MASTER ROADMAP
HackPath Master Roadmap — 7 pillars, one continuous path
The full learning path across HackPath — what's available now, what's being built, and what's planned.
PILLAR 1 OF 7
Technical FoundationsFULL 3RD TIER
Computer Foundations → Networking → Operating Systems → Cybersecurity Foundations → Cryptography (+ Programming & Automation branch)
Why: Everything else assumes you understand how computers, networks, and operating systems actually work — this is the foundation the other six pillars are built on.
PILLAR 2 OF 7
Security Engineering & Attack SurfacesFULL 3RD TIER
Identity & Access Mgmt → Web & API Security → Application Security → DevSecOps → Cloud Security
Why: This is where a modern company's real attack surface lives — identity, web apps, cloud, code pipelines.
PILLAR 3 OF 7
Offensive SecurityFULL 3RD TIER
Offensive Security & Pentesting → Adversary Simulation & Red Team Operations
Why: You can't reliably defend a system you don't know how to attack.
PILLAR 4 OF 7
Defensive OperationsFULL 3RD TIER
SOC & Detection Engineering → Incident Response & Forensics → Threat Intelligence & OSINT
Why: Most cybersecurity jobs are this: detect, respond, learn — the day-to-day of SOC, IR, and threat intel.
PILLAR 5 OF 7
Advanced & Specialized SecurityFULL 3RD TIER
Malware Analysis → Reverse Engineering (+ Mobile, Wireless, IoT/OT, AI security as parallel electives)
Why: Once fundamentals are solid, this is where you specialize into a deep, often career-defining niche.
PILLAR 6 OF 7
Governance, Architecture & AssuranceFULL 3RD TIER
GRC, Risk & Compliance → Security Architecture (+ Assurance/Audit and Resilience/BCP-DR branches)
Why: Security only scales if it's designed into the organization — this is where technical skill becomes a decision leadership relies on.
PILLAR 7 OF 7
Professional Practice, Research & CareerFULL 3RD TIER
A single domain — final pillar
Why: Technical skill alone doesn't make a career — this covers the ethics and communication that make you trusted to do this work.
Releases
Coming soon. This section will show, at a glance, what's available now, what's currently being built, and what's up next — one status per domain, pulled from the same pillar data above, across all 7 pillars.
Paths
Curated role paths — an ordered sequence through the domains above, for a specific job in mind.
Web Application Pentester
Offensive testing of web apps and APIs — from foundations through exploitation.
SOC Analyst
Monitoring, triage, and incident response in a security operations center.
Cloud Security Engineer
Securing cloud infrastructure, identity, and container/Kubernetes workloads.
Malware Analyst / Reverse Engineer
Dissecting malicious binaries and reverse-engineering how they work.
Governance, Risk & Compliance Analyst
Frameworks, risk management, architecture review, and assurance.
DevSecOps Engineer
Baking security into the software delivery pipeline, from code to cloud.
Methodology
REFERENCE FRAMEWORKS
This roadmap is aligned with — not certified by — the following established frameworks, used as a reality check on scope, terminology, and what a real role actually requires:
- CyBOK — Cybersecurity Body of Knowledge — broad academic coverage of the field's core areas.
- NICE — NIST's workforce framework — the tasks/knowledge/skills real cybersecurity jobs require.
- ECSF — ENISA's European Cybersecurity Skills Framework — role profiles used across the EU.
- MITRE ATT&CK — The industry-standard adversary tactics/techniques knowledge base.
- OWASP — Application security guidance — used specifically for the web/app security domains.
HOW DOMAINS AND PREREQUISITES ARE CHOSEN
Each pillar starts from a curated subset of an internal, much larger taxonomy (kept as a private reference document, not published) — only domains with a clear, teachable place in a learner's progression make it onto this public map. A domain's prerequisites reflect a genuine dependency (you need X to understand Y), not just a suggested reading order — see each pillar's own notes for why specific domains branch off the main spine instead of sitting on it.
VERSIONING AND REVIEW
This data lives in versioned files in the same repository as the rest of the site — git history is the changelog. There's no separate review-workflow tooling today; changes go through the same process as any other content change here.