Part of the Cybersecurity Learning Path Guide — This article is one deep-dive in our complete learning paths series.

Penetration Tester Roadmap 2026

By HADESS Team | February 28, 2026 | Updated: February 28, 2026 | 14 min read

Table of Contents

• What Penetration Testing Looks Like in 2026
• The Honest Prerequisites
• Phase 1: Networking and Systems (Months 1-3)
• Phase 2: Web Application Security (Months 4-6)
• Phase 3: Network and Infrastructure Pen Testing (Months 7-9)
• Phase 4: Active Directory and Post-Exploitation (Months 10-12)
• Certification Path for Pen Testers
• Building a Pen Testing Lab
• The Bug Bounty Question
• Getting Hired as a Pen Tester
• What Pen Testing Firms Actually Look For
• Related Guides in This Series
• Take the Next Step
• Frequently Asked Questions

What Penetration Testing Looks Like in 2026

A penetration testing roadmap needs to account for where the profession actually is, not the Hollywood version that still attracts many newcomers. Penetration testing in 2026 involves a significant amount of structured methodology, report writing, and client communication alongside the technical exploitation work that gets all the attention.

The typical pen tester’s engagement cycle looks like this: you receive a scope document defining what you can and cannot test. You perform reconnaissance within that scope. You identify vulnerabilities through a combination of automated scanning and manual testing. You attempt to exploit those vulnerabilities and demonstrate real-world impact. Then you write a detailed report that explains what you found, how you found it, why it matters, and how to fix it.

That report often matters more than the hacking itself. Organizations pay for pen tests because they need to know their risk and how to reduce it. A pen tester who finds a critical vulnerability but writes a report no one can understand has failed the engagement.

The field has also shifted significantly toward specialization. “Pen tester” used to mean someone who tested networks. Now it splits into web application testing, network/infrastructure testing, cloud testing, mobile application testing, API testing, and red teaming. This roadmap covers the foundational path that lets you specialize later.

The Honest Prerequisites

Penetration testing has a higher technical bar than most other entry points into cybersecurity. Being honest about this upfront saves people from frustration later.

You need strong networking knowledge. Not “I watched a networking video” strong — you need to understand subnetting, routing, TCP flags, how ARP works, how DHCP assignments happen, what services listen on which ports, and how firewalls filter traffic. This knowledge is used every single day in pen testing.

You need to be comfortable in Linux. Kali Linux and Parrot OS are the standard pen testing distributions. You should be able to navigate the file system, manage processes, edit files in a terminal, pipe commands together, and troubleshoot without a GUI. If you are still copy-pasting every command from a tutorial, you are not ready.

You need scripting ability. Python and Bash at minimum. You will write custom scripts, modify exploits, automate repetitive tasks, and parse output. You do not need to be a software developer, but you need to be able to read code, understand what it does, and modify it for your needs.

You need patience with methodology. Pen testing is not freestyle hacking. It follows methodologies — OWASP Testing Guide for web apps, PTES for infrastructure, OSSTMM for general testing. The methodology keeps you thorough and ensures you do not miss things.

If you are starting from scratch with no IT background, budget 12-18 months of preparation before you are competitive for a junior pen testing role. If you have networking or system administration experience, 8-12 months is realistic.

Use the HADESS career skills platform to benchmark your current abilities against pen testing role requirements.

Phase 1: Networking and Systems (Months 1-3)

Before you touch a pen testing tool, you need to understand what you are testing.

Month 1: TCP/IP and Network Architecture

Study how data moves through networks. Understand the difference between switches and routers, VLANs, subnets, and network address translation. Learn to subnet by hand — pen testers who cannot subnet quickly waste time on engagements.

Set up a lab with multiple virtual machines on different network segments. Practice routing traffic between them. Use Wireshark to observe how protocols actually behave versus how textbooks describe them.

Month 2: Linux and Windows Administration

Spend two weeks going deep on Linux. Set up services from the command line — Apache, SSH, FTP, MySQL. Understand file permissions, cron jobs, user management, and process internals. Then do the same on Windows: Active Directory basics, Group Policy, Windows services, registry, and PowerShell.

You are building the mental model of “normal” that lets you spot “abnormal” during testing. A pen tester who does not understand how Active Directory authentication works cannot effectively attack it.

Month 3: Scripting Foundations

Write Python scripts that do useful things: port scanners, web scrapers, file parsers, log analyzers. Learn Bash scripting for automation — looping through IP ranges, grepping output, piping tools together. Study enough PowerShell to understand Windows post-exploitation scripts.

The goal is not to become a developer. The goal is to stop being blocked when you need to automate something or modify a tool.

Phase 2: Web Application Security (Months 4-6)

Web application pen testing is where most of the demand is in 2026. More organizations need web app tests than network tests, and the barrier to entry is slightly lower.

Month 4: Web Fundamentals and OWASP Top 10

Understand how web applications work end-to-end. HTTP methods, status codes, headers, cookies, sessions, authentication flows, API structures (REST, GraphQL). Study the OWASP Top 10 not as a checklist but as a framework for understanding web application risk.

Set up vulnerable applications: DVWA, WebGoat, Juice Shop, and HackTheBox web challenges. Practice finding and exploiting SQL injection, cross-site scripting, broken authentication, and insecure direct object references manually before using any tools.

Month 5: Web Testing Tools and Manual Techniques

Learn Burp Suite thoroughly. Not just the proxy — learn the repeater, intruder, decoder, and comparer. Practice intercepting and modifying requests. Learn to identify injection points by reading HTTP traffic.

Study manual testing techniques: testing for IDOR by changing parameter values, checking for privilege escalation by modifying JWT tokens, testing for SSRF by injecting internal URLs, and identifying information disclosure in API responses, error messages, and source code comments.

Month 6: Reporting and Methodology

Run a complete web application test against a practice target following the OWASP Testing Guide methodology. Document everything. Write a professional pen test report with an executive summary, detailed findings (each with severity, evidence, impact, and remediation), and a methodology section.

Have someone review your report. The quality of your reports directly affects your employability. Pen testing firms lose clients over bad reports.

Phase 3: Network and Infrastructure Pen Testing (Months 7-9)

Month 7: Reconnaissance and Scanning

Learn active and passive reconnaissance techniques. Practice OSINT gathering with tools like theHarvester, Recon-ng, and Shodan. Learn Nmap thoroughly — not just basic scans but service version detection, NSE scripts, scan optimization, and output parsing.

Understand what different ports and services mean in the context of an engagement. Seeing port 445 open tells you something very different from seeing port 8080 open.

Month 8: Exploitation Frameworks

Study Metasploit — modules, payloads, handlers, post-exploitation. But do not become dependent on it. Learn to exploit vulnerabilities manually first, then use Metasploit to understand how exploitation frameworks work. Practice with Hack The Box machines that are rated Easy and Medium.

Learn how to chain vulnerabilities. A single low-severity finding might mean nothing; three low-severity findings chained together might give you domain admin.

Month 9: Privilege Escalation

Study Linux and Windows privilege escalation methodologies. On Linux: SUID binaries, cron job abuse, kernel exploits, sudo misconfigurations, writable PATH entries. On Windows: service misconfigurations, unquoted service paths, DLL hijacking, token impersonation, and AlwaysInstallElevated.

Use resources like GTFOBins for Linux and the PayloadsAllTheThings repository for both platforms. Practice on dedicated privilege escalation machines (TryHackMe and Hack The Box both have specific rooms for this).

Phase 4: Active Directory and Post-Exploitation (Months 10-12)

Active Directory attacks are the bread and butter of internal network pen tests. Most organizations run AD, and most AD environments are misconfigured.

Month 10: Active Directory Attacks

Build an AD lab with a domain controller and two or three workstations. Practice enumeration with BloodHound, PowerView, and ADRecon. Study common attack paths: Kerberoasting, AS-REP roasting, Pass-the-Hash, Pass-the-Ticket, DCSync, and delegation attacks.

Understand how these attacks work at the protocol level, not just how to run the tool. When a client asks “how does Kerberoasting work?” during a debrief, “I ran a script” is not an acceptable answer.

Month 11: Post-Exploitation and Lateral Movement

Practice pivoting through networks, setting up port forwards, and moving laterally through an environment. Learn how to maintain access without being detected by EDR solutions. Study credential harvesting techniques: Mimikatz, SAM database extraction, LSASS dumping, and credential manager queries.

Learn data exfiltration techniques and how to demonstrate impact without actually harming the client environment. This is a real skill — proving you could access sensitive data without actually downloading it all.

Month 12: Full Simulated Engagement

Run a complete pen test engagement from start to finish against your lab or a dedicated practice environment like ProLabs on Hack The Box. Follow a methodology end-to-end. Write a full professional report. Get feedback.

This capstone exercise reveals your weak spots and gives you a portfolio piece for interviews.

Certification Path for Pen Testers

The pen testing certification market is crowded. Here is what actually matters:

The OSCP is the certification that opens doors. It requires you to hack into machines in a 24-hour practical exam and write a professional report. It is difficult, time-consuming, and worth the investment. Plan to spend 2-3 months of focused preparation after completing the roadmap above.

Use the HADESS certificate roadmap planner to build a timeline that accounts for your schedule and budget.

Building a Pen Testing Lab

Your lab needs:

• Hypervisor — VMware Workstation or VirtualBox
• Kali Linux — Primary attack machine
• Windows Server — Domain controller for AD practice
• Windows 10/11 workstations — Domain-joined endpoints
• Vulnerable machines — Metasploitable, DVWA, custom-built VMs
• Network segmentation — Practice with VLANs and firewalls if your hardware supports it

Hardware recommendations: A machine with 32GB RAM and an SSD can run this comfortably. 16GB works but you will be swapping VMs in and out. A dedicated laptop for lab work keeps things clean.

The Bug Bounty Question

Should you do bug bounties as part of your pen testing preparation? Yes, but with realistic expectations.

Bug bounties teach you to find real vulnerabilities in production applications. That experience is valuable and translates directly to client engagements. However, bug bounties alone are not enough preparation for pen testing. They typically focus on web applications and do not cover network testing, Active Directory attacks, or the reporting and communication aspects of professional pen testing.

Use bug bounties as a supplement to structured learning, not a replacement.

Getting Hired as a Pen Tester

Entry points:

1. MSSP or consultancy junior pen tester — The most common path. You work under senior testers, handle easier engagements, and learn on the job. 2. SOC analyst to pen tester — Work in a SOC for 1-2 years, build your skills on the side, and transition internally or externally. 3. IT/sysadmin to pen tester — Your operational knowledge is valuable. Many good pen testers started as the people building and defending the systems. 4. Bug bounty portfolio — A strong HackerOne or Bugcrowd profile with verified findings demonstrates real-world ability.

What Pen Testing Firms Actually Look For

Hiring managers at pen testing firms screen for:

• Ability to work independently and manage time across multiple engagements
• Report writing quality (they will ask for a sample report)
• Methodology discipline, not just hacking ability
• Client communication skills — can you explain a vulnerability to a non-technical executive?
• Understanding of risk, not just exploitation — knowing why a finding matters is as important as finding it
• Cultural fit for a consulting environment — travel, deadlines, varied clients

Related Guides in This Series

• SOC Analyst Learning Path: From Zero to Hired
• CompTIA Certification Pathway: A+ to CASP+
• How to Use Practice Labs in Cybersecurity Training

Take the Next Step

Identify the skills you need to build for pen testing with the HADESS Career Skills Explorer.

Plan your certification path with the HADESS Certificate Roadmap.

Frequently Asked Questions

How long does it take to become a penetration tester?

A. From zero IT experience, expect 12-18 months of dedicated study. From an IT background (networking, sysadmin), 8-12 months is realistic. The OSCP alone takes 2-3 months of focused preparation for most people.

Is the OSCP really necessary?

A. It is not technically required, but it is the most recognized pen testing certification in the industry. Many job postings list it as required or strongly preferred. If you are serious about a pen testing career, plan to get it within your first two years.

Can I become a pen tester without a degree?

A. Yes. The pen testing field is one of the most meritocratic in tech. Demonstrated skills, certifications (especially OSCP), and practical experience matter far more than academic credentials. Many of the best pen testers in the industry are self-taught.

What is the salary range for entry-level pen testers?

A. Junior pen testers in the US typically earn $65,000-$95,000, depending on location and employer type. Consultancies tend to pay more than in-house roles. After 2-3 years and an OSCP, salaries commonly reach $100,000-$130,000.

Should I learn web app testing or network testing first?

A. Start with web application testing. There is more demand for it, the barrier to entry is lower, and the skills transfer to other specializations. Network and infrastructure testing typically comes second in most pen testing career progressions.

— HADESS Team consists of cybersecurity practitioners, hiring managers, and career strategists who have collectively spent 50+ years in the field.