LetsDefend

What it is

LetsDefend puts you inside a simulated SOC dashboard and gives you alerts to triage: suspicious log entries, a phishing email to analyse, a malware sample to investigate, or a full incident to work end to end. Rather than teaching how to break into a system, it teaches how to notice, investigate, and respond to someone else trying to. Content is organised into learning paths for roles like SOC Analyst, Incident Responder, and DFIR (digital forensics and incident response) specialist, and challenges are mapped to the MITRE ATT&CK framework so you can see which adversary technique a given alert corresponds to.

Why it fills a gap

Most beginner security platforms, TryHackMe, Hack The Box, picoCTF, lean offensive: how to find and exploit a vulnerability. Actual entry level security jobs are disproportionately defensive, SOC analyst roles in particular, and LetsDefend is one of the few platforms built specifically around that side, with a browser based interface that mirrors what a real SOC ticketing and SIEM workflow feels like rather than teaching exploitation and leaving defence as an afterthought.

Free versus paid

The Basic tier is free and always available, with limited scope. The paid VIP and VIP+ tiers add the fuller skill building and career focused content. As of 2026-09 the LetsDefend homepage lists individual paid plans between $16.99 and $39.99 a month, the pricing page notes savings for annual billing, and students with a .edu or other verified student email get 50% off at checkout. As with any subscription platform, check the current pricing page since tiers and rates change. LetsDefend is now part of the Hack The Box group following an acquisition, so expect closer integration between the two platforms over time.

Who it suits

Anyone aiming at a SOC analyst, incident response, or blue team role, including people who have done offensive focused training elsewhere and want the defensive counterpart, since understanding both sides of an incident makes each one clearer.

What you can do afterwards

Completion certificates are available for paths, and the hands on alert investigation experience is concrete evidence to talk about when applying for SOC and analyst roles, which are among the more common entry points into a security career.

Common questions

Do I need offensive security knowledge first? No, though it helps to understand common attack techniques (from MITRE ATT&CK or a platform like TryHackMe) since you are essentially working backward from an attacker's actions to detect and respond to them. Is the free tier enough to evaluate it? Yes, for a first look, though the more useful investigation scenarios sit behind the paid tiers.