Free Hands-On Cybersecurity Training & Labs
Stop reading about controls and start operating them. This is every free, hands-on way to learn cybersecurity by doing on PlayCISO — interactive labs that put you in the seat, branching incident simulations, a live Virtual SOC, a challenge ladder, and guided projects that end in a certificate. Most run entirely in your browser with no sign-up and nothing to install.
In plain words
PlayCISO offers 30+ free, browser-based hands-on security labs plus branching War Room incident simulations, a Virtual SOC, a challenge ladder and guided projects with certificates — learn by doing, no signup for most. The labs span network, email, identity, cloud, detection, SOC triage, incident response, forensics and cryptography/PKI, and each one scores you against a goal — catch rate, detection precision, the right response sequence, a hardened TLS grade. The Cyber War Room runs realistic breaches through decision trees across several companies and incident years; the Virtual SOC adds a live alert feed. Guided project tracks end in a certificate. Everything here is part of the large free tier; paid Pro tiers are $5, $10 and $40.
Interactive labs by domain
Each lab is a self-contained, in-browser exercise that puts you in the operator seat and scores you against a concrete goal. No account, no install, nothing touches a real system. Start with the operational domains, then drill deep on cryptography and PKI.
Network, identity, cloud, detection & response
Firewall Rule Lab
Order allow/deny rules and replay packets first-match-wins. Catch shadowed and any→any rules.
Egress Proxy Lab
Build a web-filtering egress policy, see the TLS-inspection trade-off, and catch data exfil.
Email Authentication Lab
Tune SPF, DKIM and DMARC and deliver messages — learn why forwarded mail survives on DKIM.
Conditional Access Lab
Build Entra-style access policies and evaluate sign-ins. Catch legacy-auth gaps and lockouts.
Cloud Posture Lab
Find and remediate cloud misconfigurations with a live posture score and blast-radius notes.
Detection Lab
Write SIEM rules on a labelled log stream and tune precision and recall to beat alert fatigue.
SOC Case Triage Lab
Triage 50 realistic security cases like an analyst — priority, team and first action, scored.
IR Playbook Lab
Sequence an incident response across the lifecycle. Image before wipe, eradicate before restore.
Forensics Lab
Reconstruct a breach from the artifacts, separate evidence from red herrings, and cite your proof.
Abliteration Lab
A safe simulation of how refusal-removal attacks on open-weights models succeed or fail — defensively. No real model.
Cryptography & PKI
Certificate Triage Lab
Flag the broken certs in a queue of 20 — expired, SHA-1, short key, SAN mismatch — without false-flagging the good ones.
Certificate Chain Lab
Assemble a valid certificate chain from a jumble; catch the missing intermediate, wrong order or untrusted root.
PKI Hierarchy Lab
Design a CA hierarchy — offline root, scoped issuing CAs, path-length and EKU constraints — scored against best practice.
Cert Revocation Lab
Decide valid / revoked / unknown from OCSP and CRL evidence — and the right client action.
Cert Rotation War Room
Work a certificate fleet’s renewal queue under limited capacity and prevent expiry outages.
Cert Pinning Lab
Rotate a pinned certificate with zero client breakage — learn backup pins and the pin-to-CA trade-off.
mTLS Handshake Lab
Diagnose and fix mutual-TLS handshake failures — untrusted CA, expired client cert, EKU, SAN mismatch.
TLS Hardening Lab
Harden a server’s TLS to an A+ grade without breaking a required client — strip weak suites, enable TLS 1.3.
CSR Builder & Auditor
Audit Certificate Signing Requests for mistakes, or build a correct one — CN, SANs, key strength.
Hashing & Integrity Lab
Verify integrity with live SHA-256/512 — and see why MD5/SHA-1 are retired via real collision pairs.
HMAC & Message Auth Lab
Compute and verify real HMAC-SHA-256 tags; catch tampering and the length-extension trap.
AES-GCM Encryption Lab
Encrypt with real AES-GCM; witness the nonce-reuse catastrophe and fail-closed tag tampering.
Digital Signature Lab
Sign and verify with real RSA-PSS and ECDSA, tamper to break it, and catch the forgeries.
Password Storage Lab
Pick safe PBKDF2 params and salt, crack an unsalted scheme, and rank bcrypt/argon2.
JWT Attack & Defense Lab
Exploit alg:none, weak secrets and HS/RS256 key confusion live — then pick the hardening that stops each.
Key Lifecycle Lab
Run keys through generate → rotate → retire → destroy and handle a key-compromise incident.
ASN.1 / DER Decoder Lab
Decode real DER into a TLV tree and identify the X.509 structures and OIDs.
CT Log Monitoring Lab
Spot the mis-issued and rogue certificates for your domain in a Certificate Transparency feed.
Entropy & Weak-RNG Lab
Measure real Shannon entropy and spot predictable keys (Debian OpenSSL 2008, time-seeded PRNGs).
TLS Handshake Lab
Order the TLS 1.2 vs 1.3 handshake and find where downgrade, MITM and 0-RTT-replay attacks hit.
See the whole set on the Labs hub.
War Room, Virtual SOC & M&A
Branching incident simulations where your decisions move a running score. Work a breach in the Cyber War Room, run a live alert feed in the Virtual SOC, or pressure-test a budget under siege.
Branching incident simulations — work a live breach through decision nodes and watch your choices move the score.
Run a security operations centre against a live alert feed — triage, escalate and contain.
Run cyber due diligence on an acquisition target and brief the deal team.
Survive a 10% budget cut, get a CISO Score, challenge a colleague.
Defend your program and priorities under a hard budget mandate.
A supermarket refrigeration ransomware sim — save the cold chain, scored.
Challenge ladder & projects
Turn one-off reps into a path. Climb the challenge ladder rung by rung, or follow a guided project track that builds real skills and ends in a certificate.
Climb a graded ladder of security challenges, one rung at a time.
Guided, multi-step project tracks that build real skills and end in a certificate.
The full hub of every free, in-browser hands-on lab in one grid.
Quick security games and drills for a lighter way to practise.
Reps with feedback
Drills that coach you, not just score you — rehearse an interview, a board report or an audit, and get gamified prep for the certifications that matter.
Practise a security interview and get coached on your answers.
Rehearse presenting an incident and your decisions out loud.
Draft and sharpen a board-level security report with coaching.
Sit the other side of the table and defend your controls in a mock audit.
A bank of ready-made scenarios to drill your team on.
Gamified practice for CSA, IAPP, ISACA, and ISO/IEC 42001.
Watch a War Room play out before you run your own.
Frequently asked questions
Where can I practice cybersecurity for free?
PlayCISO is a free, browser-based platform built for practising security by doing. It has 30+ interactive labs covering network, email, identity, cloud, detection, SOC triage, incident response, digital forensics and cryptography/PKI; branching Cyber War Room incident simulations; a Virtual SOC with a live alert feed; a challenge ladder; and guided project tracks that end in a certificate. Each lab puts you in the operator seat — writing firewall and SIEM rules, tuning DMARC and Conditional Access, remediating cloud misconfigurations, sequencing incident response and working a forensic case — and scores you against a goal. Most run with no sign-up and nothing to install.
Do I need to install anything?
No. Every lab, simulation and challenge runs entirely in your browser — there is nothing to download, no VM to spin up and no agent to install. Because they are teaching simulations, they never touch a real system, network or account, so you can practise attacks and defences safely. A modern browser with JavaScript is all you need.
Are the labs graded?
Yes. Each lab scores you against a concrete goal — catch rate on a triage queue, precision and recall on a detection rule set, the correct response sequence, a hardened TLS grade, a valid certificate chain — so you get immediate, specific feedback rather than a pass/fail. The challenge ladder tracks your progress rung by rung, and the guided project tracks end in a certificate once you complete them.
Is it really free?
Yes. The labs, the Cyber War Room, the Virtual SOC, the challenge ladder and the project tracks are free to use, and most need no sign-up. PlayCISO also has paid Pro tiers ($5, $10 and $40) that unlock deeper studios and a few advanced tools, but the hands-on training on this page is part of the large free tier.
Who is this hands-on training for?
Analysts and engineers building practical skill, people preparing for a blue-team, SOC or cloud-security interview, students learning by doing, and security leaders who want to drill their team on the decisions that matter — rule order, default-deny, alert precision, response sequencing and evidence-based investigation. The coaching tools (interview practice, board-report coach, cert prep) add feedback on top of the drills.
What is the Cyber War Room?
The Cyber War Room is a set of branching incident simulations: you work a realistic breach through a tree of decision nodes, and each choice moves a running score so you can see the consequences of acting too slowly, skipping containment or mis-prioritising. Several companies and incident years are available, and a live-feed Virtual SOC variant simulates the alert stream alongside the decisions. You can also watch a War Room play out before running your own.