Stop Telling Beginners to Start With CompTIA A+.

The Most Repeated Advice in Cybersecurity Is Wrong

Someone joins a cybersecurity Discord. Types one sentence:

"I want to get into cybersecurity. Where do I start?"

Within minutes, the thread fills up. And somewhere in the first five replies, it appears:

"Start with CompTIA A+. It's the foundation. You need to crawl before you walk."

This advice gets repeated so frequently, so confidently, and by so many people — that questioning it feels like arguing against gravity.

I'm arguing against it.

Not because the CompTIA A+ is useless. Because telling every beginner to start there is lazy advice that wastes months of their time, costs them money they may not have, and optimizes for a path that doesn't lead where they think it leads.

What CompTIA A+ Actually Is

The A+ certification tests knowledge of PC hardware troubleshooting, printer maintenance, mobile device management, basic networking, and operating system support.

It is a help desk certification.

Not an insult — help desk work is real work, and the A+ is a legitimate credential for that specific path. But it was designed to certify IT support technicians, not security practitioners.

The exam covers how to replace a RAM stick. How to troubleshoot a printer. How to set up a Windows workstation for a new employee. How to identify which port a monitor cable uses.

None of this is security work.

The people who need CompTIA A+ are people who want to work IT support. That is a real career path with a genuine role for this certification.

The people who want to work in cybersecurity are being handed a map to a different destination.

The "Foundation" Argument Doesn't Hold

The defense of A+ always sounds the same:

"You need to understand computers before you can hack them."

True. Also irrelevant to whether A+ is the right way to build that understanding.

The A+ teaches you how computers break for the purposes of fixing them. Cybersecurity requires understanding how computers work for the purposes of understanding what can go wrong at a systemic level — networks, authentication, trust relationships, data flows, permissions.

These are different knowledge bases.

Understanding TCP/IP matters for security. The A+ covers networking at a level too shallow to be useful for security work. You'll learn enough to pass the exam and not enough to understand what an Nmap SYN scan is doing or why a misconfigured DNS server is an attack surface.

Understanding operating systems matters for security. The A+ covers Windows troubleshooting at a user-support level. It doesn't cover Linux, which is the operating system of nearly every server, cloud instance, and offensive security tool in existence.

Understanding hardware matters for… IoT security and physical access testing. Which are real but represent a fraction of the security roles available and are not where most beginners are headed.

The foundation argument assumes A+ builds the foundation for security work. It builds the foundation for IT support work. These foundations overlap partially and diverge substantially.

The Real Cost Nobody Calculates

CompTIA A+ requires two exams. Current exam cost: approximately $246 USD per exam. Total: approximately $492 USD, plus study materials, plus the time to prepare — typically 2 to 4 months for someone starting from zero.

At the end of this investment, you have a credential for IT support work and knowledge that partially overlaps with what security work requires.

Now calculate what $492 and 3 months produces if directed differently:

TryHackMe Pro subscription: $14/month. 3 months = $42. Access to structured, hands-on security learning paths that build directly applicable skill. Change remaining from A+ budget: $450.

HackTheBox subscription: $14/month. Real machines, real methodology, real skill building.

PortSwigger Web Security Academy: $0. Free. Comprehensive. Built by the team that makes Burp Suite. Directly applicable to bug bounty and web application security.

Bug bounty hunting on public programs: $0. Real targets. Real methodology. Portfolio-building output.

The $492 A+ budget funds 2 years of TryHackMe and HackTheBox simultaneously, with money left over for a book or two — while producing directly applicable security skill and portfolio evidence that A+ never produces.

The advice to start with A+ is expensive in both money and time, in ways that the people giving the advice often don't calculate.

Who Actually Gives This Advice and Why

The A+ recommendation comes from four sources.

YouTube channels with CompTIA affiliate links. Every sale of a CompTIA study guide or exam voucher through their link generates commission. The recommendation is not purely educational.

People who took the A+ path themselves. Survivorship reasoning — "I did it this way and it worked, therefore it's the right way." This doesn't account for whether a different path would have worked faster, or whether the A+ was the reason they succeeded rather than something they succeeded despite.

Reddit threads where the same advice gets upvoted repeatedly. Online advice communities optimize for consensus, not accuracy. The answer that gets upvoted is the answer that matches what people have seen before — which is the previous upvoted answer. The loop self-reinforces.

Hiring managers at large enterprises who genuinely require it. This group is real. Large IT organizations with formal HR requirements sometimes list A+ as a prerequisite for entry-level roles. If you want to work IT support at a large corporation as a stepping stone, A+ makes sense for that specific goal. But this is a minority of cybersecurity career paths and shouldn't be the universal starting recommendation.

What Beginners Actually Need

The goal isn't credentials. The goal is enough applied skill to produce something real — a lab writeup, a HackerOne submission, a tool on GitHub — and enough understanding to interview credibly for an entry-level security role.

Here's what produces that outcome faster than A+:

Linux fundamentals — actually applied. Not a course. Install Ubuntu or Kali in a VM. Use it as your primary computing environment for a month. Break things, fix things, read man pages. The command line fluency you build by using Linux daily is more durable and more applicable than anything a certification exam tests.

Networking fundamentals through Wireshark. Open Wireshark on your home network. Watch a DNS query resolve. Watch a TCP handshake complete. Watch an HTTPS connection establish. The OSI model becomes real when you can see it in packet captures — not when you've memorized the layer names for an exam.

TryHackMe's free paths or PortSwigger Academy. Structured, hands-on, security-specific, and free. Both platforms force you to apply concepts in environments that resemble real targets more closely than any multiple-choice exam.

One real bug bounty submission — any severity. The process of finding something, documenting it professionally, and submitting it teaches more about security methodology than any course. A Low severity valid finding or even a duplicate teaches you what you're missing in a way that a completed curriculum never does.

None of this costs $492. None of it takes 3 months before you touch security content. All of it produces demonstrable output.

The Specific Scenario Where A+ Makes Sense

This is not a blanket argument against the A+.

If your goal is IT support work at a large organization that requires it, get the A+. It's the right credential for that specific role.

If you have zero technical background and the hands-on alternatives feel completely inaccessible, A+ provides structured learning that builds some foundational vocabulary. Some foundation is better than no foundation.

If your employer will pay for it and it satisfies a checkbox requirement for your current role, take it.

But if you are a beginner who wants to work in cybersecurity — offensive security, application security, bug bounty, penetration testing — and someone tells you to start with A+ as your first step toward that goal, understand what they're actually giving you:

A detour.

A potentially expensive, 3-month detour into content that is adjacent to but not on the path you're trying to walk.

The Advice That Should Replace It

When a beginner asks where to start, the honest answer requires one follow-up question:

What specifically do you want to do in cybersecurity?

Web application security and bug bounty → PortSwigger Web Security Academy, then TryHackMe web paths, then public bug bounty programs.

Penetration testing → TryHackMe, then HackTheBox, then OSCP when the skill is there to support it.

Cloud security → AWS or Azure free tier, hands-on labs, cloud security specialization content.

GRC and compliance → CompTIA Security+ is actually appropriate here — it covers the governance and compliance frameworks that GRC roles require.

SOC and defensive security → Blue team paths on TryHackMe, SIEM hands-on labs, Security+ if the employer requires it.

The A+ appears nowhere on this list. Because the question "where do I start in cybersecurity" doesn't have one answer — and the answer that applies to the largest number of people who want to work in security is not a help desk certification.

The Last Thing

The people giving the A+ recommendation aren't malicious. Most of them genuinely believe it's good advice.

But good intentions and accurate advice are different things. The cybersecurity community has repeated this recommendation so many times that it achieved the status of conventional wisdom — and conventional wisdom in a fast-moving field is frequently just old advice that nobody has re-examined.

Re-examine it.

Ask the person recommending A+ when they last looked at the CompTIA exam objectives and compared them to the skills that actual security job postings require. Ask them how many people they know who got hired into security roles specifically because of their A+ certification. Ask them whether they'd give the same advice to someone who told them they specifically wanted to do penetration testing.

The answers will tell you how much the recommendation was thought through.

Stop telling beginners to start with CompTIA A+.

Tell them to start with the work.

Key Takeaways

• CompTIA A+ is a help desk certification — it was not designed for security practitioners and does not build security-specific skills efficiently
• The "foundation" argument is flawed — A+ builds foundation for IT support, not for security work
• Real cost: $492 + 3 months produces a support credential; the same investment in hands-on security platforms produces applicable skill and portfolio output
• The recommendation persists because of affiliate incentives, survivorship bias, and self-reinforcing online consensus — not because it's the optimal path
• Beginners need applied, security-specific starting points: PortSwigger, TryHackMe, HackTheBox, public bug bounty — all cheaper, all more directly applicable
• A+ makes sense for: IT support roles, employer-required checkboxes, and beginners who need maximum structure before touching security content
• The right starting advice requires one question first: what specifically do you want to do in cybersecurity?
• Conventional wisdom in a fast-moving field is often just old advice nobody re-examined

rem//S