Review · Labs and tabletop
TryHackMe review: the free starting point for SOC skills
TryHackMe has the largest audience in this set (8M+ users), a free individual tier and 800+ labs, plus AI-generated tabletop exercises for business teams. It scores 6.5 of 10 and ranks sixth: strong on breadth and effort to run, weaker on executive exercising.
Editorial assessment · Assessed from vendor sites, product pages and published pricing, September 2026
Ranked 6 of 7
Editorial verdict
Start here for analyst skills on a budget; add a crisis simulation platform when executives need to rehearse.
| Fact | Detail | Source |
|---|---|---|
| Business products | SOC Simulator, AI-driven Tabletop Exercises, Custom Content Studio, Live Breach Exercises, Threat Hunting Simulator, Management Dashboard, Tailored CTFs, Certifications | tryhackme.com/business |
| Scale (vendor-stated) | 8M+ users, 800+ labs, 1000+ organizations | tryhackme.com/business |
| Tabletop setup | Choose industry, attack vector and tech stack; edit injects or re-prompt in natural language ("Co-Create"); upload IR playbooks | tryhackme.com/business/solutions/tabletop-exercises |
| Tabletop speed and scale | "10 min average time" to launch; "Unlimited exercises, unlimited participants" | tryhackme.com/business/solutions/tabletop-exercises |
| Frameworks | Scenarios align to NIST and ISO 27035 | tryhackme.com/business/solutions/tabletop-exercises |
| Evidence | "Audit-ready reports" with performance insights | tryhackme.com/business/solutions/tabletop-exercises |
| Individual pricing | Free tier plus paid individual plans listed publicly | tryhackme.com/pricing |
| Business pricing | Not published | tryhackme.com/business |
6-1What does TryHackMe do?
TryHackMe is a gamified, browser-based training platform. Individuals learn through rooms and learning paths; businesses add management dashboards, custom content, simulators and tailored CTFs. The SOC Simulator and Threat Hunting Simulator give analysts practice on realistic alert and hunting workloads.
Its tabletop product generates a scenario from the team's industry, attack vector and technology stack, then lets the team edit injects and response actions or re-prompt. TryHackMe states it costs '56% more affordable than the average consultancy tabletop exercise'; that is the vendor's comparison, not ours.
6-2Who is it built for?
SOC analysts, security engineers and the managers who run their training. The tabletop page speaks to managers, practitioners and security leaders. Executives, legal and communications are not the stated audience.
6-3What does it cost?
Individual plans, including a free tier, are listed on the public pricing page. Business plans are priced through sales.
6-4What are the caveats?
- Cross-team exercising scores 5: the tabletop centres on the security team.
- Business pricing is not published.
- Launch-time and cost claims are the vendor's.
6-5How does it score on each criterion?
AI builds the tabletop from industry, attack vector and tech stack; teams can edit injects or re-prompt, and upload their own IR playbooks.
Aimed at managers, practitioners and security leaders; the exercise centres on the security team rather than the boardroom.
Audit-ready reports with performance insights; scenarios align to NIST and ISO 27035.
The vendor states a 10-minute average launch, with unlimited exercises and participants.
800+ labs, a SOC Simulator, a Threat Hunting Simulator and Live Breach Exercises.
8M+ users and a free individual tier; the largest open community in this set.
Individual plans are priced publicly; business plans go through sales.
Strengths
- Free individual tier and the largest community here.
- 800+ labs and SOC and threat hunting simulators.
- AI tabletop with editable injects and playbook upload.
- Alignment to NIST and ISO 27035.
Limitations
- Less suited to executive crisis exercises.
- Business pricing through sales.
- No live-fire range on customer tooling.
6-6What should you compare it with?
See TryHackMe alternatives or compare TryHackMe with other platforms