Around day 50 I felt an enormous tiredness. Exactly the same as a year earlier. This summer I took on the challenge for the second time: at least 62 days of daily cybersecurity study. And for the second time I did not deliver.
Attempt One: Chaos in the Search for Knowledge
A year ago what I knew about cyber was incomparably less than today. Taking on the challenge on impulse, I did not really know which sources to use to gain as much as possible in a limited time. Should I try the PortSwigger labs? Or listen to NTHW recordings? Sometimes an interesting webinar came along, other times my eye caught on a very short course about a topic I cared about...
Not quite knowing where to start, I tried a bit of everything. Which in turn produced a growing sense of being lost. Cybersecurity is, after all, an enormous field, where in the first place it is easy to lose your bearings when you see the sheer number of topics to master, and in the second it is easy to be seduced by courses of varying quality, which look as though they offer solid knowledge, but even when they genuinely do, they leave a newcomer with no way to place it in a wider context.
That challenge showed me several important things about learning cybersecurity. And the time has come to share them.
Lesson 1: It Is Worth Mastering the Basics Before Moving On
If a year ago I had spent the time on mastering the foundational topics that matter in cybersecurity, whether through Hack The Box Academy or TryHackMe, it would have been far easier to find my way among the multitude of recordings and courses on the market. And I do not mean only the general theory of which areas cybersecurity covers, but above all the practice: the basics of operating systems and their consoles, the basics of networking, using the tools that come up in pentests, and so on.
Working out a general sense of what is rustling in the cyber grass makes it easier to choose the next tools for your development - whether those turn out to be boxes to hack, webinars, courses, or certifications.
Lesson 2: It Is (Usually) Easier in Company
It does not matter whether the progress gets shared on social media, or arranged with friends so that for the coming weeks each of us puts aside a little time every day for learning. Telling someone about your goal usually makes you look at reaching it a little more seriously.
Of course life likes to surprise us and we will not always manage to keep our promises, but the mere awareness that someone might ask "how is it going" is enough to change our attitude towards the goal. Not to mention that sharing small wins and supporting each other through the harder moments gets us further.
Lesson 3: A Contract With Yourself Is Worth Signing
A declaration made to other people carries weight, but it does not replace a decision made towards yourself. I have caught myself on this more than once since last year's challenge. Many of my plans, starting with the previous challenge and going through my intention to take the BSCP, broke on the vagueness of the goal I was setting myself.
Many things can feed that lack of detail - in my case the biggest factor was other life priorities tied to coming out of earlier crises. Only with hindsight do I see that I was openly declaring my intention to take the BSCP and taking steps towards studying for that certificate, while at the same time I had no room to admit to myself that I had other, more important goals on my plate and that those were what I was actually working on. The same problem, in a slightly different guise, came back in this year's challenge (see: Lesson 4).
Wiser for that experience, I can now see that before I take on a bigger subject again - a 100-day challenge, or studying for a certificate - it is worth spending a little time working out what my priority actually is at this point. And if, using something like the SMART technique, I conclude that I do have room to act on a given goal, then - to hold myself to the decision - it is worth signing a contract with myself.
A contract with yourself is something other than the non-committal "I would like to do this and that". The latter still leaves a way out; the former means agreeing to concrete action and to pursuing the goal despite whatever gets in the way. And it carries its weight regardless of whether anyone besides me knows about that goal at all.
Attempt Two: Little Red Cyber Riding Hood Picking Flowers
This year's run at the cyber summer turned out like the tale of Little Red Riding Hood, who had a clear goal - to reach Grandmother with the cake and the wine - and then let herself be tempted by an equally attractive goal the Wolf put in her way. After all, who would not want to add hand-picked flowers to a parcel for someone they love? Never mind that the plan was to walk straight to Granny's...
Richer for last year's experience, I set myself the goal of completing the Pre Security and Cybersecurity 101 paths on TryHackMe. For me that decision was a natural continuation of my studies after earning the Google Cybersecurity certificate, which I took through INCO Academy. Inspired by what Karol Wróblewski talked about in the extra sessions that came with that certificate, I started exploring the paths TryHackMe offers. They looked like the answer to my problem - the gap between theoretical knowledge and actually hacking boxes - so I set off eagerly.
Then it turned out that TryHackMe was running a summer CTF. My energy went into a side thread of the learning: hacking boxes whose difficulty varied wildly from one day of the event to the next. Granted, at the very end there was the satisfaction that with other people's help I had picked up a good deal of knowledge and had a completion certificate to show for it. On the other hand... well. It cost me so much energy that a long while passed before I got back to studying cybersecurity regularly.
Lesson 4: When the Choice Appears Between the Path You Set and Changing It
There is one thing worse than following the wrong path for too long: stepping off it the moment the thought to do so first crosses your mind.
Some time ago I heard that it is worth setting goals for, say, 90 days and sticking to them for at least a while, even if they later turn out not to be the best ones. The point is that some time should pass between the moment we notice the need for a change and the moment we decide to make it. That time is what lets us judge whether the change is dictated by a real need to switch direction, or by an impulse that will ultimately pull us away from the goal we set.
I did not give myself that time. I abandoned the path I had set without a second thought, in favour of a summer CTF I was not ready for. Yes, I did learn some things, but I would have used that time far more effectively sitting with simpler boxes (privilege escalation, for instance). To say nothing of the drain on energy - when you are only starting out in an area, several hours of banging your head against a wall because you reached for something far too hard for you right now does nothing for your motivation.
Lesson 5: Maybe Focus on Yourself Rather Than on the Recruiter?
This year I decided to publish something every day, to share my study notes and to show on LinkedIn how much I was putting into learning. After about 30 days that became another huge stone in the backpack, adding to a load that was already heavy.
I could of course have generated the content with AI, except then I would not have gone back over what I had learned in the way that genuinely helps me learn. I could also have written that today I learned this and that, but then the posts would have been one more outpouring of not particularly meaningful content under the heading: look at me. If I could give advice to myself from a few months ago, I would say: publish if you want to, but once a week, say, a blog post, so that some trace of your learning is left behind. If, though, you want to study intensively, then focus on studying, and signal your progress on social media at longer intervals.
There is a common belief that it is good to document challenges like this, to show a recruiter that we keep developing. I think, though, that the weight of such posts is overrated, especially once you take into account that in the vast majority of cases what gets us through the ATS is a specific certificate, not daily brag posts, however good. It is also worth weighing up for yourself how much time you can give to learning and how much to building a personal brand - and in what form that brand gets built. Blog posts? Writeups on GitHub? Social media updates? It is worth thinking this through before you start - so as not to add, as I did, more stones to a backpack already heavy with everything you are learning.
Lesson 6: What Happens When You Do Not Deliver
What hurts most is announcing your challenge and then not carrying it through, with other people there to witness the stumble. And you cannot even be sure whether a third attempt will work out, or whether people will once again see that it did not.
Let me reassure you: most people will not even notice. Some will, but will not attach any importance to it. Someone may ask, if they do not forget in the rush of their own days. Nobody has asked me yet, and it has been a few weeks since I stopped reporting on the challenge.
The world did not collapse, people did not write me off; the only casualties were my ego and my conviction that I have superhuman strength and can overcome every obstacle on the spot without it costing me any learning. No, I do not have superhuman strength. No, I cannot always limit how much circumstances affect what I have declared - never mind the times when I unknowingly trip myself up.
Does that mean I ended the challenge in failure again? The numbers alone do not capture the experience I gained, nor the many reflections that surfaced once I started thinking about the challenge itself. Which is why I am already thinking about the next one - better prepared this time.
