SEC0 and the fundamentals problem

SEC0 is TryHackMe’s entry point certificate: foundational IT, computer literacy, and the bare minimum of security concepts. I took it out of curiosity and a bit of badge padding.

It is also one of the most glossed-over certificates around, because experienced people ignore it and most beginners go straight for SEC1.

For preparation, on top of my years working in IT, I went through the Pre Security learning path before sitting the exam.

The format is simple enough. You get questions with one clear answer, and you answer them. Getting to some of those answers is stranger than the format suggests: you spin up a browser inside the exam environment, work through a set of interactive questions in it, and answering those produces a code that you paste into the real answer field. Other sections drop you into a VM to go and find flags.

So what do I make of it? It really is entry level, and it teaches the bare fundamentals you need before security. Heck, I would go further: this is material worth studying before you specialize into any IT field, not just this one. Passing it says very little about you as a security practitioner. It says you have the foundations to go and become one, or a sysadmin, or a network engineer, or anything else.

Which is the tension I keep coming back to. The certificate is close to worthless as a credential. The thing it certifies is not. I have seen plenty of students start a cybersecurity course with zero fundamentals, and watching them bulldoze through coursework without understanding what sits underneath it is a sad thing.

The part I actually wanted to write about

Working through it made me reflect on cybersecurity as a discipline. I think it is one of the harder fields in IT, because it borrows from every other role before it lets you in.

Want to exploit a web application? You need to know how a web application is built, which means you need web development experience. Attacking Azure? You need to have used Azure. Every offensive skill sits on top of somebody else’s day job.

So when I compare four years studying cybersecurity against four years studying software engineering, I think you land in one of two places:

1. You study cybersecurity and software engineering at the same time, and fit both into the same four years.
2. You get cybersecurity concepts pushed onto you with no grasp of how the underlying things actually work, because you never had the implementer’s point of view.

The first is twice the work. The second is the one I see more often.

Welp, small rant over.

I would only recommend the certificate itself if you want an ego boost or a self-assessment check. The learning path behind it is a different story: genuinely great for beginners, and worth revisiting if you specialized way too early and want to go back and shore up your fundamentals.