Professor Messer SEC is a free, complete video series designed to prepare learners for the CompTIA Security+ certification exam. It covers all official domains including threats, attacks, vulnerabilities, architecture and design, implementation, operations and incident response, and governance, risk, and compliance.
The series is hosted by Dr. Joseph Messer, a certified IT professional with decades of experience in networking and cybersecurity. His teaching style emphasizes clarity, practical application, and real-world context, making complex topics accessible to beginners and intermediate learners alike.
Each lesson is approximately 10-15 minutes long, structured around specific exam objectives. The content is updated regularly to reflect changes in the CompTIA Security+ SY0-701 exam blueprint, ensuring alignment with current testing standards.
Professor Messer SEC uses a modular format. Each video targets one or two specific objectives from the CompTIA Security+ exam outline. For example, a video titled "Understanding MAC Addresses" explains how Media Access Control (MAC) addresses function in Ethernet networks, their role in device identification, and how they're used in filtering and access control.
Lessons begin with a brief explanation of the concept, followed by a demonstration using real tools or scenarios. A typical segment on firewall rule configuration shows how to set up allow/deny rules based on IP ranges, ports, and protocols-using a virtual lab environment that mirrors real enterprise setups.
After each module, Professor Messer includes a quick quiz or recap. These aren't graded but serve as mental checkpoints. He often references the official CompTIA exam objectives document, citing exact domain numbers (e.g., "Domain 2.3: Identify common attack vectors") to reinforce alignment with test content.
The series is divided into six major units, each corresponding to a primary domain in the Security+ exam. The following table outlines the structure and key subtopics covered:
| Domain | Key Topics Covered | Number of Videos |
|---|---|---|
| Threats, Attacks, and Vulnerabilities | Phishing, ransomware, zero-day exploits, social engineering, DDoS mitigation | 42 |
| Architecture and Design | Secure network segmentation, cloud security models, secure endpoint configurations | 36 |
| Implementation | Implementing firewalls, IDS/IPS, encryption standards (AES, RSA), MFA setup | 51 |
| Operations and Incident Response | Forensic imaging, chain of custody, incident handling procedures, log analysis | 38 |
| Governance, Risk, and Compliance | Risk assessment frameworks, data classification, privacy laws (GDPR, HIPAA) | 29 |
| General Security Concepts | Authentication methods, role-based access, least privilege, defense in depth | 24 |
Each unit builds on the previous one. For example, after covering basic authentication methods like passwords and tokens, the series moves into multi-factor authentication (MFA), explaining how time-based one-time passwords (TOTP) work via apps like Google Authenticator.
A non-obvious point often missed by other free resources: Professor Messer includes detailed explanations of common exam traps. For instance, he clarifies that while "firewall" and "router" both filter traffic, a firewall operates at Layer 3-4 (network and transport layers), whereas a router primarily routes packets based on IP address and subnet-critical distinctions for passing the exam.
Professor Messer SEC is widely used by individuals preparing for the CompTIA Security+ certification, especially those studying independently. It's particularly effective for visual and auditory learners who benefit from seeing concepts demonstrated rather than reading dense manuals.
Many users report completing the entire series in under 60 hours. One learner completed the course in 45 days while working full-time, averaging 1.5 hours per day. They passed the exam on the first attempt with a score of 820 out of 900.
Organizations also reference the series internally. A mid-sized healthcare provider in Texas used it as a baseline training tool for new IT staff. After completing the series, employees scored 30% higher on internal security assessments compared to peers trained through vendor-specific courses.
It's frequently paired with practice exams from platforms like Professor Messer's own website and CompTIA's official practice tests. The combination provides both conceptual mastery and test-taking stamina.
Some learners assume Professor Messer SEC is equivalent to a full certification program. It is not. It does not include hands-on labs, proctored exams, or official certification credentials. It is a preparatory resource, not a substitute for formal testing.
Another misconception: that the videos are outdated. This is false. As of 2024, the series has been updated to cover the latest version of the exam, SY0-701. New content was added in January 2024 addressing emerging threats like AI-powered phishing and supply chain attacks.
There's also confusion between Professor Messer SEC and other similar YouTube channels. While several educators offer free cybersecurity content, Professor Messer's series stands out due to its strict adherence to the official exam objectives and consistent pacing. Unlike some creators who jump between topics or prioritize entertainment over accuracy, Professor Messer maintains a focused, technical tone throughout.
For example, when discussing encryption, he doesn't just define symmetric vs asymmetric encryption-he walks through a real-world scenario: encrypting a patient record in a hospital system using AES-256 for storage and RSA for key exchange. He then explains why hybrid encryption is used in practice, citing performance and security trade-offs.
Consider a scenario where a company experiences a ransomware attack. The attacker gains access via a phishing email, installs malware, and encrypts files on the file server. An employee reports the issue.
Using Professor Messer SEC, a junior analyst would recall the following steps:
This sequence aligns with the NIST Computer Security Incident Handling Guide and is reinforced in multiple videos across the Operations and Incident Response unit.
When asked about his teaching philosophy, Professor Messer said: "I don't want people to memorize facts. I want them to understand why something works the way it does. That's how you survive in real IT."