A guide to entry-level and career-stage cyber security certifications for UK learners: what each covers, prerequisites, how they're viewed by employers, free and funded routes, UK Cyber Security Council professional titles, and how to choose.
Cyber security has a confusing alphabet soup of certifications. The right one depends on where you're starting and where you want to go. Certifications help get past CV filters, but employers also value practical skills and experience, so combine them with hands-on practice.
Starting from scratch
- ISC2 Certified in Cybersecurity (CC): an entry-level certification covering security principles, access control, network security and operations. ISC2 has offered free online training and exam vouchers for it through its "One Million Certified in Cybersecurity" programme; check current availability.
- CompTIA Security+: a widely recognised foundation certification covering threats, architecture, operations and governance. It's vendor-neutral and often listed in job adverts.
- Google Cybersecurity Certificate: an online professional certificate with practical labs, usually via a subscription platform.
If you're new to IT entirely, networking and operating system basics come first. CompTIA's Network+ or free networking courses can fill that gap.
Next steps by specialism
- Security operations and blue team: CompTIA CySA+, or vendor certifications for security tools used by employers.
- Penetration testing: CompTIA PenTest+ and the hands-on OSCP from OffSec, which is highly regarded but demanding. In the UK, CREST and CHECK schemes matter for some testing roles, especially for government work.
- Cloud security: security certifications from AWS, Microsoft Azure and Google Cloud, and the vendor-neutral CCSK or CCSP.
- Governance, risk and compliance: ISO 27001 lead implementer or auditor courses, and ISACA's CISM or CRISC for experienced professionals.
Senior certifications
CISSP from ISC2 is a respected certification for experienced practitioners and managers. Full certification requires five years of relevant paid work experience in at least two of its domains (with possible one-year waivers). Passing without experience gives Associate of ISC2 status.
UK professional titles
The UK Cyber Security Council, the government-backed professional body, awards professional titles: Associate, Principal and Chartered, in specialisms such as security architecture, incident response and governance. These are assessed on competence and experience, and are increasingly recognised.
Free and funded routes in the UK
- CyberFirst: NCSC programmes for young people, including bursaries and degree apprenticeships.
- Apprenticeships: cyber security apprenticeships at various levels, with training funded and a salary paid.
- Skills Bootcamps: free courses in England for eligible adults, including cyber security.
- Free learning platforms and capture-the-flag challenges for practical skills.
Practical experience
- build a home lab with virtual machines;
- practise on legal training platforms and capture-the-flag events;
- write up what you learn in a blog or portfolio;
- contribute to open-source security projects.
Only test systems you own or have explicit permission to test. Unauthorised access is a criminal offence under the Computer Misuse Act 1990.
Costs and funding
Exam fees range from free (through promotions such as ISC2's CC programme) to well over a thousand pounds for advanced certifications, before any training course. If you're employed, ask about your training budget: many employers pay for exams relevant to your role. Check refund and resit policies before booking, and be wary of unofficial "exam dumps", which breach certification rules and can get you banned.
Keeping certifications
Many certifications expire unless you earn continuing professional education (CPE) credits and pay annual maintenance fees. Factor this in.
How do you choose?
- Look at 20 job adverts for the role you want and note which certifications appear.
- Pick one foundation certification.
- Combine it with practical projects.
- Add a specialist certification once you know your direction.
Frequently asked questions
Do I need a degree for cyber security?
No. Many people enter through apprenticeships, IT support roles or self-study plus certifications.
Is CEH worth it?
It's known among some employers, but many technical teams value hands-on certifications more. Check adverts in your target sector.
Sources and further reading
- ISC2: Certified in Cybersecurity
- CompTIA Security+
- UK Cyber Security Council: Professional titles
- NCSC: CyberFirst
- ISC2: CISSP experience requirements
- legislation.gov.uk: Computer Misuse Act 1990
Facts checked on 20 October 2026. Spotted an error? Tell us and we will correct it.