Every security course comes with a recommended kit list, and most of those lists were written by someone with an affiliate link. The useful version of this question has almost nothing to do with gadgets.
Two published numbers settle it. Kali Linux asks for 2GB of RAM to run its default desktop. Security Onion's standalone install asks for 24GB and refuses to start on ARM. Everything else follows from those. I go through the full reasoning in a longer post on DevToolLab; this is the short version.
Start From the Software, Not the Shopping List
The projects publish their own requirements, so you can check these rather than trust a recommendation.
Kali's documentation puts the default Xfce4 desktop at 2GB of RAM and 20GB of disk. Strip it back to an SSH server and it will technically boot in 128MB. The number that matters more is further down the same page: once you are running Burp Suite or several tools together, the suggestion is at least 8GB for the VM alone.
Security Onion is a different animal. Its minimum specs table lists three tiers, and the gap between them is the whole story.
Import wants 2 cores, 4GB and 50GB. Evaluation wants 4 cores, 8GB and 200GB. Standalone wants 4 cores, 24GB and 200GB, and the project separately suggests 32GB or more once you point it at real traffic.
So the tool everyone buys hardware for, Kali, is the cheapest thing on the list. The expensive requirement is the blue-team stack nobody mentions in the kit posts.
The Apple Silicon Trap
Security Onion's docs carry a warning in a box: it does not support ARM or any other non-x86-64 processor.
The default laptop recommendation for students in 2026 is an Apple Silicon MacBook. Apple Silicon is ARM. A MacBook Air will happily run Kali in a VM and carry you through every web-focused CTF you care to attempt, but it cannot run Security Onion in any virtual machine, at any amount of RAM.
If your program has a SOC, blue-team or network-monitoring module, you need x86-64 somewhere: a Windows or Linux laptop, a used desktop, or a cloud instance you rent for the term. Work this out before you buy a laptop, not in week three.
The Only Purchase That Really Matters
Buy 16GB of RAM. That is the decision.
Security work means an attacker VM and a target VM running at the same time, and 8GB will not carry both once the host OS takes its cut. RAM is also the component you generally cannot add later on a modern laptop, unlike storage. If the budget forces a choice, drop the CPU tier or the screen before you drop memory.
After that, a 1TB external SSD. VM images are large and they multiply faster than you expect: an attacker image, two or three targets, and a snapshot before every time you break something on purpose. Snapshots are the single best habit in lab work and they are what fills a disk.
Then stop. The first year of most curricula is browser-based or VM-based, and the free platforms need nothing you do not already own. Buying hardware before you hit a wall is how people end up with a drawer of untouched devices.
Buy These Later, When Something Forces It
A USB WiFi adapter with monitor mode, once a wireless module starts. Built-in laptop chipsets usually cannot capture in monitor mode, so this is the one purchase that unlocks coursework you genuinely cannot do otherwise. Match the chipset to what your course asks for, because driver support decides whether it works, not the brand on the box.
A Raspberry Pi, once you want a target that is not your own laptop. Cheap, disposable, and easy to re-image after you wreck it. Note it is also ARM, which makes it a target rather than a monitoring host.
A managed switch with port mirroring, once you reach packet capture. Courses tend to assume this and students tend to skip it, and without a mirror port you simply cannot see traffic that is not addressed to you.
A hardware security key, whenever. That one is not lab equipment so much as practice: using WebAuthn on your own accounts teaches it better than any slide deck, and it protects the accounts your coursework is about to live in.
What Not to Buy
RF multitools are genuinely fun and almost never required. They demo well and then sit unused, because very few courses are built around them. If you want one, buy it after the semester that made you want it.
Skip the pre-built "hacking laptop" listings too. They are ordinary machines with a themed sticker and a markup. A dull 16GB laptop with decent battery life is the better tool.
The Non-Negotiable Part
All of this applies to equipment you own or an environment you have written permission to test: your own lab, purpose-built platforms like picoCTF and OverTheWire, your university's authorized range, or a bug bounty program's stated scope.
Running scans or capturing traffic on the campus network, a cafe's WiFi, or a company you do not work for is not practice. In the United States it falls under the Computer Fraud and Abuse Act, and universities expel students over it. The skills transfer to a job. A conviction does not.
The Order to Do It In
Check your syllabus for a blue-team course first, because that alone decides whether you need x86-64. Then buy 16GB of RAM, add a 1TB external SSD, and run a full semester on nothing else so you find out where you actually get stuck. Buy the WiFi adapter when a wireless module starts, and a Pi or a switch only when a specific assignment demands one.
While you are working through network labs, two things on DevToolLab that come up constantly: the Subnet Calculator for planning an isolated lab range so your targets cannot reach anything they should not, and the MAC Address Lookup for identifying gear on your own network during inventory exercises.
Wrapping Up
Two published figures do most of the work here. Kali needs 2GB and runs anywhere. Security Onion standalone needs 24GB and will not run on ARM at all. In between sits a 16GB x86-64 laptop and an external SSD, which covers the overwhelming majority of what a degree throws at you.
Everything else is a purchase you make when a specific class forces your hand, not in August alongside the textbooks.
References
- Cybersecurity Lab Gear for Students 2026 - the full version, with the requirements table and the build order in detail
- Kali Linux installation requirements
- Security Onion 2.4 hardware requirements
Top comments (0)