I would be very cautious about his learning this online and without supervision - he could very very easily be sucked into the dark net and that would be a very negative outcome...
the two categories of development he could really work on are:
as cyber security is focused on those two sectors - ultimately it is a mixture of the two (and business practices which are most often the weakness!)
code - he can work on this by simply having a website to play with - hosting and a domain is all he needs... anything on the stackexchange system of websites is a good support network
hardware, he needs to start small (raspberry pi etc.) and then work his way up - you can probably buy old kit such as routers / etc. on ebay and he can connect to them at home and start to work on how they operate...
however in all of this - the ideal would be to have someone who can mentor him - it is worth seeing whether someone in IT (support or academic) at school could help - depends totally on the school, I know one school where a boy like this was found trying dodgy hacking, and turned to help the school by stress testing their systems - win win.
in the absence of that I would google some cyber security firms and contact them to ask how he could get involved - that enthusiasm would be really interesting for some - if our firm was doing that work, it would be exactly the type of future employee I would want and the opportunity to shape them now would be fantastic...
or even contact GCHQ and ask how he could start to get involved - they may have advice...
ultimately - support him, if he has an inclination for this work then it is a fab and very necessary career (for society) ahead - but please do not let him just play online without understanding what he is doing - it can be a very tricky subject to navigate online without guidance and can go wrong without meaning to... and the online world has some very nasty areas...