerability analyst, which makes it an intermediate-to-advanced certification.
Specializations: incident handling (E|CIH), threat intelligence (C|TIA), digital forensics (CHFI) or SIEM tools such as Splunk.
Pentesting and red team
Penetration testing requires a solid grounding in systems, networks and web technologies before any offensive certification.
First step: EC-Council's CEH v13, which gives a broad view of attack techniques, or CompTIA PenTest+ for an approach more focused on methodology and reporting.
Hands-on step: OffSec's OSCP+, whose proctored exam lasts nearly 24 hours and involves compromising real machines and then writing a report.
Going further: EC-Council's CPENT or specialized certifications (web, Active Directory, cloud).
The choice between CEH and OSCP+ depends on your level and your goal; we cover it in detail in our CEH vs OSCP+ comparison.
Governance, CISO and audit
Governance, compliance and audit profiles rely on standards and management certifications.
ISO/IEC 27001 Lead Implementer and Lead Auditor (PECB): to implement or audit an information security management system. The full Lead Implementer or Lead Auditor credential requires five years of professional experience, including two in security management, plus 300 hours of project or audit work; a Provisional level is available as soon as you pass the exam.
ISO/IEC 27005 and EBIOS Risk Manager: for risk management.
ISACA CISA for information systems audit, CRISC for IT risk.
ISACA CISM and ISC2 CISSP for security managers, two certifications that each require five years of experience. Our article CISSP vs CISM will help you decide.
EC-Council's C|CISO for executive security roles.
If your organization falls under NIS 2 or DORA, dedicated training on these regulations is a useful addition to this path; see our article on NIS 2 and DORA obligations.
Cloud security
Cloud security lends itself to a two-level path.
The Cloud Security Alliance's CCSK v5: an open-book online exam with 60 questions in 120 minutes and no experience requirement. It provides a vendor-neutral foundation.
Cloud provider certifications: AWS Certified Security – Specialty, Google Professional Cloud Security Engineer or the Azure security certifications, depending on the platform you use.
ISC2's CCSP: the advanced certification, which requires five years of cumulative IT experience, including three in information security and one in one of its six domains. The CCSK can count for one year of experience in the CCSP domains, and an active CISSP satisfies the entire requirement.
Experience requirements to plan for
A common mistake is to aim for a certification whose full credential you will not be able to obtain. Here are the points to watch:
CISSP: five cumulative years in at least two of the eight domains; without this experience, passing the exam earns you Associate of ISC2 status.
CISM: five years of security management experience covering at least three of the four domains, gained within the ten years preceding the application.
CCSP: five years in IT, including three in security.
CEH: official training or, failing that, two years of IT security experience with an eligibility application.
ISO 27001 Lead Implementer or Lead Auditor (PECB): five years of experience and 300 hours of activities; the Provisional and intermediate levels let you start earlier.
Training with Securevalley
Securevalley Training is a PECB Authorized Silver Partner and an EC-Council Authorized Reseller. For other vendors and certification bodies, our courses are certification preparation. Here are a few entry points depending on your profile:
Which certification should I start with in cybersecurity?
If you already have networking basics, CompTIA Security+ is a general starting point. If networking concepts are still unclear to you, start with Network+ or the CCNA.
Can you take the CISSP without five years of experience?
Yes, the exam is open to all. If you pass without the required experience, you obtain Associate of ISC2 status and have six years to gain the missing experience.
Should you favor a vendor-neutral or a vendor certification?
The two are complementary. A vendor-neutral certification validates transferable concepts; a vendor certification proves your mastery of a product used by your employer or your clients.
How many certifications should you aim for per year?
There is no rule. One well-prepared certification applied in your daily work is worth more than several obtained without practice.
Conclusion
A good path starts from your target role, builds on solid foundations and progresses at the pace of your experience. Choose your next step based on your current position, check which exam version is in effect and set aside time for practice: that is what gives a certification its weight.