Free Cybersecurity Learning Resources Guide: Courses, Labs and Practice Platforms

There is more free cybersecurity training online than anyone could finish, and most learners waste months on resources that are out of date, too shallow or not connected to a real job. This guide sorts the best free courses, labs and practice platforms by what they actually teach, who runs them and what they cost once the free part ends. It covers government and standards body material, vendor and university platforms, intentionally vulnerable applications and public datasets for blue team practice. It is written for career changers, students, early career analysts and the managers who build team training plans on a small budget. Facts about each resource were checked on its own site on 26 October 2026; free offers change, so confirm before you plan around one.

Key takeaways

• Start from a curated public list, not a search engine. The NIST NICE "Free and Low Cost Online Cybersecurity Learning Content" page groups resources by career stage and states plainly that a listing is not an endorsement.
• Hands-on beats video. OverTheWire Bandit, the PortSwigger Web Security Academy, OWASP Juice Shop and the Splunk BOTS v3 dataset teach by doing, and each is free at the point of use.
• Free offers expire. ISC2 closed its One Million Certified in Cybersecurity enrolment on 20 May 2026, and existing exam codes must be used by 31 December 2026. Check dates before building a plan around a free exam.
• Map resources to a role. Use the NICE Framework or your target job description to pick resources, so every hour builds towards something an employer can recognise.
• Stay legal and contained. Practise only on platforms built for it or on your own isolated lab; running a vulnerable app on an open network or testing a real site without permission creates real risk.

How to judge a free resource

Free material varies from world-class to misleading. Before investing time, check five things. The Cybersecurity Learning Roadmap Guide sets out the stages; this page is the resource catalogue that sits underneath it.

• Provenance: who runs it and why. Government bodies (NIST, NCSC), standards projects (OWASP, MITRE) and universities (Carnegie Mellon's picoCTF) have no product to sell you. Vendor academies are often excellent but steer towards their own tools.
• Currency: look for a last-updated date. The NIST NICE list was updated on 19 May 2026; the SC-900 certification page on Microsoft Learn on 21 October 2026. Material that still teaches retired protocols or tools as current is a warning sign.
• Licence and terms: OWASP Juice Shop is MIT licensed and the BOTS v3 dataset is CC0-1.0 (public domain dedication), so teams can use both internally without negotiation. Commercial "free tiers" can change their terms at any time.
• Depth of practice: count the labs, not the hours of video. The Web Security Academy has, for example, 30 cross-site scripting labs and 16 SQL injection labs.
• The paid cliff: work out what happens when the free part ends. NIST notes that the Google Cybersecurity Certificate needs a paid Coursera membership after a free week, and that some listed items are free or under US$100 only for a limited time.

Resource map by stage and track

The table groups the resources covered in this guide by the stage of learning they suit and the track they build towards. Costs are as stated by each provider when checked on 26 October 2026.

Foundations: Linux, networking and general skills

Every security track assumes you are comfortable at a command line, understand how hosts talk to each other and can read a log. Free resources cover this stage well.

• OverTheWire Bandit: the site's own suggested order starts with Bandit for "Unix/Linux basics". Each level is reached over SSH and teaches one idea: file permissions, searching, encodings, compression, processes. Natas (web basics) and Krypton (classical crypto) follow. Work through it with the Linux Fundamentals for Defenders Guide open, so each puzzle maps to something a defender uses.
• picoCTF: Carnegie Mellon describes picoCTF as the largest high school hacking competition, and it has now joined CyLab Security Academy, CMU's free learning platform. Challenges span general skills, cryptography, web exploitation and forensics, and the platform now extends to topics such as AI security. Older picoCTF accounts (created before 8 May 2026) still work.
• Networking: pair a free introductory course (Cisco Networking Academy's is on the NIST NICE list) with packet captures you take yourself. The Wireshark for Security Analysis Guide shows what to look for.
• Windows: most enterprise attacks still touch Windows. Free vendor documentation is the primary source here; read it alongside the Windows Event Log Guide.

Hands-on labs and practice platforms

Labs are where knowledge turns into skill. The two families below need different handling.

Hosted platforms

Hosted platforms give you a legal target with nothing to install. The PortSwigger Web Security Academy is free in full: more than 30 topics including SQL injection, cross-site scripting, CSRF, SSRF, request smuggling, JWT attacks and newer material on API testing and web LLM attacks, each with text explanations and interactive labs. An account tracks progress. PortSwigger also runs a paid "Burp Suite Certified" exam; the Academy page does not state its price, so check before planning for it. TryHackMe and CyberDefenders appear on the NIST NICE list for hands-on and blue team labs respectively; both have free content and paid tiers. For wider context on ranges and competitions see the Cyber Ranges, CTFs and Hands-On Training Guide.

Self-hosted targets and datasets

Self-hosted material runs in your own lab, which means you control it and are responsible for containing it.

• OWASP Juice Shop: an intentionally insecure web application written in JavaScript, released under the MIT licence. It runs on Node.js, in Docker or under Vagrant, and its Score Board tracks 116 challenges across categories such as injection, XSS, broken access control and sensitive data exposure, including flaws from the OWASP Top Ten. Read the OWASP Top 10 Guide first, then use Juice Shop to see each risk in practice.
• Splunk BOTS v3: a public Boss of the SOC dataset (CC0-1.0, 320.1 MB) delivered pre-indexed for Splunk Enterprise and searched with index=botsv3. It contains Windows event logs, Sysmon, AWS CloudTrail, Office 365, Linux and network stream data from a simulated incident, which makes it one of the few free ways to practise a realistic multi-source investigation. The repository lists the add-ons and versions it expects (it was built on Splunk Enterprise 7.1.7) and warns that the data may contain offensive language. See the SIEM Guide for the concepts behind it.
• Open source detection stacks: if you would rather not depend on a commercial SIEM, the Security Onion Guide explains a free platform you can build and feed with your own lab traffic.

Build the lab properly before you load vulnerable software into it: a host-only or isolated virtual network, snapshots before each exercise, no port forwarding from your router. The Building a Cybersecurity Home Lab Guide covers the design.

Government, standards body and framework training

Public bodies publish material that is free, vendor-neutral and closely tied to how employers and regulators describe the work.

• NIST NICE: the "Free and Low Cost Online Cybersecurity Learning Content" page is organised into four tables: Career and Professional Development, Educator Training and Curriculum, Employee Awareness Training, and K12 Education and Games. Footnotes flag items that are free only for a limited time or that lead to a certification or degree. NIST states that a listing does not imply recommendation or endorsement.
• CISA Learning: the NIST NICE list describes it as free training for government employees, contractors and veterans. It is not open to every member of the public, so check eligibility first.
• MITRE ATT&CK training: the ATT&CK site publishes training modules including ATT&CK Fundamentals, ATT&CK Cyber Threat Intelligence, Adversary Emulation, Purple Teaming Fundamentals, ATT&CK Based SOC Assessments, ATT&CK Detection Engineering and TTP-Based Threat Hunting and Detection Engineering. These suit analysts who already know the basics.
• NCSC Exercise in a Box: a free UK NCSC service for testing incident response, aimed at small and medium-sized organisations, local government and emergency services. It contains 20 exercises across 12 topics, in two formats: short micro exercises on a single subject and tabletop exercises for groups. Topics include ransomware, phishing, supply chain, passwords and vulnerabilities. Pair it with the Tabletop Exercise Guide.
• Standards themselves: NIST CSF 2.0, NIST SP 800-53 Rev. 5, the OWASP Top 10 and ASVS and the ATT&CK knowledge base are free to read. Reading the primary text, not a summary, is a skill employers notice in interviews.

Free and low-cost routes to certification

A certificate is not the same as competence, but for career changers it gets an application past the first filter. Free routes exist, but they move.

If you enrolled in the ISC2 programme before it closed, your course access lasts until it expires and you do not have to finish the course to sit the exam. ISC2 warns that the name on your registration must match your test-centre ID exactly. For the exam content itself see the ISC2 Certified in Cybersecurity (CC) Guide, and for the wider landscape the Cybersecurity Certifications Guide.

Turning free resources into a plan

Unstructured browsing is the most common reason self-taught learners stall. Use a phased plan with an output at each step.

1. Pick a target role. Choose one from the Cybersecurity Careers Guide (for example SOC analyst) and collect three real job adverts for it. List the skills that appear in at least two.
2. Foundations (4 to 8 weeks). Cisco's introductory course or equivalent, Bandit levels 0 to 20, and a networking module. Output: notes in your own words and a short write-up of the hardest Bandit levels.
3. Build the lab (1 to 2 weeks). Isolated virtual network, snapshot discipline, one Windows and one Linux host. Output: a diagram and a rebuild script or checklist.
4. Track depth (8 to 16 weeks). Web and AppSec: Web Security Academy learning path plus Juice Shop. Blue team: BOTS v3 and free CyberDefenders labs plus ATT&CK modules. Output: three investigation or testing reports written as if for a manager.
5. Validate. Sit a low-cost entry certification if the target adverts ask for one, and enter a public CTF such as picoCTF to test yourself under time pressure.
6. Review and roll back. Every month, compare progress with the target adverts. If a resource has not produced an output in four weeks, drop it and pick the next one on the map rather than starting another course.

Measuring progress

Learners and managers both need evidence that time is turning into capability. Track a few simple measures:

• Labs completed per week, by track, with a running total (for example Web Security Academy labs solved).
• Written outputs: number of investigation reports, testing write-ups or detection rules produced and reviewed by someone else.
• Coverage of target skills: the share of skills from your job adverts with at least one lab or write-up as evidence.
• Time to solve: how long a repeat-style challenge (for example a BOTS question type) takes now compared with your first attempt.
• For teams: the proportion of staff in specialised roles with a completed role-based plan, which is the evidence NIST CSF 2.0 PR.AT-02 and SP 800-53 AT-3 expect.

Using free resources for team development

Managers can build serious team programmes from free material, provided they map it to roles and frameworks so training spend (or the lack of it) is defensible at audit.

Small teams can run the whole programme on free resources plus a shared lab. Larger organisations usually add a commercial range for scale and reporting, and keep the free material for onboarding and specialist depth. For workforce-wide awareness (as opposed to technical skills) see the Security Awareness and Human Risk Management Guide.

Where identity fits

Most free curricula teach identity only as passwords and MFA, yet stolen credentials, tokens and API keys sit behind a large share of real incidents. Microsoft's SC-900 learning path is one of the few free entry routes that treats identity as a domain of its own. Add identity and non-human identity reading to any track: the free NHI and IAM Glossary is a good starting point, and BOTS v3 includes AWS CloudTrail and Office 365 data in which access key and account activity can be investigated.

Common failure patterns

• Course collecting: finishing introductions on five platforms and depth on none. Pick one track and stay with it until it produces written outputs.
• Exposing vulnerable software: running Juice Shop or a vulnerable VM on a bridged network or a cloud instance with a public IP. These applications are built to be compromised; keep them isolated and shut them down after use.
• Practising on real systems: testing a live website, employer system or public Wi-Fi without written permission. In the UK, unauthorised access to computer material is an offence under section 1 of the Computer Misuse Act 1990, and most countries have equivalents. Stay on platforms and labs built for practice.
• Planning around an offer that has closed: for example expecting a free ISC2 CC exam after the May 2026 enrolment closure. Check the provider's own page, not a forum post.
• Ignoring the write-up: solving labs without recording how. Employers hire people who can explain findings; the write-up is the evidence.
• Leaking secrets in public portfolios: pushing lab notes, scripts or cloud credentials to a public GitHub repository. Real attackers scan for exactly this, as the Uber 2016 breach showed when AWS keys in a GitHub repository exposed data on 57 million people. Use throwaway accounts in labs and scan repositories before publishing.

Practitioner checklist

• Choose one target role and collect three current job adverts for it.
• Bookmark the NIST NICE free and low-cost list and check it each quarter for changes.
• Complete OverTheWire Bandit before any offensive or blue team track.
• Build an isolated lab with snapshots before running Juice Shop or any vulnerable VM.
• Pick one depth track (Web Security Academy and Juice Shop, or BOTS v3 and blue team labs) and finish it.
• Write up every lab or investigation in plain language and have someone review it.
• Verify any free certification offer, its end date and its ongoing fees on the certifying body's own page.
• For managers: map each resource to a role and to PR.AT-02, AT-3 or ISO/IEC 27001 Annex A 6.3, and record completion.
• Never test systems you do not own or have written permission to test.

Standards and references

• NIST NICE: Free and Low Cost Online Cybersecurity Learning Content
• NCSC: Exercise in a Box
• MITRE ATT&CK: Training
• OWASP: Juice Shop project
• ISC2: One Million Certified in Cybersecurity
• PortSwigger: Web Security Academy
• Carnegie Mellon University: picoCTF
• Splunk: Boss of the SOC (BOTS) Dataset Version 3

Related NHI Mgmt Group resources: Cybersecurity Learning Roadmap Guide · Building a Cybersecurity Home Lab Guide · Cyber Ranges, CTFs and Hands-On Training Guide · Cybersecurity Careers Guide · Path to CISO Career Guide