Learn / Careers in cybersecurity
Free learning resources and home labs
The best free and low-cost places to practice security skills legally, including TryHackMe, Hack The Box, picoCTF and OverTheWire, plus free government training and how to build a safe home lab.
Learn by doing, legally
Security skills stick when you practice them. The platforms on this page give you deliberately vulnerable machines, puzzles and guided lessons that you are explicitly permitted to attack and investigate. That permission is everything: practicing on systems you do not own or have authorization to test is illegal, even if you mean no harm. See legal and ethical boundaries.
Practice platforms
| Platform | Cost | Best for | Notes |
|---|---|---|---|
| TryHackMe | Free tier; paid subscription | Complete beginners | Browser-based guided rooms; learning paths for defensive and offensive skills |
| Hack The Box | Free tier; paid tiers | Intermediate learners | Realistic machines; HTB Academy offers structured courses |
| picoCTF | Free | Students and beginners | Created by Carnegie Mellon University; year-round practice gym plus an annual competition |
| OverTheWire | Free | Linux and command-line basics | "Bandit" is a classic first wargame; later games get harder |
| CyberDefenders and similar blue team labs | Free and paid | Defensive investigation | Analyze logs, network captures and disk images |
Rotate between offensive puzzles and defensive investigations. Employers value people who understand both how attacks work and how they show up in logs.
Free courses and official training
- CISA (the US Cybersecurity and Infrastructure Security Agency) publishes free training, exercises and guidance through its website, including resources for the public and small organizations.
- NIST publishes free frameworks and guides, including the Cybersecurity Framework and the NICE Workforce Framework, which describes security work roles and the skills each needs. It is a useful map when planning what to learn.
- Vendor learning portals from Microsoft, AWS, Google Cloud and Cisco include free security courses and labs.
- University courses are available free to audit on platforms such as edX and Coursera.
- Free video courses for entry certifications, such as complete Security+ and Network+ series from well-known instructors, are widely available.
Building a legal home lab
A home lab is a small set of machines you own and control, used to practice safely. It also makes great interview material.
What you need:
- A computer with at least 16 GB of RAM if possible (8 GB works for small labs).
- Free virtualization software such as VirtualBox, VMware Workstation Pro (now free for personal use), Hyper-V on Windows Pro, or UTM on Mac.
- Free operating systems: a Linux distribution such as Ubuntu, evaluation copies of Windows Server and Windows from Microsoft, and intentionally vulnerable training machines published for practice.
Starter lab ideas:
- Logging lab: forward logs from a Windows and a Linux machine into a free SIEM or log tool and write detection rules for failed logins.
- Network lab: run a free firewall distribution such as pfSense or OPNsense between two virtual networks and practice segmentation rules.
- Active Directory lab: build a small Windows domain to learn accounts, groups and policies, which most companies use.
- Hardening lab: apply free CIS Benchmark recommendations to a server and document each change.
Keep vulnerable practice machines on an isolated virtual network ("host-only" or "internal" mode), never exposed to the internet or your home network. Do not scan your neighbors, your employer's network or public IP addresses. Your lab ends at the edge of the equipment you own.
Capture the flag and community
Capture the flag (CTF) competitions are timed challenges where teams solve security puzzles to find hidden "flags". CTFtime.org lists upcoming events, many beginner-friendly and online. Local BSides conferences, university clubs and online communities welcome newcomers and are a good way to find mentors and job leads.
Turning practice into proof
Write up what you learn. Platforms usually allow public write-ups only for retired challenges, so check each site's rules before publishing. A short blog post explaining a lab you built, a detection you wrote, or a retired machine you solved shows employers exactly how you think. See how to start a cyber career.