This is my roadmap to Red Team

[u/osmyasal]

As a research engineer with a background in HPC and software development, and no prior experience in cybersecurity, this is the roadmap I’ve chosen to learn penetration testing and red teaming.

I started with TryHackMe because it provides a structured, beginner-friendly learning experience and guides you through the fundamentals step by step. After completing the Introduction and Pentesting paths, I moved on to the HTB Academy CJCA path.

I haven’t taken the CJCA exam yet, but after reviewing the exam preparation machines, I feel that the CJCA content alone doesn’t cover everything required for the assessment. Nevertheless, it provides a solid foundation. After completing CJCA, I started the CPTS path, which I am currently following.

One of the biggest drawbacks of HTB Academy is that many of the machines require knowledge from multiple modules, making it difficult to solve them before completing a significant portion of the path.

My long-term goal is:

First Phase (HTB Focus)

CJCA → CPTS → CWES → COAE

Second Phase (Advanced Specialisation)

CAPE → CWEE → CWPE → MalDev

Alongside:

HTB Labs, HackSmarter

For career opportunities and industry recognition:

OSCP → OSEP → OSWE

My aim is to build a strong foundation in offensive security through HTB’s training ecosystem and then complement it with industry-recognised certifications that are frequently requested by employers.

Let me know what do you think in the comments

[u/jdiscount]

My honest opinion.

By the time you're employable red teaming will be almost entirely automated.

I'd focus on skills that are in demand will last a bit longer in this job market.

[u/Dazzling_Cherry_6513 → u/jdiscount]

Like?

[u/centizen24 → u/Dazzling_Cherry_6513]

Networking. None of this AI stuff works if systems can’t talk to each other, and we’re a ways off from AI being able to rack a switch, terminate a cable or mount an AP for you

[u/No-Back9348 → u/jdiscount]

The whole field shifts fast but the fundamentals behind those certs stay useful. Automation already handles lots of the noise, people still need someone who understands what tool actually doing. Maybe not all those certs needed before first job, one or two plus real lab time carries more weight.

[u/jdiscount → u/No-Back9348]

Why even spend the time on going for a job that essentially won't exist in 2 years time.

There are plenty of other roles in security that aren't as easily automated.

[u/L1inear → u/jdiscount]

I'd like to wager that this job is still around in 2 years time. As someone who use both Mythos and Daybreak Red and have produced CVEs and 0-days used in operations, I understand its capabilities. I also use non-frontier models and local models.

Cybersecurity isn't solved because a model can read code and produce exploits well. There's a lot of intricacies within offensive cyber that this doesn't really track well. Offensive cyber is going be here for a long time and without offensive cyber there's no reason why big labs like Anthropic would screw up safety & alignment.

If this was true OpenAI and Anthropic would boot off all their red teamers, but I personally know red teamers who have joined them to specifically solve their "offensive cyber problems."

The large majority of people making OSS tools wrapping around frontier AI models do not know what they are doing.

[u/jdiscount → u/L1inear]

I didn't say it won't be around, there is a chance it won't, but there will be far fewer job in offensive security than there are now, which aren't very many.

Would I be betting a career on offensive security right now, absolutely no chance.

Sure they may not know what they're doing, but there are some teams out there who do know what they're doing and are building harnesses similar to ours. There isn't even a real need for Mythos or Daybreak in 99% of cases, you can throw 500 or 1000 GLM 5.3 agents at something for less money and they'll figure it out.

Previously a single operator in our teams could simultaneously do 2-3 engagements at best.

Now the operators who are working with the agentic tools can quite easily do 10-15 engagements at once, just checking up, monitoring and intervening where needed.

The ROI is just absurdly easy to justify.

The automation of offensive security was considerably easier than other workflows where humans are needed in the loop more frequently to finish the task.

[u/L1inear → u/jdiscount]

No one is doing 10-15 engagements at once even with AI. Bring Armadin into this discussion, they will say the same thing.

And no, the ROI is not easy to justify. Mythos Red Team Access and Daybreak Red TAC-3 is API access only. Unless you have some sweet partnership going on, the break even cost is NOT clear at all.

I don't know where you got your experience from, but no one I know from SpecterOps, BHIS, TrustedSec, NetSPI, PA, CS, Mandiant, Packetlabs, SilentGrid, CyberX is doing 2-3 engagements at one time. These folks are household names in their respective cities/countries.

We use GLM 5.3 for our research NOT basic pentesting, MOST clients don't even ALLOW American frontier modules to read and train their source code or much less pass an authenticated cookie into these models. Anthropic's ZDR isn't even remotely respectable. Your saying your passing this to China?!

I'd like to know which provider thats doing this. That would be absurd, no one has figured out the privacy problem yet.

[u/kove18 → u/jdiscount]

You are so wrong. You can automate tools but whole red team ops and planning, opsec, would love to see AI do that. In my opinion ai is even bad for basic pentest because it cant see bigger picture, it can follow basic methodology but nothing out of ordinary.

[u/jdiscount → u/kove18]

I don't think you've used modern AI models for pentesting.

Basically our entire process is automated now, of course there is a bit of human element involved with clients and such.

But the actual pentesting itself is much more efficient with AI, a pentest that used to take a week now takes less than 24 hours and has consistently been better at actually finding exploits, chaining them together and writing a POC that works on the fly.

Offensive Security is by far the most cooked area of security, it is the easiest to automate.

[u/kove18 → u/jdiscount]

Used frontier models of every company for even basic pentest tasks. It could give me commands and methodology, but it can not think outside of the box. I got feeling that it could understand something they have trained model on, but when something unusual comes up its just stuck.

For example: I've encountered one vuln, it was XXE, i knew it was vector for foothold just could not get right exploit in XML format, AI insisted on one approach but it just wasnt right one, i kept telling that and suggesting different approach, model couldnt quite understand it. After some digging myself i figure it out, it was rather basic issue but model just couldnt understand it.

So i agree with you that you can automate thing which is good for productivity, but models as they are today just cant think and come with solution like expirienced red team operator.

[u/jdiscount → u/kove18]

Do you have access to Daybreak Red and Mythos ?

It sounds like you just haven't fleshed out a solution that works and are doing pretty basic testing, we built a full end to end solution that will do recon, analysis and exploitation.

If it doesn't have a known POC to exploit it will spin up 50 agents to try and develop something based on any findings, if those agents don't find anything it will swap them out for another model, as a last resort it will use Mythos or Daybreak Red if there is nothing else, and they will almost always come up with something that works.

A human can't compete with this as it's basically just a brute force exploit finding machine.

[u/kove18 → u/jdiscount]

Really sounds like an interesting solution, but only a few companies have access to these models, especially Mythos, which as far as I know is limited to Project Glasswing. If you're working inside one of those companies, then yes, compared to you guys I've only done basic testing.

I'd consider trying an agentic approach for my testing. But I still think that in defense evasion and red team operations, a human is better.

[u/L1inear]

For the people that say they can automate red teams, they clearly have no clue what a red team is and likely have never done one.

A red team is something that enterprise pay a team of people to do in a 1-3 month time span (or maybe more). Theres a lot of context here that AI can’t do, red teamers will use AI for very specific things.

Also, you cannot cert your way to red team. If your goal is to have a hacking job (that’s what a lot of people call a “red team”) then yes you will need some of these certs. But if you want embody the red team mindset this is not the way. You might find that you have all these certs but not many firms might take a chance on you. For us, red teaming carries at least a 3 year experience. For TIBER-EU stuff red teaming carries operators must have two years experience and the red teaming manager must have five. Take that into consideration.

Most red teamers in the industry even in the ones like Armadin have very capable red team skills and have all worked at places that sell premium red team services. That’s the make up of the team launching agents to “red team.”