Hands-on SOC training · free to start

A map of the job. Not a pile of courses.

The Atlas lays out every skill a SOC analyst actually uses, shows you where you stand, and hands you the next twelve-minute lesson. Finish a node and a real case opens up, with a team waiting on your call.

No card to start840 analysts on the mapRuns in the browser. No homelab.

nodes on the map: 44
career zones: 8
guided routes: 5
free story episodes: 5
people learning here: 840

Don't know where to start?

Pick a route. One of the team walks it with you.

A route is a numbered path across the map, with a person from the SOC who reacts as you go. Change your mind any time; nothing you finished is lost.

Not sure? Look at the map first

ROLE10 steps

SOC Analyst · Level 1The shift, in order. Finish it and Ed puts you on a real case.

Ed Mercer · SOC Lead

CERT6 steps

Security+ · SY0-701The cert gets the interview. The modules get you through week one.

Ed Mercer · SOC Lead

CERT5 steps

Network+ · N10-009Half of what you will chase lives in a packet. Learn to read it.

Ed Mercer · SOC Lead

SKILL4 steps

Linux for SOCNobody hands you a GUI during an incident. Be fast in a shell.

Mara Vance · Tech Lead

SKILL2 steps

Cloud SecurityThe box that got popped is not in a rack you can walk to.

Mara Vance · Tech Lead

Progression

Every lesson pays. Every ten is a level. Every module opens a case.

Nothing here is a certificate of attendance. Points land as you pass the checks inside a lesson, the map lights up node by node, and finishing a module hands you a real investigation with the team.

1 · Inside a lesson

EARNED SO FAR4 / 10 pts

Two knowledge checks passed, the final assessment still to go. Finish for the other 6.

You see the points fill up while you work, not a week later.

2 · On the map

SIEM Fundamentals

1 lesson to unlock Case: Auth Spray

Finished nodes glow. The one you are in shows its ring. Anything you have not touched stays quiet.

The map is the progress bar. There is no other one.

3 · On your record1,250 ptsLevel 12 · Security Analyst

VPN Auth Spray · Case+40

OSI Model · Lesson+10

Every point has a receipt. Titles come at 500, 1,000, 3,000.

Then the real thing

Finish a node. Work a case with the team.

Cases are investigations, not quizzes. A queue, real logs in a browser SIEM, a decision to make, and four people who remember how you did. Close one well and their trust in you goes up. That is the only leaderboard that matters here.

Ed MercerSOC Lead · incident leadership
Mara VanceTech Lead · siem & endpoint
Tess HarrowEmail Specialist · email security
Eli NavarroThreat Intel · threat intelligence

See the casesNo homelab. No VM. It runs in the tab you are in.

Straylight Finance · SOC1 in queue

Analyst queue

VPN Auth Spray Against Treasury StaffED-104 · Log/SIEM Analysis · easy · 10-15 min · 40 ptsUnlocked by SIEM Fundamentals

Macro Click on ws-fin-01Endpoint Investigation · unlocks when Windows Event Logs is done

Two more lessons and the auth spray is yours to work. Do not rush the logs module; it is the one you will use every day.

Season Zero · free · 2-3 hours

Your first week was supposed to be easy.

Five episodes, one unfolding incident, the same four people. Start here if you have never worked an alert, or if you want to feel the job before you commit to the map.

01First Day25-30 min
02Inbox Zero30-40 min
03Follow the Thread35-45 min
04Lateral40-50 min
05Containment40-50 min

Recall

It fades. We tell you.

Every card you rate inside a lesson gets a memory score that drops if you leave it alone. When a finished node starts to fade on the map, a four-minute review brings it back. No streak to break, no guilt. Just a nudge before you forget.

Network Basics · 45% recall

Done three weeks ago. Fading.

Top it up · 4 min

146 cards tracked9 due today82% average

When you need the cert

Security+, A+ and Network+ simulators, flashcards, and a dated 30-day plan.

Here when you need it. It is not the point.

Exam simulator 30-Day Accelerator

Pricing

Start free. Pay when the map runs out.

FREE$0

The whole map to look at, the free nodes to learn, Season Zero, the free cases, recall, your record.

No card. Progress is kept if you upgrade later.

PREMIUM7-DAY TRIAL

$15/mo billed yearly

or $25 month to month. Every node, every track, every case, the exam simulators, Season One.

Start the trialCancel any time. You keep everything you finished.

Questions

Fair ones.

: No. The map starts at "How Computers Work" and builds through networking, operating systems and security basics before it branches. Season Zero teaches the tools inside the story before it asks you to use them. If you can use a browser, you can start today.
: They train the attacker. This trains the person who catches the attacker: reading logs, triaging alerts, writing detections, working an incident with a team. If the job you want is SOC analyst, detection engineer or incident responder, this is what that job looks like.
: It trains the things interviewers test: alert triage, email analysis, log correlation, detection writing, incident response. The cases give you investigations you can talk through in an interview. The map gives you a record of what you have actually done, not what you watched.
: CompTIA Security+ (SY0-701), Network+ (N10-009), and A+ Core 1 and Core 2, each with a full-length simulator and flashcards by domain. There is also a dated 30-day Security+ plan with coaching if you want a deadline.
: Yes, and it is not a teaser. The whole map is visible, the free nodes are real lessons, Season Zero is the full five episodes, the free cases are real investigations, and your recall and record are kept. No card to start.
: A lesson is about twelve minutes and pays as you go. Season Zero is two to three hours. The first case opens as soon as its module is done. People tend to say they feel different in interviews after a few weeks of steady rooms, but the honest answer is that the map shows you your own answer.
: Skip the foundation. Prerequisites are advice here, not gates, so open Detection or Malware directly, or go straight to the cases. Recall will tell you which of the basics has actually faded.

Open the map. See what you already know.

Three minutes to sign up, no card, and the first node is waiting. If you would rather feel the job first, Season Zero is free too.