Free courses & certifications to level up in security
Hand-picked, genuinely free trainings from the best providers, grouped by role: security leaders, SOC analysts, GRC, AppSec and AI-security engineers, pen testers, cloud teams, and people starting out. Filter by level, time commitment, and whether you walk away with a certificate. Vote on what helped you, and suggest one we're missing.
Each course appears once, under the role it suits best. Pick a role above to see everything for it.
CISO & security leaders
SANS Free Webcasts & Resources
Expert-led sessions on strategy, threats, and building security programmes.
SOC & incident response
CISA Cyber Training
Free US-government training across incident response, industrial control systems, and cyber defence, much of it live and virtual.
LetsDefend (free path)
A hands-on SOC analyst simulator — investigate real alerts in a browser. The Basic plan is free and includes SOC, phishing and malware-analysis fundamentals.
An Introduction to Time Travel Debugging (FLARE Learning Hub)
How to use WinDbg Time Travel Debugging for malware triage: record a process, replay it forwards and backwards, query the trace with LINQ for module loads, shellcode or injection, and automate it with JavaScript. A demo and a lab, with files in the mandiant/flare-learning-hub repo. The hours are our estimate.
Blue Team Labs Online
Defensive challenges and investigations: forensics, IR, and threat hunting. Challenges are free; the in-browser investigations are PRO.
Microsoft SC-200: Security Operations
Threat detection and response with Microsoft Sentinel and Defender. The learning paths are free; the SC-200 exam is paid.
The Go Reverse Engineering Reference (FLARE Learning Hub)
A reference for reversing Go executables in three parts: how the compiler implements each language feature in assembly, the Go runtime (initialisation, type descriptors, write barriers, runtime functions), and the layout of a Windows Go binary. Covers Windows AMD64 executables built with Go 1.24.0 only. The hours are our estimate.
GRC, audit & compliance
NIST Cybersecurity Framework 2.0
The framework that anchors modern risk and controls programmes, with quick-start guides and profiles.
PCI DSS Document Library
The source standards, SAQs, and guidance — pair it with PlayCISO’s PCI tools.
AppSec & AI security
Abliterated Models, Explained
Beginner’s guide to refusal-removed (abliterated) LLMs: the mechanism, an interactive visualizer, how to recognise them on Hugging Face, and how to govern the risk.
DeepLearning.AI Short Courses
Bite-size, hands-on courses on RAG, agents, evaluation, and safety. Videos are free; certificates need a paid Pro membership.
OWASP Top 10
The foundational awareness document for web application security risks, now in its 2025 edition.
Cohere LLM University
From embeddings to RAG to deployment, taught clearly from first principles.
OWASP Top 10 for LLM Applications
The reference risk list for LLM apps (2025 edition): prompt injection, sensitive data disclosure, excessive agency and more.
Hugging Face AI Agents Course
Build and evaluate autonomous agents. Free certificates for the fundamentals unit and for full completion, with no deadline.
5-Day Gen AI Intensive (self-paced)
Google’s whitepapers and code labs on prompting, embeddings, agents, and MLOps, now a free self-paced Kaggle Learn Guide.
Hugging Face LLM Course
Transformers, fine-tuning, and deploying LLMs hands-on. Free and ad-free; no certificate yet.
Web Security Academy
The gold standard for web AppSec: interactive labs from the makers of Burp Suite.
Pen testers & red teams
TryHackMe (free rooms)
Guided, gamified hacking rooms — one of the best on-ramps into offensive and defensive security.
PentesterLab (free exercises)
Real, isolated vulnerabilities to exploit and learn web pentesting properly. Free exercises to start; the full library is PRO.
HTB Academy (free modules)
Structured offensive-security modules with hands-on labs and a clear skill path. The free modules carry no certificate; HTB certifications are paid.
Web Hacking Techniques Index
Two decades of web-hacking research (2006–present) — 1,100+ techniques from the annual Top 10, preserved as Markdown/PDF with Wayback backups so the originals never vanish.
REA — Reverse Engineer Anything (MCP)
Open-source (MIT) MCP server that lets an AI agent reverse-engineer binaries, Electron/.NET/APK apps, websites and runtime behavior via Ghidra/IDA/Hopper. Powerful and dual-use — use only on targets you are authorized to analyze.
OpenSecurityTraining2
University-depth, free courses on system architecture, OS internals, firmware, reverse engineering and vulnerability research.
Cloud & identity
CloudSec Academy
Deep, practical explainers on cloud attack paths, CSPM, CNAPP, and identity.
Career & learning
Introduction to Cybersecurity
Threats, attacks, and how to protect yourself and organisations. Pass the final exam for a Cisco badge.
Cybersecurity Fundamentals
Threat actors, attack types, social engineering, cryptography and detect-and-respond basics. Pass the end-of-course assessment (80%) for a free IBM digital badge.
Microsoft SC-900: Security Fundamentals
Security, compliance, and identity fundamentals across the Microsoft cloud. The learning paths are free; the SC-900 exam is paid.
Fortinet NSE 1: Cybersecurity and Cloud Fundamentals
Free self-paced course that earns the NSE 1 certification on completion, no exam. Replaced Fortinet Certified Fundamentals (FCF) in July 2026.
Junior Cybersecurity Analyst Career Path
Free self-paced path through network defence, cloud security, cryptography, vulnerability assessment and incident response, with a Cisco badge for passing the final exam. Prepares you for the CCST Cybersecurity exam, which is paid.
Know these already? Put them into practice.
PlayCISO turns theory into reps — run a mock incident, sit a simulated PCI QSA interview, or defend your calls to a board.
Links go directly to each provider. PlayCISO curates this list and isn't affiliated with the providers.
Yes, you can learn cybersecurity for free. This library lists hand-picked free cybersecurity courses and certifications by role, and marks which ones end in a certificate or badge. Free badges exist (for example IBM SkillsBuild Cybersecurity Fundamentals), but recognised exams are usually paid.
Last reviewed 4 November 2026.
This is the main PlayCISO page for free cybersecurity courses and certifications. For browser labs, see free and Pro hands-on cybersecurity training and labs. Sub-guides: free cybersecurity certifications, free cybersecurity courses with certificates, free 20-hour cybersecurity training plan, websites to learn cybersecurity for free and free security awareness training.
Free vs needs a plan on PlayCISO
| Practice item | Status |
|---|---|
| How to learn cybersecurity (guide) | Free |
| Beginner CTF challenges | Free |
| CIA triad scenario sorter | Free |
| Detection Lab | Free |
| IR Playbook Lab | Free |
| Forensics Lab | Free |
| SOC Case Triage Lab | Needs a plan |
| AI Cert Prep | Needs a plan |
| Cyber War Room | Free account: 3 campaigns; more needs a plan |
Status for tools is read from the site's paid-tools list. The library entries above are third-party courses; their terms are the provider's.
New to security? Start here
- How to get an entry level cybersecurity job: roles, what employers screen for and a 90-day plan.
- Cybersecurity certifications guide: which ones, in what order, with prices checked.
- Security+ study guide: the exam domains in plain words, mapped to labs, with a six-week plan.
- Beginner CTF challenges: practise encodings, ciphers and basic puzzles.
- CIA triad scenario sorter: the first idea in the field, applied to real incidents.
- Fake job interview malware guide, with the Fake Recruiter Checklist and the Fake Recruiter Interview Lab: spot the lure before the take-home task.
Free AI security certifications: what is actually available
Free certifications focused on AI security are still rare. Most free AI-security learning is reading or coursework with no credential, and most free AI certificates cover building and evaluating AI systems, not securing them. In this library, the AI & LLM Security entry that awards a certificate is the Hugging Face AI Agents Course (free certificates, no deadline). It is an engineering course rather than a security course.
- For the AI-security knowledge itself: start with the OWASP Top 10 for LLM Applications (free reading, no certificate). It covers prompt injection, data leakage and the other core LLM risks.
- For a free security credential to pair with it: IBM SkillsBuild Cybersecurity Fundamentals (free badge for passing the assessment), Cisco Networking Academy's Introduction to Cybersecurity and Junior Cybersecurity Analyst path (badges), and Fortinet NSE 1 are all free.
- What dropped off: ISC2's free Certified in Cybersecurity programme closed to new candidates in May 2026, and Coursera replaced free auditing with a first-module preview, so the Google and Microsoft professional certificates there now need a subscription.
To see every option that ends in a credential, pick your role above, then use the Certificate filter. Links and free status were last checked in October 2026.
Free cybersecurity courses: how to choose
Choose by role and by level, not by brand. Pick the role you are aiming for above, start with the beginner-level entries, and move to role-specific courses once you can explain basic networking and logs. Check what each free entry actually gives you: a certificate, a badge, or learning only.
- How to learn cybersecurity: a six-stage beginner roadmap.
- Hands-on training and labs: where to practise what the courses teach.
- PlayCISO Weekly: a five-minute security briefing every Thursday.
Frequently asked questions
Is there a free AI security certification?
Very few free certifications focus specifically on AI security. Most free AI-security material, such as the OWASP Top 10 for LLM Applications, is reading without a credential. The free AI certificate in this library, the Hugging Face AI Agents Course, covers building and evaluating agents rather than securing them. A practical route is a free security credential such as the IBM SkillsBuild Cybersecurity Fundamentals badge or a Cisco Networking Academy badge, combined with free AI-security reading.
Is ISC2 Certified in Cybersecurity (CC) still free?
Not for new candidates. ISC2 closed new enrollments in its free One Million Certified in Cybersecurity programme on 20 May 2026. Exam codes already issued can be used until 31 December 2026; otherwise the CC exam costs US$199, plus a US$50 annual maintenance fee once you are certified. That is why it is no longer in this library.
Where can I take free cybersecurity courses?
The library above lists hand-picked free courses and certifications from named providers, grouped by role and filterable by level and time. Pick your role, then filter by level. Free status was checked on the date shown on this page, and providers change terms, so confirm on the provider's site before you enrol.
Are free cybersecurity courses worth it?
They are worth it for the foundations and for finding out which part of security you like. A free course shows you can finish learning, but employers usually also look for hands-on practice and, for many roles, one recognised certification. Pair a course with labs and written notes on what you did.
What is the best order for free cyber security training?
Networking and operating-system basics first, then core security concepts, then hands-on labs, then a role-specific course. The beginner roadmap lays out six stages, and the hands-on training guide lists where to practise each one.
Are there free cybersecurity courses with certificates?
Yes, but the certificate is often the paid part. In this library, the IBM SkillsBuild Cybersecurity Fundamentals badge is free (pass the end-of-course assessment with 80% or higher), and Fortinet and Cisco Networking Academy offer free training. Some other certificates, such as TryHackMe path certificates, need a paid plan. Use the Certificate filter above and confirm terms on the provider's page. Checked 4 November 2026.
What are the free cybersecurity certifications?
Free badges and course certificates exist, but recognised exams are usually paid. ISC2 closed new free Certified in Cybersecurity enrollments on 20 May 2026. The guide to free cybersecurity certifications lists what is free, closed or paid, read from each provider's own page.
Is there a free 20-hour cybersecurity training plan?
We did not find a provider offering one official free 20-hour programme. The free 20-hour training plan guide splits 20 hours across foundations, concepts, hands-on web security, guided rooms and PlayCISO labs, using free sources whose pages we checked.
What are the best websites to learn cybersecurity for free?
PortSwigger Web Security Academy says it is 100% free, Professor Messer says all of its training videos are free, and TryHackMe, Cybrary and Hack The Box have free tiers with limits. The websites guide shows what each free tier includes.
Is there free security awareness training?
Some. SANS publishes the OUCH! awareness newsletter free each month, and CISA publishes Cyber Essentials for small organisations. The security awareness guide lists what each provider page does and does not say is free.