I Completed 170+ TryHackMe Rooms — Here's the Learning Path I Wish I Started With
Here's what I know about TryHackMe: it works. I'm Top 2% globally with 170+ rooms completed. I've earned 6 learning path certifications. I've moved from zero cybersecurity knowledge to SOC internship at a commercial MSSP. TryHackMe was the primary learning platform for all of that.
But I wasted about 60 hours doing rooms in the wrong order. I started rooms because they looked interesting, not because they built systematically on prior knowledge. I did penetration testing rooms before I understood Linux well enough to exploit systems efficiently. I skipped foundational paths because I was bored with basics. Then I hit walls where I was missing critical knowledge I could have learned earlier.
This post is the roadmap I wish I'd had. It's not "do every TryHackMe room in order." It's "here's the optimal learning path through TryHackMe for different career goals, based on what actually prepared me for real work."
- Phase 0: Foundations (what you should know before any path)
- Phase 1: The Essential Paths (do these first, in order)
- Phase 2: Specialisation Paths (choose based on career goals)
- Phase 3: Advanced Paths (for depth, not breadth)
- Common mistakes I made (and how to avoid them)
- How to maintain momentum and avoid burnout
The Honest Truth: Not All TryHackMe Paths Are Created Equal
In December 2024, I had zero cybersecurity knowledge. I knew Python basics from a university course. I'd never heard of Kali Linux or Burp Suite. I applied to TryHackMe mostly because it was free and had good reviews. I joined, looked at the learning paths, and started with Pre Security because it looked beginner-friendly.
That decision probably saved me 40+ hours of wasted time, even though I didn't understand why it mattered at the time.
Phase 0: Foundations — Before You Touch Any Learning Path
These aren't learning paths on TryHackMe. These are prerequisite knowledge that you should have before starting the actual paths. If you skip these, you'll struggle understanding the paths themselves.
Before you do anything on TryHackMe, you need to be comfortable typing commands in a terminal. Not expert-level. Just comfortable enough that running `ls`, `cd`, `cat`, `grep` doesn't feel like magic. If you're completely new to command line, spend 2-3 days with free YouTube tutorials (NetworkChuck, John Hammond) or Linux Academy free tier before touching TryHackMe.
Understand the difference between IP addresses, ports, and protocols at a surface level. You don't need to memorize OSI layers yet. You just need to know that a port is a communication endpoint and that protocols like HTTP and SSH use specific ports. TryHackMe's Pre Security path teaches this, but it helps to have encountered it before.
Phase 1: The Essential Paths — Do These First, In This Order
These three paths build on each other and establish all foundational knowledge you'll need for any specialisation later.
Pre Security covers: networking basics (IP, TCP/UDP, DNS), Linux command line fundamentals, Windows system basics, and how computers communicate. This path is deliberately beginner-friendly. Some rooms feel repetitive if you already know the material, but that repetition helps it stick.
Why first: Every single room you do after this assumes you understand the basics covered here. If you skip it because it feels too beginner, you'll struggle with later rooms trying to understand concepts they don't explain because they assume Pre Security knowledge.
Time investment: 20-25 hours over 3-4 weeks. ROI: Critical. This path directly enables everything that follows.
What it teaches: The shared language of cybersecurity. After Pre Security, you understand what a port is, what a packet is, how DNS resolution works, the difference between HTTP and HTTPS. This is the foundation.
Cyber Security 101 bridges foundational knowledge and actual security practices. It covers: incident response fundamentals, threat analysis, defensive security principles, and how security teams actually work. This is where you start thinking like a defender rather than a network administrator.
Why second: Pre Security teaches you how computers work. Cyber Security 101 teaches you how to defend computers and respond when they're attacked. The sequence matters because you need to understand the "what" before you can understand the "how to protect it."
Time investment: 25-30 hours over 4-5 weeks. ROI: Critical. This path directly supports SOC and incident response careers.
What it teaches: The incident response process, threat analysis frameworks, defensive security strategies. After this path, you understand why certain logs are monitored and how alerts translate to actual security decisions.
Web Fundamentals covers web application architecture, common web vulnerabilities (SQL injection, XSS, CSRF), web testing tools, and how to think about application security. This path is the bridge between "I understand networks" and "I can identify application vulnerabilities."
Why third: By this point you understand networks and defensive principles. Web Fundamentals teaches you how those principles apply specifically to web applications — which is where most vulnerabilities actually live in modern systems.
Time investment: 30-35 hours over 5-6 weeks. ROI: Very High. Web security knowledge applies to both offensive (penetration testing) and defensive (SOC, security scanning) work.
What it teaches: The difference between network-layer and application-layer attacks. After this path, you understand why web application firewalls exist, what SQL injection actually does, why developers need secure coding training.
Why These Three Paths First
After Pre Security + Cyber Security 101 + Web Fundamentals, you have 50-70 hours of structured learning covering:
- Defensive knowledge: How to detect, respond to, and understand attacks
- Network literacy: Understanding how systems communicate
- Application security: Where most real vulnerabilities live
- Incident response process: The actual workflow for responding to security events
- Threat thinking: How to approach security problems from attacker perspective
These three paths take 3-4 months and establish all knowledge you need for SOC analyst or junior penetration tester roles. If you only have time to do TryHackMe paths and nothing else, these three are the minimum viable knowledge.
📚 Books That Helped Me Learn Faster
TryHackMe gives you hands-on practice, but I found that combining labs with a few great books helped me understand the concepts much faster.
🐧 Linux Basics for Hackers
The best beginner-friendly Linux book for cybersecurity students. It explains the Linux command line, networking, scripting, and Kali Linux in a practical way that perfectly complements the Pre Security learning path.
📖 View on Amazon🐍 Black Hat Python
Once you finish the basics, this book teaches how Python is used in penetration testing, automation, malware analysis, networking, and offensive security.
📖 View on Amazon🌐 The Web Application Hacker's Handbook
One of the most recommended books for understanding web application security, Burp Suite workflows, authentication flaws, SQL injection, XSS, and modern penetration testing methodology.
📖 View on AmazonDisclosure: As an Amazon Associate, I earn from qualifying purchases at no additional cost to you.
Phase 2: Specialisation Paths — Choose Based on Your Target Role
After Phase 1, your career path bifurcates. Choose your specialisation and go deep.
If You're Targeting SOC/Incident Response/Defensive Roles:
SOC Level 1 is the most directly applicable path for anyone targeting SOC analyst roles. It covers: SIEM concepts, log analysis, alert triage, incident response workflows, and threat intelligence. Each room simulates realistic SOC scenarios where you're analyzing logs, identifying malicious activity, and making alert tuning decisions.
Why take this: This path teaches you the exact workflow you'll do in a SOC analyst role. By the time you finish, you've practiced alert analysis, log investigation, and incident response decision-making dozens of times.
Time investment: 35-45 hours over 6-8 weeks. ROI: Extremely High for SOC roles. This path directly prepared me for my Inhok Technologies internship.
What it teaches: SIEM tool usage patterns, log parsing and analysis, threat hunting methodology, how to escalate alerts appropriately. This is the path that actually teaches SOC work.
If You're Targeting Penetration Testing/Offensive Roles:
Jr Penetration Tester is the offensive counterpart to SOC Level 1. It covers: scanning and enumeration, exploitation techniques, privilege escalation, post-exploitation, and complete attack chains. Rooms progress from "here's a vulnerable service, exploit it" to "here's a network, get from foothold to domain admin."
Why take this: If you want to do penetration testing, this path systematically teaches you every step of a real penetration test. You practice actual attack techniques against intentionally vulnerable systems.
Time investment: 50-60 hours over 8-10 weeks. ROI: Extremely High for penetration testing roles. This path directly prepares you for OSCP-level thinking.
What it teaches: Complete attack chains. How to chain individual vulnerabilities into a full exploitation path. Why privilege escalation is critical. Post-exploitation and maintaining access.
After Phase 1, you choose: SOC Level 1 (defensive) or Jr Penetration Tester (offensive). Both are valuable. Both teach skills you need. But they require different time investments and lead to different career paths.
You don't have to pick one forever. But if you're picking one first, I recommend picking based on your immediate job target. If you're applying for SOC positions, do SOC Level 1. If you're targeting penetration testing, do Jr Penetration Tester. You can do both, but not in your first 6 months unless you're dedicating 15+ hours per week.
Phase 3: Advanced/Specialised Paths
After Phase 1 + one Phase 2 path, you have solid foundation knowledge. Phase 3 paths go deep into specific domains.
This is a mega-path that combines penetration testing content from beginner to intermediate level. If you want comprehensive offensive security training, this consolidates a lot of it. However, it overlaps significantly with Jr Penetration Tester.
Honest take: If you've already done Jr Penetration Tester, Complete Beginner to Pentester has diminishing returns. If you're starting from zero and want one comprehensive path, this might be better than doing three separate paths.
TryHackMe has paths focused on specific tools and techniques: Burp Suite, Nmap, Metasploit, Active Directory attacks, etc. These are valuable for depth but assume you've already done foundational paths.
When to take: After Phase 1 + Phase 2. Use these for practicing specific tools or filling specific knowledge gaps, not as primary learning.
The Timeline: How I Actually Progressed
Total from zero to 170+ rooms: about 9 months at 30-40 hours per month, alongside university and internship work.
Common Mistakes I Made (Learn From Them)
I tried to start with Web Fundamentals because Pre Security looked "too basic." I got stuck understanding concepts that the rooms assumed I knew. I went back and did Pre Security. Problem solved. Lesson: Do the foundational paths even if they feel repetitive. Especially if you didn't learn those topics formally.
Around month 3, I started picking interesting-sounding rooms without following a structured path. I did penetration testing rooms before finishing Web Fundamentals. I did Active Directory rooms without understanding Windows administration. This wasted time and created knowledge gaps. Lesson: Follow the paths sequentially. The sequencing is thought-out.
Early on, I'd rush through a room, get the flag, move on. After month 4, I realised rooms are teaching tools. I started spending time on rooms even after getting flags — understanding why the vulnerability exists, what the mitigation is, how it would appear in logs. Rooms became 2-3x more valuable. Lesson: Slow down. Understand concepts, not just exploit steps.
I did 40+ rooms before I started keeping a structured learning journal. By that point, I'd forgotten half the lessons from early rooms. When I started documenting: "What did I learn? What tools did I use? What concept did this teach?" — retention improved dramatically. Lesson: Document as you learn. Future you will be grateful.
After SOC Level 1, I thought I'd learned everything needed for a SOC analyst role. I was wrong. I then had to do separate SIEM training on Splunk and Wazuh specifics. I then had to practice threat hunting. Lesson: Learning paths teach concepts, not tool mastery. You need supporting learning beyond just paths.
Beyond TryHackMe: What You Still Need
- Specific SIEM tools (Splunk, Wazuh) at professional depth
- Real-world incident response procedures for specific companies
- How to write detection rules that actually catch threats
- Programming beyond Python basics
- Professional communication and report writing
TryHackMe got me 60% of the way to a SOC analyst role. The other 40% came from: Inhok Technologies internship, hands-on SIEM training (Splunk and Wazuh), writing detection rules in practice, reading actual incident response reports, and doing bug bounty hunting to apply offensive knowledge to real systems.
The Optimal Learning Path Summary
The Minimum Path (3-4 months)
- Pre Security (20-25 hrs)
- Cyber Security 101 (25-30 hrs)
- Web Fundamentals (30-35 hrs)
Total: 75-90 hours over 3-4 months
After this, you have foundational knowledge. You're not ready for a job, but you understand cybersecurity enough to pursue internships or continue learning more advanced topics.
The SOC Specialist Path (5-6 months)
- Pre Security (20-25 hrs)
- Cyber Security 101 (25-30 hrs)
- Web Fundamentals (30-35 hrs)
- SOC Level 1 (35-45 hrs)
Total: 110-135 hours over 5-6 months
After this path + supporting SIEM training (Splunk, Wazuh), you're competitive for SOC L1 positions. This is the path I followed.
The Penetration Tester Path (5-7 months)
- Pre Security (20-25 hrs)
- Cyber Security 101 (25-30 hrs)
- Web Fundamentals (30-35 hrs)
- Jr Penetration Tester (50-60 hrs)
Total: 125-150 hours over 5-7 months
After this path, you understand penetration testing methodology. You're not ready for OSCP yet, but you have solid foundation for exploit development and real penetration testing work.
![Penetration Testing Guide: Real-World Methodology (Recon to Exploitation) [2026]](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPBk3GKaD1haQ8sYEamZkLq-DHFa8nGpQnjj525DE5MSLuEU0hldEUClxccXHfAqtPk9JKtXgivFp1V2dAy34YDYj2Zax9A7fSBlGbhJMCAwG74hjyImun9uEQuPwRwd7K50N7lSkKBwvHKoR0vPFm2bbYYBin3P2oQfygM4W8MV1Bzx517R7Q4Na7zYJB/w72-h72-p-k-no-nu/wp14480856-dark-web-hackers-wallpapers.png)
0 Comments