Practise the security job before you apply for it.
Hands-on labs for computer science, IT, cybersecurity and engineering students: respond to a ransomware incident, triage a SOC log stream, write detection rules and work a forensic case. All in your browser, graded as you go, no install and no account.
The first lab is the IR Playbook Lab. Free, no signup, English and Spanish.
What you can do in your first hour
Five labs, all free, none needing an account. Each one scores you, explains what you missed, and lets you run it again.
IR Playbook Lab
Read an incident brief (ransomware, BEC wire fraud or a leaked AWS key) and put the response in the right order. Wipe before you image and the evidence is gone; that is how it is scored. Mid-run injects change the plan, and a Socratic AI coach asks questions without giving the answer.
OpenSOC Log Triage Trainer
A stream of 1,000 synthetic logs from identity, EDR, firewall, email, DNS, proxy and cloud sources. Click the fields that look wrong, then see which were real red flags and why.
OpenDetection Lab
Write SIEM rules with conditions and count-based correlation, run them on a labelled log stream, and tune them until you catch the attack chain without false positives.
OpenForensics Lab
Work a case from mail, identity, endpoint and network artifacts. Separate evidence from red herrings and back every conclusion with the artifact that proves it.
OpenPick the Phish
Fifty emails, ten of them phishing. Read the headers, inspect the links, and report the hostile ones without flooding the queue with false alarms.
OpenWant more? The labs hub has the rest, from firewall rules to cloud misconfigurations, filterable by role.
Browse all labsPick the role you are aiming at
The skills entry-level security jobs ask for, and the free labs and tools that practise them.
SOC analyst
Log reading, alert triage, writing and tuning detections.
Incident responder
Response order, evidence handling, containment under pressure.
GRC analyst
Frameworks, control gaps, audit readiness.
AppSec and AI security
Secrets in code, LLM and agent risks, MCP configuration.
Proof you can show an employer
What you actually get at the end of a run, described exactly.
A shareable IR scorecard
Every finished IR Playbook Lab run gets its own public page with your grade, time, accuracy per phase of the response and, once enough people have played that scenario, your percentile. The link unfurls with a preview card on LinkedIn and in chat.
Practice certificates
The SOC Log Triage Trainer, Pick the Phish and the NIST CSF 2.0 Toolkit turn your result into a certificate page with your name, grade and score, plus an image you can download. They are practice records, not accredited or proctored credentials, so present them that way.
Something real to talk about
An interviewer will ask what you would do first in a ransomware incident. Having sequenced it, been marked down for wiping before imaging, and fixed it on the next run is a better answer than a definition.
For lecturers
Bring your class
The IR Playbook Lab has a class mode built in: brief the class, let everyone play a run or two, then debrief from the live leaderboard. Lecturers at universities in Panama and Peru have already run it with their classes as a Microsoft Teams assignment.
- 1
Create the class
Open the IR Playbook Lab, press Class, type a class name and press Create class. You get a six-character code and a student link. No lecturer account is needed.
- 2
Hand it out
Share the link or the code however you already reach students: an LMS post, a Microsoft Teams assignment, or the projector. Codes avoid 0/O and 1/I so they survive being read aloud.
- 3
Students play
They open the link (or type the code into the lab) and play as usual. No student accounts or emails. The board shows the first name each student chooses, or "A PlayCISO player".
- 4
Watch and debrief
The teacher view shows the live leaderboard (best score per player, refreshed every 20 seconds), the player count and the class average, and prints cleanly for your records.
- Three scenarios: ransomware on a file server, BEC wire fraud, and a leaked AWS key on GitHub.
- Fully available in English and Spanish, not machine-translated on the fly.
- Class mode covers the IR Playbook Lab. The other labs on this page work for any student individually.
What is free, and what is not
Free, no account
Every lab and tool linked on this page, the Cyber Arcade games, the free templates and the 2-minute readiness scorecard.
Free account, no card
Adds one full War Room incident: you run a breach as the decision-maker and every call is graded.
Pro · $5/month or $40/year
More War Room runs, AI mock interviews across 7 security roles, the architect studios and every Pro tool. One plan, cancel anytime. There is no separate student price.
Inviting classmates can earn Pro: when someone joins through your invite link, verifies their email and finishes their first lab, they get a month of Pro, and when they finish three labs, so do you. Pro needs a card on file to redeem; you are not charged until the free months end. How invites work · Full pricing
Works in any modern browser, on a laptop or a campus lab machine, wherever you study. The companies and incidents are fictional, nothing connects to a real system, and prices are in US dollars.
Frequently asked questions
Is PlayCISO free for students?
The labs on this page are free and need no account: the IR Playbook Lab, SOC Log Triage Trainer, Detection Lab, Forensics Lab, Pick the Phish and the role tools listed. A free account adds one full War Room incident. Pro, which unlocks more War Room runs, the AI mock interviews, the studios and the Pro tools, is $5 a month or $40 a year. There is no separate student discount.
Do I need to install anything or set up a VM?
No. Everything runs in a web browser on a laptop or a lab machine. The incidents, logs and companies are simulations inside the page, so nothing touches a real system or network, and there is nothing to download.
Will this help me get a cybersecurity job?
It gives you practice and something concrete to show: a public scorecard page for each IR Playbook Lab run and practice certificates from the SOC triage, phishing and NIST CSF tools. These are practice records, not accredited certifications, so pair them with the coursework and certifications your programme recommends.
How can my lecturer run this with the whole class?
In the IR Playbook Lab, the lecturer presses Class, names the class and gets a six-character code and link. Students open the link or type the code, play, and their finished runs appear on a live class leaderboard with a printable teacher view. No student accounts or emails are needed.
Does it work outside the United States?
Yes. It runs in any modern browser, wherever you are. The IR Playbook Lab is fully available in English and Spanish, and classes at universities in Panama and Peru have used it as a Microsoft Teams assignment. Prices are in US dollars.
What data do you collect from students?
The free labs need no account and no email. In class mode the leaderboard shows only the display name a student types. Analytics only load if you accept cookies, and you can withdraw that consent on the privacy page.
Your first incident is waiting
Put the ransomware response in the right order, see your grade, and try to beat it.
Start your first lab