Free labs to try before you pay
You can test whether you like security work without paying anything. Cisco's Networking Academy, OverTheWire, LetsDefend, Blue Team Labs Online, CyberDefenders, TryHackMe and Carnegie Mellon's CyLab Security Academy all have free practice. Some also sell paid plans, and we note what's free on each. Spend four weeks here before you buy an exam. Checked on Nov 10, 2026.
Show my cert and total costOr jump to the 4-week free plan.
Practice only where you're allowed. Use these labs, or computers you own. Testing other people's systems without permission is illegal in most countries.
Security basics
- Cisco: Introduction to Cybersecurity
Free. 6 hours, self-paced. Common attacks and how defenders respond.
- Microsoft Learn: security, compliance and identity concepts
No price shown on the page. Zero Trust, sign-in and access basics. It's the prep path for SC-900.
- Professor Messer: Security+ SY0-701 videos
Free videos. He sells notes and practice exams separately.
Linux and the command line
- OverTheWire: Bandit
Free. A game played in a terminal. OverTheWire says it's aimed at absolute beginners.
- CyLab Security Academy (formerly picoCTF)
Free, run by Carnegie Mellon University. Short CTF puzzles (capture the flag: find a hidden answer). Some puzzles practice attacks. For defense practice, pick ones about forensics, logs or the command line. Old picoCTF logins still work.
Networking
- Cisco: Networking Basics
Free. 22 hours, self-paced. How networks carry data.
- Wireshark
Free and open source. A tool that shows the traffic on your own network, packet by packet.
- Professor Messer: Network+ N10-009 and A+ videos
Free videos for Network+ and both A+ exams.
SOC work: alerts and phishing
A SOC (security operations center) is the team that watches alerts and decides which ones are real. Many first security jobs are here.
- LetsDefend
Free courses, including SOC Fundamentals, Phishing Email Analysis and Detecting Web Attacks. It also sells paid plans.
- Blue Team Labs Online
Free: the downloadable challenges (phishing emails, logs, memory and network captures). Paid: the hosted "investigations".
- TryHackMe
Free: free rooms only, limited learning paths, and one hour a day of its browser-based lab machine. Paid: full learning paths and unlimited lab time.
- Cisco: Endpoint Security
Free. 27 hours. Protecting laptops, phones and servers.
Logs and SIEM
A SIEM (security information and event management tool) collects logs from many computers in one place and flags strange events. Reading it is core SOC work.
- Splunk free courses
Free self-paced courses, including Intro to Splunk. Splunk makes a SIEM.
- CyberDefenders
Free sign-up with some free labs. Labs marked "Premium" are paid. Topics include network forensics, threat hunting and endpoint forensics.
- Security Onion
Free and open. A security monitoring and log platform you install and run yourself. A good next step once the guided labs feel easy.
The 4-week free plan
About five to eight hours a week. That's our suggestion, not a rule. Go slower if you need to.
Week 1: the basics
Finish Cisco's Introduction to Cybersecurity (6 hours). Then play the first five levels of OverTheWire Bandit.
Week 2: networks
Start Cisco's Networking Basics. Install Wireshark and watch your own computer load one web page. Find the DNS lookup (where your computer asks for a site's address).
Week 3: the SOC desk
Take LetsDefend's SOC Fundamentals and Phishing Email Analysis. Then try one TryHackMe free room on phishing or logs.
Week 4: your first investigation
Do Splunk's Intro to Splunk. Then finish one free Blue Team Labs Online challenge or one free CyberDefenders lab. Write down what happened, in order, in plain words.
Now decide
Did weeks 3 and 4 hold your attention? Then book the first cert for your starting point. Did they bore you? That's worth knowing before you spend money. Security has other paths, like audit and risk, and IT work in general.