If you're a student, or coming from a field with no overlap with computers at all, this is a different starting point than "IT support moving into security." You don't have networking or systems experience to build on top of. That's fine, but it changes what the first few months should actually look like, and it's where most beginners waste the most time.
The two mistakes almost everyone makes first
Jumping straight to hacking tools. Kali Linux, Metasploit, a YouTube video titled "become a hacker in 30 days", none of it means anything yet if you don't understand what a port is, what a protocol does, or how a request actually travels from your browser to a server. Tools without fundamentals just become memorized commands you can't adapt when something doesn't go exactly like the video.
Buying a course before knowing if you like the work. Plenty of free material exists that covers exactly the same ground as most paid beginner courses. Spend a month on free resources first. If it holds your attention through the unglamorous parts, that's real signal. If it doesn't, you've lost nothing.
The actual order, and what to use for each step
1. Basic networking (2 to 4 weeks). You need to understand IP addresses, ports, DNS, and how data actually moves across a network before any security concept makes real sense. Professor Messer's free Network+ video series on YouTube covers this thoroughly and is widely used precisely because it doesn't assume anything.
2. Linux fundamentals (2 to 4 weeks, can overlap with the above). Most security tooling and most real targets run on Linux. Linuxjourney.com is free and walks through this from nothing. OverTheWire's Bandit wargame, also free, is the standard next step, it forces you to actually use the command line to solve small problems rather than just reading about it.
3. Core security concepts (3 to 4 weeks). Professor Messer's Security+ series, free on YouTube, or TryHackMe's "Pre Security" learning path, covers the concepts, common attack types, basic cryptography, authentication, without assuming you already know how to attack anything.
4. Guided hands-on practice (ongoing from here). TryHackMe's "Complete Beginner" path, and later HackTheBox's "Starting Point" tier, both free or nearly free, give you guided labs before you're expected to work anything blind.
That's roughly three months of fundamentals before touching genuinely unguided practice. This is not a slow timeline, it's the actual timeline. Content promising "job-ready in 30 days" from zero is selling a feeling, not a real outcome.
A weekly structure that actually holds up
Five to seven hours a week, broken into two or three sessions, works better than one long weekend session. Consistency across months matters more than intensity in any single week, this is true throughout security learning, not just at the start.
Keep a simple log, what you covered, what confused you, what you want to revisit. It sounds unnecessary at this stage. It becomes the habit that carries you through everything after fundamentals, and it's far easier to build now than to bolt on later.
What comes after this
Once fundamentals are genuinely solid, the path forks based on what you find interesting, web application security, network penetration testing, and each has its own next layer of free resources (PortSwigger's Web Security Academy for web-specific work is worth knowing about even at this stage, just to see what's ahead).
Where mentorship actually fits for this stage
Being direct here rather than generic: 1:1 mentorship isn't the right fit for someone at day zero. The fundamentals above are genuinely better built through consistent free practice than through paid guidance, there's nothing at this stage that a mentor does faster than a good habit and three months.
Where it becomes relevant is later, once you've built the fundamentals and hit the same wall a lot of people hit next: you know the material, you've done the guided labs, and you still can't work an unfamiliar target or you're not sure your foundation is actually solid enough to move forward on. That's a real, common, and specific point to reach out, not before it. If that's where you end up in a few months, the mentorship page explains how the next stage works.