I'm 16 and just getting started with C. My long-term goal is to work in vulnerability research and exploit development, with reverse engineering as a major part of that path.

I'm trying to avoid the common mistake of jumping between tools, courses, and trendy topics without understanding the fundamentals.

For those of you who do security research professionally:

1. What would you learn, and in what order, during your first year?
2. How important are C, assembly, operating systems, computer architecture, Linux, networking, and Python? Which should I prioritise instead of trying to learn everything at once?
3. When does it make sense to start studying memory corruption, fuzzing, debugging, and vulnerability analysis?
4. Which labs, books, or practical projects actually teach you to think like a researcher rather than just follow tutorials?
5. How many hours of focused practice per week is a realistic target for a beginner?
6. What separates someone who can solve CTF challenges from someone who can independently discover and understand real vulnerabilities?

I'm not looking for exploit code to copy or a shortcut into the industry. I want to develop the ability to understand systems deeply and eventually find problems that other people have missed.

If you were starting again today, what would you focus on first, and what would you deliberately postpone?

i feel something might be missing 😕 🤔