Skip to content
CertGPS
Career path

Self-Taught to Certified: Turning Self-Study Into Evidence Employers Can Check

For self-taught learners: using the NICE Framework as a syllabus, what self-study can't count toward, and which lab-graded exams show skill best for the money.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

Self-Taught to Certified: Turning Self-Study Into Evidence Employers Can Check

An employer can't see what you learned alone at a desk, so a self-taught route has to end in things they can check, such as a passed exam or a graded lab report. That changes which certifications earn their price. Exams that make you investigate or attack a live lab say more about self-taught skill than a multiple-choice score, and several cost less than the better-known names.

A syllabus from the NICE Framework

The hardest part of studying alone is knowing what to study. NIST's NICE Workforce Framework (SP 800-181) solves most of that, because it lists the tasks, knowledge and skills for each cybersecurity work role. Pick the role you're aiming at and turn its task list into a checklist. For the entry analyst role, Defensive Cybersecurity (PD-WRL-001), the tasks include identifying anomalous network activity, detecting intrusions, isolating malware and resolving incidents. For each one, write down how you'd do it and on what tool, then build a lab where you can.

Exam outlines make the second half of the syllabus. CompTIA publishes the objectives for each exam as a free PDF, and GIAC lists the objectives for each certification on its site. Between a work role's tasks and an exam's objectives, you have a reading list and a lab plan without paying for a course.

For material, NIST keeps a list of free and low-cost online learning, which includes Cisco Networking Academy's introductory cybersecurity course, TryHackMe's free tier and SANS's free community resources. NIST says the list isn't an endorsement, so treat it as a starting point.

What self-study can't count toward

ISC2's experience rules count full-time work, part-time work of 20 to 34 hours a week, and paid or unpaid internships confirmed on company letterhead. A home lab isn't on that list, however much you've done in it. SSCP accepts a qualifying degree in place of its year of experience; CISSP still needs qualifying work even with a waiver. You can pass either exam early and hold Associate of ISC2 status while meeting the relevant experience deadline. ISC2 Certified in Cybersecurity needs no experience at all.

The Bureau of Labor Statistics lists a bachelor's degree as the typical entry education for information security analysts and says many employers prefer candidates with a security certification. If you don't have a degree, our no-degree path deals with that question.

Exams that grade what you can do

CredentialWhat gets gradedPriceRenewal
GFACT75 questions on hardware, operating systems, networking and code, in 2 hours$3994 years; 36 CPEs and $199
Security+Up to 90 multiple-choice and performance-based questions, in 90 minutes$4393 years; 50 CEUs and $150
BTL120 task-based questions answered from a compromised lab network, within 24 hours£399 with trainingNone; it doesn't expire
HTB CDSAFlags and a written incident report from a seven-day investigation$210 voucher, after a 15-module pathNone; no expiration date
eJPT45 questions answered by scanning and exploiting a lab, within 48 hours$250 voucher with an INE subscription, or $299 bundle3 years

GIAC names self-taught online learners among GFACT's intended audience, and it's a fair check that your computing foundations hold before you spend more. Security+ carries the formal recognition, since CompTIA aligns it with US Defense Department 8140 work roles such as cyber defense analyst. Neither proves you can work an incident.

The lab exams come closer. BTL1 puts you inside a compromised network with real tools and asks what happened. It has no entry requirements, and Centri, which runs it, recommends it for people with up to two years of experience. CDSA goes further: you get seven days across several networks, and an instructor marks your incident report against a commercial standard. You can't buy the voucher until you've completed Hack The Box Academy's SOC Analyst path, which suits a self-taught learner because the path is the structure you'd otherwise lack. On the offensive side, the eJPT has you attack a small network over 48 hours. INE pitches it at people with little to no security experience, and it has no prerequisites beyond the subscription needed to buy the voucher.

A sequence for one person paying their own way

Start with fundamentals until you can explain how an IP packet gets from a laptop to a web server and back, and can read authentication logs on both Linux and Windows. Sit GFACT only if you want an outside check on that; otherwise move on.

Next, sit Security+, mainly for that 8140 alignment and the employer preference BLS describes. Plan for the version change: SY0-801 is expected to launch on or around November 17, 2026, and SY0-701 retires in English on June 11, 2027.

Then choose one lab-graded credential in the direction you want to work. For defense, choose BTL1 or CDSA; for offense, the eJPT. Keep notes as you go, and write up the investigations you do on retired or practice labs as short reports: what you saw, what you concluded, what you'd do next. Those reports are the self-taught candidate's portfolio, and they give an interviewer something concrete to ask about.

At list prices, Security+ plus BTL1 comes to $439 and £399. Keep the currencies separate when budgeting: exchange rates, checkout currency and taxes can change the total. In our view, one knowledge exam and one practical credential make a reasonable limit for a first year.

When to stop studying and apply

After one knowledge exam and one practical credential, the next certification adds less than a job would. Start applying, including for IT support roles. CyberSeek lists IT support as a feeder into security jobs, and BLS says support roles can be open to people with a high school diploma plus IT certifications. Our route from no experience covers that stage in more detail, and if you're weighing a paid program instead of continuing alone, read what bootcamp graduates should do next first.

Sources