Blue Team Labs Online (BTLO) Review 2026: Free Challenges vs PRO

Blue Team Labs Online is one of the first names that comes up when you search for blue team practice. It also has a catch that most reviews skip: BTLO's own FAQ says it is built for people who already know their way around security tools.

So is it for you? This review goes through what BTLO is, what is free, what PRO adds, what it costs, and who it suits. One honest note first: this is built from BTLO's own published pages, not from a PRO subscription we paid for. We'll tell you where that matters. Prices and lab counts below are as of 24 October 2026 and change, so check BTLO before you buy.

What is Blue Team Labs Online?

BTLO is a gamified practice platform where defenders work through security investigations and challenges. Its site lists incident response, digital forensics, security operations, reverse engineering and threat hunting as the areas it covers.

It is run by Centri, the company that also sells the BTL1 certification. If you are weighing the cert, we cover it in our BTL1 review.

Content comes in two formats:

• Challenges: downloadable files you work on your own machine, such as memory dumps, phishing emails, packet captures and logs.
• Investigations: scenario-based labs. These are the paid part, and they run in the browser.

You earn points for answering all the questions in a lab or challenge, scaled to its difficulty rating. Points feed profiles and leaderboards, and the site also hands out achievements, ranks, badges and titles.

Is BTLO free?

Partly, and the free part is generous. BTLO says you get access to all of its security challenges for free.

The catch is the format. Challenges are downloads, so you supply the tools. For a memory dump that means setting up something like Volatility yourself. If you enjoy that, great. If you are still learning what to open first, it can stall you.

What do you get with PRO?

PRO adds the investigations. BTLO's site lists these perks:

• Unlimited access to active and retired investigations, described as dedicated labs "that no one can interfere with"
• A browser-based client, so no VM or VPN setup
• Profile customization
• Achievements for completing pathways
• Global and local leaderboards
• Cancel any time

At the time of writing the site says PRO gives access to 275 unique investigation labs, plus all the challenges.

PRO prices on the site are in pounds:

• 1 month: £15
• 3 months: £40.50 (BTLO says this saves 10%)
• 6 months: £76.50 (saves 15%)
• Annual: £144 (saves 20%)

The page does not give a count for the free challenges, so we won't quote one.

Is BTLO good for beginners?

By BTLO's own words, not really. Its FAQ says the platform "is designed for defenders that already have experience with security tools and investigations." It also says it is not a training platform, and that a training subscription is in development.

That is an honest thing to say, and it is useful to you. If you are brand new, a platform that teaches as it goes will feel better first. Some options are in our comparison of free SOC labs and our LetsDefend review. For CyberDefenders, see our CyberDefenders review.

We can't tell you how hard individual BTLO labs are in practice, because that is exactly what a PRO subscription would show. If a specific lab's difficulty matters to you, look at its difficulty rating on the site before you start.

Is BTLO worth it? Who it suits

Let's lay it out plainly.

BTLO makes sense if:

• You already use tools like a SIEM, Wireshark or a memory forensics tool and want varied scenarios to practice on
• You like leaderboards and points as motivation
• You want scenario labs in a browser without setting up a VM
• You are keeping skills sharp for a role you already have

Maybe not yet if:

• You have never opened a log or a packet capture and want someone to explain the steps
• You want a structured curriculum with lessons before scenarios
• You want a certification path in the same subscription (BTLO's page does not mention certifications)

How do I use BTLO alongside other practice?

A simple plan, in order of difficulty:

1. Learn the investigation loop. Pick up the habit of forming a question, finding evidence and writing a verdict. Our free Cases start easy and list time up front (the first ones are marked easy and 10 to 15 minutes), so you can build that habit in short sessions.
2. Follow a story. Adventures Season Zero is a free, browser-based, story-driven SOC investigation. It is aimed at beginners and takes about 30 to 40 minutes for the first episode.
3. Try BTLO's free challenges. Download one, pick the tool you know least, and work through it.
4. Decide on PRO after that. If you are running out of free material and want browser-based labs, a one-month PRO is the lowest-commitment way to see what the investigations feel like.

FAQs

Is Blue Team Labs Online free?

Partly. All of BTLO's security challenges are free, according to its site. The 275 investigation labs need PRO.

How much is BTLO PRO?

As of 24 October 2026 the site lists £15 for one month, £40.50 for three, £76.50 for six and £144 for a year. Prices change, so check before buying.

Is BTLO the same as BTL1?

No. BTLO is the practice platform. BTL1 is a separate certification sold by the same company, Centri. Our BTL1 review covers the cert.

Does BTLO need a VM or VPN?

PRO investigations run in a browser, so BTLO says no VM or VPN setup is needed. Free challenges are downloads, so you use your own tools.

Is BTLO a good way to prepare for a SOC job?

It is practice, not a course. BTLO says it is for people who already have experience, so pair it with something that teaches the basics first.

TL;DR

BTLO is a gamified blue team practice platform from Centri. The challenges are free downloads, and PRO (from £15 a month) adds 275 browser-based investigation labs. BTLO's own FAQ says it is designed for people who already have some experience, so beginners may want a guided platform first. This review is based on BTLO's published information, not on a paid subscription of ours.

Sources:

• Blue Team Labs Online
• Centri

How EpicDetect Can Help

If BTLO is a place to sharpen skills, start with the basics somewhere that explains them. Our Cases are free, hands-on investigations covering email analysis, SIEM correlation, endpoint forensics and threat intelligence. You work the evidence, then check your verdict.

For a story-driven start, Adventures Season Zero is free. When you want structured lessons, the EpicDetect Atlas maps nine learning paths from foundations through SOC investigation.