Every week I get messages from people asking "what certification should I get first" or "should I learn Python or Linux first." Wrong questions. Here's what I've learned getting people from zero to their first pentest engagement:

What actually matters:

1. Networking fundamentals, deeply. Not "what is a subnet" trivia — you need to be able to picture a packet's entire journey from your laptop to a server and back, including every device that touches it. Almost every vuln class (MITM, ARP spoofing, misconfigured firewalls) is just a networking concept exploited. Skip this and everything else you learn is memorization instead of understanding.

1. Comfort in a Linux shell, not comfort with Kali. People install Kali on day one and think they're hacking. You're not — you're clicking buttons in a GUI. Real progress happens when you can navigate, pipe, grep, and script without thinking about it. Kali is a toolbox; it doesn't make you a carpenter.

1. A home lab you break constantly. You do not learn security by reading. You learn it by misconfiguring a service, breaking it, and figuring out why. Spin up VMs, intentionally vulnerable machines (HTB, TryHackMe, VulnHub), and just go. The people who progress fastest are the ones who are comfortable being stuck for hours.

What doesn't matter as much as people think:

1. Certifications, early on. OSCP, Security+, whatever — they matter for getting past HR filters later, but they will not teach you how to think like an attacker if you don't already have the fundamentals above. Get the skills first, let the cert be a checkpoint, not a starting point.

1. Which distro / tool is "the best." This is bikeshedding. Nmap vs. Masscan, Burp vs. ZAP — pick one, learn it properly, move on. Tool-hopping is a procrastination habit disguised as research.

If you're just starting out: spend your first month almost entirely on networking + Linux before you touch a single "hacking tool." It feels slow. It's not — it's the only thing that compounds.

— Nova