What are the most suitable cyber security certifications for a 16 year old who wants to go into penetration testing, cyber security and network security?

  • Downvoting without giving a reason is not polite. If you want to downvote somebody (with 16 years) that makes a pretty good question about security certifications (even if the question can be asked much better) that can help many others; at least write in a comment your reasons. Thank you!.
    – KanekiDev
    Nov 10, 2016 at 14:33
  • 2
    This is going to be fairly opinion based, and will vary based on geographic factors - if you're in the UK, for example, getting CREST Registered Tester status is a good step, but it would be difficult to do in countries without CREST presence.
    – Matthew
    Nov 10, 2016 at 14:42
  • While I think Kaneki and Ninja's answers are excellent, the question will unfortunately have different answers from different people - this type of question is too broad/opinion based as it depends a lot on you, what jobs you get etc
    – Rory Alsop
    Nov 10, 2016 at 20:55
  • I completely disagree with you @Rory Alsop. In the cybersecurity world, some certifications are better considered than others, some are focused mainly in management, some others not; some are mainly theory, some others focus more on practice. You can't get too many answers, for now there are just 2 and are so similar.
    – KanekiDev
    Nov 11, 2016 at 7:14
  • Kaneki- take for example the UK. As Matthew said, here CREST is the gold standard for penetration testers, and will get you the jobs. Comp TIA or CEH would never be on my list - I'd prefer to see some solid technical quals (in web app dev, or networks etc) when hiring testers. And you don't mention CSX.
    – Rory Alsop
    Nov 11, 2016 at 7:20

2 Answers 2


First of all i'd like to welcome you to the security and pen-testing world. It's a very amusing one.

Then let's answer, as Ninja Wabbit said, but there are a little bit more:

  • SANS certifications: probably the SANS certifications are the highest recognized and the best in security. But those certs are so expensive, about 5000-6000 USD ($).
  • Comp TIA Security + / Network + : is one of the most suitables for you as learner. It starts from a low level, and its price is fair enough.
  • CEH: eccouncil's certification is not as well considered as many people think. Is mostly a theory knowledge you can get from it, and its price can go pretty high (more than 1000 $).
  • CISM: this certification is not for you. CISM is mostly for managers, not for pen-testers nor ethical-hackers, forget CISM unless you want to be a cybersecurity team manager.
  • CISSP: as CISM is pretty focused for management, policies creation, etc... but not for pen-testing as you want (as you say in your question).
  • OSCP: Offensive-Security Certified Professional. Well, THIS IS THE ONE you want. Offensive Security is the team behind the pen-testing linux distribution "Kali". This one, even being a little bit expensive too (up to 1000$) is one of the best considered among the cyber security specialists. This one would lead you to the pen-testing, and this is the one i would recommend. But not now, it is thought by many people that it is pretty hard.

Finally in my opinnion i would suggest you to:

  1. Start learning some computer basics (programming, scripting, OS, ...).
  2. Start learning some security basics.
  3. Maybe start some basic courses (cheap ones).
  4. Buy books, read... read a lot. You need to read a lot to become a high-level security professional.
  5. PLAY! Set up your own vulnerable environment (you can find many on the internet) and try some basics, keep playing while you're learning.
  6. Get the certifications you want / you can afford.

And finally two last sentences: "Good luck!" & "With great power comes great responsibility"

  • Do you think having somebody to coach me and teach me a little is a good option. If so how would I go about finding said person?
    – user24113
    Nov 10, 2016 at 14:35
  • well.. this depends a lot on you. Some people (as me) prefer to learn by themselves, with curiosity, reading, looking for information, "playing" (playing but legally). While some other people prefer/need somebody to teach them. It depends on you, on what's the way you want to learn. But both are valid enough. If you want to find somebody, the very first need: ensure yourself that your coach is a nice-guy, a legal one, a white-hat, not any kind of criminal (he may use you for some evil purposes). So care so much about choosing the right person.
    – KanekiDev
    Nov 10, 2016 at 14:48

That depends on what said 16-year-old already knows, of course.

More important than anything else, know-how and experience are key. That is what gives certifications their punch, and there is nothing more painful than encountering a "paper tiger" with seventeen certifications and a Master's Degree in Information Security who has passed a ton of exams and written a thesis, but has zero real-world experience or know-how.

Beginning with the basics though, I would look at the following:

  • CompTIA Security+
  • CompTIA Network+
  • Certified Ethical Hacker (CEH)
  • Any SANS courses that are of interest - try to build up a certification
  • Any IISP accredited training
  • CISSP / CISM Preparation

Later on (as s/he gains some work experience):

  • IISP Full Membership
  • CISSP / CISM Certification (these are losing value against IISP these days)

Note that the CompTIA courses are VERY basic, but they do provide a bare minimum baseline from which to start.

CEH is not as hard as it sounds - as a result, it is also not incredibly valuable. Still, it is a start in a direction.

If interested in penetration testing, any additional networking and programming certifications are immensely useful.

The SANS courses are excellent, and deeply technical when covering technical subjects. Very worth pursuing, and SANS certifications are very valuable for a technical career.

Membership of the IISP is fast beginning to eclipse the CISSP / CISM and other "top" security certifications, as many employers view those certificates as little more than confirmation that a person can sit and pass a long exam.

Note: I am not aware of the age limits for any of these certifications - such things stopped applying to me a long, long time ago.

  • Thanks a lot for the information, I greatly appreciate it.
    – user24113
    Nov 10, 2016 at 14:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.