What should I learn in cybersecurity today?
Too many roadmaps, playlists and resource lists? Stop choosing. Draw one small topic, read for 15 minutes, explain it out loud, and fix only the gaps.
On this page
Do you also feel the same? Open a tab to start studying and you will find about forty things to study before your coffee cools. A roadmap with seven stages. SEVEN! A playlist of sixty-odd videos. A GitHub list of "awesome" resources with its own table of contents. A thread arguing over whether you should start with Linux, networking or Python.
Twenty minutes later you have compared all of them, bookmarked a few, and learned nothing. Plenty of people in this field have done this more often than they would admit, and it is a poor use of the one free hour you had. Stay with this blog to uncover a smarter use of your time than endless "cyber" doomscrolling.
The trouble is the choosing
There is no shortage of good material. The shortage is a starting point. Every time you sit down you have to decide what to learn, and that decision costs more than it looks. It uses up the energy you wanted to spend on the topic itself, and you rarely decide well. Left alone, most of us drift toward whatever feels comfortable: the thing we already half know, or the thing that sounds exciting. For example, SQL injection gets studied again and again. Almost nobody sits down to learn why a session cookie needs the Secure flag.
The small things are where people get caught
Roadmaps list "web security" as a single bullet. The detail underneath that bullet is where you get tested, in interviews and in real incidents. What is the difference between encoding, encryption and hashing? What does SameSite change about a cookie? Why do we salt passwords if the hash is already one-way? What separates a 401 from a 403?
Each of these takes about ten minutes to learn properly. None of them feels like a worthy study session, so they never get picked. Then someone asks you one in an interview and you realise you have been nodding along to the answer for years without being able to give it.
Time to change this. Try one of those now. Answer it out loud in thirty seconds without looking anything up. If you hesitated, you have just found your next study session.
Let something else pick
The fix is almost boring: we take the decision away from you. Choose a field you care about, then draw one topic from it at random. That topic is today's topic, even if it looks too small, too dull or slightly scary. A random draw has no preference for what is comfortable, so it keeps landing on the gaps you would have walked past.
You can try this tonight. Draw a card from cardosec and then do three things in order:
- Read about it for 10 to 15 minutes. Not a whole course, just enough to explain it.
- Set a timer for two or three minutes, close every tab and explain it out loud as if to a friend who has never heard of it.
- Notice where you stalled or waffled. Those spots are what you did not know. Look up only those parts.
The explaining step is the one people skip, and it does the most work. Reading feels like understanding until you have to say the words. Whatever you cannot say plainly, you have not learned yet.
Some days the draw will be easy and you will finish early. Other days it will humble you. Both are fine. The point is to show up for one small topic, again and again, so the gaps close one at a time instead of piling up where you cannot see them.
How cardosec does it
cardosec is built around this exact loop. You pick a field, such as Web AppSec, Blue team / DFIR or AI security, and a mode: Explain it, Incident drill, Deep dive or Interview. Then you draw. The card gives you the topic, you research it, and when you are ready you press Start and talk against a timer.
Afterwards your answer is transcribed and, if you have connected your own AI key, checked by your AI provider. You see what you covered, what you missed and where to read next, and the card goes into your history so you can see what you have already done. One card is meant to fit in about 30 minutes.
Pick one for today
Let's take things step by step. You do not need a roadmap tonight, and you do not need to finish the playlist. You need one topic, picked by something other than your mood. Close the tabs, draw a card and see how far you get without Googling.
Rome was not built in a day.