Practice makes defenders: Labs, CTFs & Blue Team
Cybersecurity is a practice skill. You learn it by trying it, safely, in places built for it. In 2026 employers look for people who can show what they have done: a solved challenge, a home lab, an incident write-up. This page is pillar H of SHIELD 2040, Hands-on defense. It collects free practice platforms, competitions with their real costs and age rules, a home lab you can build with free tools, and the ethics that keep you on the right side of the law.
What you'll be able to do
Use the command line safely
Solve beginner wargames and puzzles that teach Linux commands, files and permissions in a legal sandbox.
Capture your first flag
Work through a capture-the-flag (CTF) challenge from reading the clue to submitting the answer.
Investigate like a defender
Read logs and network captures, and write down what happened in an incident timeline.
Build a home lab
Run virtual machines on your own computer with free tools, so you can practice without risking anything real.
Monitor and detect
Collect logs with Wazuh, Security Onion or Splunk and spot a suspicious pattern.
Hack legally and ethically
Explain authorization, scope and responsible disclosure, and know where the legal line is.
Free practice platforms
Everything here has a free way in. Some platforms limit what the free tier includes, and those limits change, so we say what we confirmed and what you should check. Hours are our own estimates. Ages are marked on every card. Only practice on systems these platforms give you.
OverTheWire wargames
Provider: OverTheWire. You earn: skills practice only (no certificate). Start with the Bandit wargame to learn Linux basics through puzzles you solve over SSH. Cost: Free course · Level: Beginner · About 10 to 20 hours for Bandit (estimate) Age: no age limit stated; recommended with a coach for under-13s.
Start the wargames
picoCTF / CyLab Security Academy (Carnegie Mellon University)
Provider: Carnegie Mellon CyLab. You earn: skills practice and annual competitions (no certificate). picoCTF.org is now the free CyLab Security Academy, run by the same CMU team, with a challenge library, learning paths and a CTF primer. Cost: Free course · Level: Beginner to Intermediate · Open-ended; about 10 hours to start (estimate) Age (youth-friendly): reports say accounts need users to be 13 or older, with parental consent for 13 to 17. Some competition prizes are limited to U.S. middle and high school students. Confirm on the site.
Open picoCTF
TryHackMe: free rooms
Provider: TryHackMe. You earn: skills practice. The free plan includes a set of free rooms and a limited daily AttackBox browser machine. Completion certificates and the full library need a paid plan, and free-tier limits change, so check the site. Free certificate: no. Cost: Free course (limited free tier) · Level: Beginner · About 5 to 15 hours of free rooms (estimate) Age: minimum age not confirmed; use with a coach for under-18s.
Open TryHackMe
Free vs paid (TryHackMe blog)
Hack The Box: Academy free modules and free tier
Provider: Hack The Box. You earn: skills practice. HTB's help center says the Tier 0 modules in HTB Academy are completely free (each costs Cubes that are refunded when you finish). Starting Point machines are the beginner lab category. Most other Academy content is paid. Cost: Free course (Tier 0 modules) · Level: Beginner · About 10 hours (estimate) Age: minimum age not confirmed; use with a coach for under-18s.
HTB Academy
How Academy works
CyberDefenders: free blue-team labs
Provider: CyberDefenders. You earn: skills practice. Free accounts include a library of free blue-team labs (digital forensics, threat hunting, SOC work) with limited cloud time. The full library needs a paid plan. Cost: Free course (limited free tier) · Level: Beginner to Intermediate · About 1 to 3 hours per lab (estimate) Age: not stated; recommended for ages 16 and up with a coach (our guidance).
Free blue-team labs
LetsDefend: free tier
Provider: LetsDefend. You earn: skills practice in a simulated SOC. Reports say the free tier includes some alert investigations and a SOC Analyst learning path; confirm what is free at sign-up because limits change. Cost: Free course (limited free tier) · Level: Beginner to Intermediate · About 10 hours (estimate) Age: not stated; recommended for ages 16 and up with a coach (our guidance).
Open LetsDefend
Blue Team Labs Online
Provider: Security Blue Team. You earn: skills practice with investigation challenges. A set of challenges is free; the full lab library is paid. We could not confirm the current free-tier size, so check the site. Cost: Free course (limited free tier) · Level: Beginner to Intermediate · About 1 to 2 hours per challenge (estimate) Age: not stated; recommended for ages 16 and up with a coach (our guidance).
Open Blue Team Labs Online
Competitions and youth programs
Competitions are a great way to practice with a deadline and a team. Check the cost and the eligibility line on each card first, because several are for students only.
National Cyber League (NCL)
Provider: Cyber Skyline. You earn: a scouting report and skills ranking from individual and team games. Not free by default: regular registration is $45 for the season ($55 late). NCL's donation page says donations fund free registrations, so ask NCL about a waiver. Fall 2026 registration has closed (late registration ended Oct. 13), so plan for the next season. Cost: Paid registration ($45; waivers via NCL) · Level: Beginner to Advanced · Season-long, about 20 hours (estimate) Age (youth and students): must be 13 or older and a student in high school, college, an apprenticeship, an academic boot camp, or a transitioning veteran. U.S. and Canada only.
National Cyber League
NCL FAQ
CyberPatriot (Air Force Association)
Provider: Air Force Association. You earn: team competition experience and a path toward scholarships and careers. Teams pay a registration fee (see the official Schedule and Fees page), so it is not a free course; some states and sponsors help with fees. Cost: Team fee applies · Level: Beginner · Season-long (about 3 hours per week, estimate) Age (youth only): Open Division for high school students, All Service Division for JROTC, Civil Air Patrol and Sea Cadets, and a Middle School Division. Teams have 2 to 6 students and one adult coach.
CyberPatriot
Schedule and fees
NSA Codebreaker Challenge
Provider: National Security Agency. You earn: points, awards and a standing among peers for the highest-scoring students. The 2026 challenge runs September 25, 2026 to January 20, 2027. We found no fee on the official pages. A certificate is not part of it. Cost: No fee listed · Level: Intermediate to Advanced · Self-paced, about 20 to 60 hours (estimate) Age (students): open to anyone with an email address from a recognized U.S. school or university. Only students earn points and awards.
NSA Codebreaker Challenge
US Cyber Games
Provider: US Cyber Games (Katzcy, with NIST NICE). You earn: free qualifier events, practice and, for top athletes, a place on the US Cyber Team. Season VI is current. The open event was free and open to everyone in the reports we found; the team application has stricter rules. Cost: Free course (open events) · Level: Beginner to Advanced · Varies Age: open events reported as no age limit. The US Cyber Team application requires U.S. citizenship and a birth date on or after January 1, 2000 (reported). Confirm on the official site.
US Cyber Games
US Cyber Challenge
Provider: US Cyber Challenge. You earn: its Cyber Quests (online competitions) and Cyber Camps (week-long training). Current status not confirmed: the site describes both, but we found no current dates, cost or eligibility, so check with the organizers before you plan around it. Cost: Cost not confirmed · Level: Intermediate · Varies
US Cyber Challenge
Build your home lab with free tools
A home lab is a few virtual computers on your own machine that you are allowed to break. All of these tools are free to download. Build in this order and keep the lab on a private virtual network, not connected to the internet.
Step 1 · VirtualBox
Free, open-source virtualization from Oracle. It runs your lab computers inside your own computer. Start with 8 GB of RAM or more if you can. Level: Beginner · About 2 hours (estimate)
Download VirtualBox
Step 2 · Kali Linux
A free Linux distribution with security tools preinstalled. Use it only against machines you own or have written permission to test. Kali publishes ready-made virtual machine images for VirtualBox. Level: Beginner to Intermediate · About 3 hours to set up and explore (estimate)
Get Kali
Kali docs
Step 3 · Wireshark
Free network protocol analyzer. Capture traffic between your lab machines, then filter for DNS, HTTP and the TCP handshake to see networking in action. Level: Beginner · About 5 hours (estimate)
Download Wireshark
Step 4 · Wazuh
Free, open-source security monitoring (host intrusion detection, log analysis, file integrity). Use the official quickstart to run it, then install the agent on a lab machine and watch the alerts. Level: Intermediate · About 6 hours (estimate)
Wazuh quickstart
Step 5 · Security Onion
Free, open-source platform for network security monitoring, intrusion detection and log management, built for defenders. It needs more memory than the other tools, so plan a dedicated virtual machine. Level: Intermediate · About 8 hours (estimate)
Security Onion software
Documentation
Step 6 · Splunk: free trial and free security courses
Splunk offers a 60-day free trial of Splunk Enterprise (500 MB per day, no credit card), which you can convert to a perpetual free license, and a free self-paced eLearning library that includes security courses such as SOC Essentials. Check Splunk's current license terms for the free license limits. Level: Intermediate · About 8 hours (estimate)
Splunk Enterprise free trial
Free Splunk courses
Safety and ethics
Cyber defenders are trusted with powerful skills. The rule is simple: only test what you own or have clear, written permission to test. Breaking into other people's systems is illegal in most countries, even if you mean no harm.
- Stay in the sandbox. Use the platforms above and your own isolated lab. Never scan or attack a school, a business or a stranger's network.
- Know the scope. A CTF or bug-bounty program tells you exactly what you may test. Stay inside it.
- Disclose responsibly. If you ever find a real weakness, stop, do not access data, and report it privately to the owner. CISA's coordinated vulnerability disclosure process explains how, and disclose.io promotes safe-harbor policies.
- Learn the rules for hackers. Hacker101 is a free course on web security and ethical bug hunting. Laws differ by country, so ask your coach before you take part in any real-world program.
- Protect people. Never share other people's data, passwords or private details, even inside a lab.
For Curiosity Coaches
Use this page once a learner has finished the first steps of Cyber Security Foundations. Always read the safety section out loud before the first lab.
Discussion prompts
- What is the difference between a defender and an attacker? Why do defenders need to think like attackers?
- Where is the legal line? Describe a case where "I was just curious" would still be wrong.
- After a lab, ask: what evidence did you find, and what would you tell a manager?
A 4-week hands-on plan
- Week 1: OverTheWire Bandit, levels 0 to 10. Learn ls, cat, find and permissions.
- Week 2: picoCTF or TryHackMe free rooms. Solve three challenges and write a short walkthrough for each.
- Week 3: install VirtualBox and Wireshark. Capture a web page load and explain each step.
- Week 4: one free CyberDefenders or LetsDefend investigation, written up as a timeline. Optional: Wazuh in the lab.
Age and level fit
- Ages 10 to 12: OverTheWire and picoCTF puzzles side by side with a coach. No account creation without a parent.
- Ages 13 to 17: picoCTF, TryHackMe free rooms and a school-based team (CyberPatriot, NCL if eligible). Parental consent needed where platforms require it.
- Adults and career-changers: the full home lab and the blue-team platforms, then NSA Codebreaker or US Cyber Games if eligible.
Free resource library