Building Your 90-Day Progression Plan

Good intentions fade quickly. "I will study cybersecurity" becomes "I will start next week" for months. A plan turns an ambition into a calendar of small, measurable actions. In this lesson you will build a realistic 90-day plan that fits your life, combines reading, practice and proof of work, and ends with a concrete step toward a certification, a first program or a first job application.

Why 90 days?

Ninety days is long enough to make visible progress and short enough to stay motivated. It is about thirteen weeks: three phases of one month. At the end you review, adjust and plan the next 90. Think of it like training for a first race: you do not decide to run a marathon on Monday; you follow a progressive plan.

The principles of a good plan

• Be realistic. Count the hours you truly have each week. Five regular hours beat twenty hours planned and abandoned.
• Mix input and output. Reading and videos are input; labs, scripts, writeups and reports are output. Aim for more output than input, since output is what builds skill and portfolio.
• Have one main goal. A single clear target, such as "prepare for an entry-level certification" or "land a SOC analyst interview", beats five vague ones.
• Make goals measurable. "Complete ten guided lab rooms and publish three writeups" is measurable. "Learn hacking" is not.
• Avoid tutorial hell. Watching endless tutorials without building anything feels productive but is not. After each learning session, produce something.
• Protect rest. Burnout ends more learning journeys than difficulty does.
• Stay legal. Every practical activity happens in your lab, on legal training platforms or in explicit programs.

Step 1: define your goal and your time

Write one sentence: "In 90 days I will ____." Then count your weekly hours, for example: three evenings of one and a half hours, plus one weekend session of three hours, equals seven and a half hours per week. Multiply by thirteen weeks to know your total budget, and size your goals to fit it.

Step 2: the three phases

Days 1 to 30: consolidate

Goal: strengthen the foundations and organize your tools.

• Review the weak points of the earlier courses: networks, Linux, web basics, the penetration testing method.
• Make sure your lab works and has snapshots. Add one new scenario, such as a small Active Directory lab from chapter 1.
• Finish and polish your Python scripts from chapter 2.
• Start a daily or weekly note-taking habit.
• Complete a first set of guided learning paths on a training platform.
• Milestone: a working lab, three polished scripts, and a clear folder structure for your portfolio.

Days 31 to 60: specialize and practice

Goal: go deeper in the direction you chose in lesson 7.1.

• Choose a track: for example web and API testing, defensive analysis, or cloud security.
• Work through labs related to that track on legal platforms, and write notes for each one.
• Join a beginner-friendly CTF or a community study group.
• Publish your first two writeups, respecting platform rules.
• Study the official objectives of your target certification, if you chose one.
• Milestone: two writeups, a CTF participation, and a mapping of the certification objectives to your current skills.

Days 61 to 90: prove and connect

Goal: turn skills into evidence and opportunities.

• Assemble and review your portfolio, with the three best items first.
• Take practice assessments or exams for the certification, or book the exam date if you are ready.
• Start with a vulnerability disclosure program or a beginner-friendly bug bounty target, if that suits your goal, after reading the policy twice.
• Update your CV and professional profile with concrete, honest achievements.
• Reach out to the community: meetups, online groups, mentors. Apply to a few roles, even if you do not feel fully ready.
• Milestone: a published portfolio, a booked exam or first application, and a review of the next 90 days.

A weekly rhythm that works

Block	Purpose	Example
Learn (about 25 percent)	New concept or technique	Read one chapter, one official documentation page
Practice (about 40 percent)	Hands-on in a lab or platform	One guided room, one lab exercise
Produce (about 25 percent)	Notes, writeups, scripts, reports	A short writeup or a script improvement
Connect and review (about 10 percent)	Community, feedback, weekly review	A question on a forum, ten minutes of weekly reflection

These percentages are guidelines, not rules. Adapt them to your goal and experience.

Measuring progress without fooling yourself

• Output metrics: labs completed, writeups published, scripts finished, hours practiced.
• Skill checks: redo an old lab without notes and compare the time; explain a topic aloud without reading.
• Feedback: a mentor or peer reviews one of your portfolio items.
• Weekly review: ten minutes: what went well, what blocked me, what do I change next week?

Beware of vanity metrics such as the number of videos watched or tools installed.

Handling setbacks

• You missed a week. Do not try to catch up by doubling. Resume the plan and cut the least important tasks.
• You are stuck on a lab. Use a time limit, then look for hints in official documentation or ask in a community, without copying solutions. Note what you learned from the hint.
• You feel like an impostor. This is very common in security, where the field is huge. Nobody knows everything. Compare yourself to your past self.
• You lose motivation. Return to your "why", reduce the scope for a while and celebrate small wins.

A sample plan, filled in

Here is a short example for a fictional learner, "Sam", who works full time and has six hours per week. Goal: "In 90 days, publish my portfolio and be ready to apply to junior SOC roles."

Goal: portfolio published + ready to apply to junior SOC roles
Time: 6 h/week (2 weekday evenings x 1.5 h, 1 weekend block x 3 h)

Days 1-30   Consolidate
  - Lab working with snapshots; log source added to a small SIEM-like setup
  - Polish log_summary.py and scope_check.py
  - Finish 6 guided blue-team rooms on a training platform
  Milestone: 3 scripts + 6 rooms + notes

Days 31-60  Specialize
  - Write 3 detection use cases mapped to ATT&CK techniques
  - 1 beginner CTF; 2 writeups (platform rules respected)
  - Compare 2 certifications; choose Security+ objectives as syllabus
  Milestone: 3 use cases + 2 writeups + certification study plan

Days 61-90  Prove and connect
  - Publish portfolio with README and ethics statement
  - Practice assessments; book the exam
  - Update CV; apply to 5 roles; attend 1 local meetup
  Milestone: portfolio public + exam booked + 5 applications

Your turn: write your own plan

Using the template above, write your 90-day plan on one page. Include: your goal sentence, your weekly hours, three milestones (one per phase), at least two output deliverables per phase and one risk you foresee with how you will handle it.

See a solution

A good plan has these characteristics, whatever your goal:

• The goal is one specific sentence with a date or deadline.
• The weekly hours are honest, with fixed time slots in a calendar.
• Each phase has a milestone that produces a visible deliverable, not just "study more".
• Practice and production outweigh passive input.
• A risk and a mitigation, for example: "Risk: busy periods at work. Mitigation: a minimum plan of two sessions per week and a shift of the timeline by up to two weeks."
• It includes at least one outward-facing action, such as a meetup, a mentor message or an application.

Compare your plan with this list and fix what is missing.

Portfolio step

Save your plan as 90-day-plan.md in 07-career-plan. Put the first three weeks in your calendar with specific dates and times. Commit to a review date at day 30. Share the plan with a friend or mentor; accountability multiplies the chance of success.

Next, we look at how to keep learning and stay connected after the 90 days.