LetsDefend Review 2026: Price, Free Tier and Alternatives

Thinking about paying for LetsDefend, or upgrading from the free plan? One thing changed in the last year, and many reviews were written before it.

In September 2025, Hack The Box acquired LetsDefend. HTB says 191 defensive courses from LetsDefend are now integrated into HTB Academy. LetsDefend's own site still sells its plans. So a reader choosing LetsDefend in 2026 has two routes to LetsDefend's defensive courses, at different prices and inside different platforms.

Below: what each plan includes, when LetsDefend is the right pick, and which alternative fits the gap you actually have.

Last checked: October 2026.

What is LetsDefend, and what changed in 2026?

LetsDefend's core format is a simulated SOC environment: alerts arrive and you investigate them. Around that it has courses, challenges, quizzes and hands-on labs, organised into career paths for SOC Analyst, Incident Responder and Detection Engineering. The roles it lists include SOC Analyst, Incident Responder, Detection Engineer, DFIR, SIEM Engineer and Threat Hunter.

The news is ownership. Hack The Box announced the acquisition on 16 September 2025, and has since said that 191 LetsDefend defensive courses are part of HTB Academy. In practical terms:

• If you want LetsDefend's simulated SOC environment and its career paths, LetsDefend's own site sells them.
• If you want the defensive course material alongside HTB's wider catalogue (Academy has 350+ modules), HTB Academy is now a second route.

How much does LetsDefend cost in 2026?

As of October 2026, from LetsDefend's pricing page:

There is a 50% student discount with a .edu email. You can cancel any time and the subscription runs to the end of the billing cycle. Certificates of completion for the career paths come with the paid plans.

Prices change, check their site before you buy.

What does the LetsDefend free tier include?

The Basic plan gives you the free courses, challenges and quizzes, one hour of hands-on labs a month, and a limited set of SOC Analyst alerts. That is enough to find out whether the alert-investigation format suits how you learn before you spend anything. In our view, use it exactly for that: work a few alerts, then decide.

Is LetsDefend worth it?

LetsDefend is a good fit if:

• You want alert-investigation practice specifically. The simulated SOC environment is its core format. If your gap is "I have never investigated an alert end to end", it is aimed squarely at you.
• You want a defined career path. SOC Analyst, Incident Responder and Detection Engineering paths give you an order to work in and a certificate of completion on paid plans.
• You want to go past Tier 1. VIP+ adds Incident Responder alerts and courses and connecting to endpoint machines, which is a natural next step after triage.
• You are a student. Half price with a .edu email changes the maths.

It may not be the best first purchase if you are still on absolute fundamentals (what a process is, how Windows logs work, what DNS does). For most beginners we'd learn those first, wherever is cheapest, then come back to alert practice with something to apply.

What are the best LetsDefend alternatives?

Pick by the gap you are trying to close, not by brand.

Missing fundamentals and structure: TryHackMe

TryHackMe's SOC Level 1 path has 14 modules and 65 hands-on labs, estimated at 65h 29m, rated Easy. TryHackMe describes itself as having 1,000+ interactive labs across offensive and defensive topics. It also runs the SAL1 (Security Analyst Level 1) certification, which combines multiple-choice questions with a practical section in TryHackMe's SOC simulator.

As of October 2026, from TryHackMe's pricing page, shown to a US visitor (may vary by region): Free $0; Premium $18.11/month or $11.19/month billed annually; MAX $30.73/month or $18.99/month billed annually. The free plan has limited path access and a 1-hour daily limit on the in-browser attack machine. Prices change, check their site before you buy.

Choose it if you want a guided, beginner-paced path with a lot of breadth. We go deeper in our TryHackMe SOC Level 1 breakdown.

Want the LetsDefend material plus a certification: HTB Academy and CDSA

Because of the acquisition, HTB Academy is now the closest alternative in content terms. The HTB CDSA (Certified Defensive Security Analyst) is aimed at entry-level SOC analysts. To start the exam you must complete 100% of the "SOC Analyst" job-role path; the exam is hands-on (security analysis, SOC operations, incident handling) and requires a commercial-grade report.

Academy prices change on 12 October 2026. From HTB's Academy pricing post, as of October 2026: Student $10/month (was $8), Silver Monthly $30/month (was $18, Tier 0-II), Silver Annual $550/year (was $490, Tier 0-II plus two bundled exam vouchers: HTB CJCA and one Specialist certification). Gold and Platinum tiers sit above that. Prices change, check their site before you buy.

Choose it if you want one subscription covering defensive and offensive material, with a practical cert at the end. HTB also runs Sherlocks, its defensive investigation challenges (evidence plus questions). See tryhackme-vs-hack-the-box-blue-team-2026 for how the two big platforms compare for blue team work.

Already experienced, want sharp investigation reps: BTLO

Blue Team Labs Online is run by Centri (formerly Security Blue Team). The free tier includes all security challenges, with downloadable content such as memory dumps, phishing emails, packet captures and logs. PRO adds 274 investigation labs that run in the browser, no VM or VPN.

As of October 2026, from BTLO: PRO is £15/month, £40.50 for 3 months, £76.50 for 6 months, or £144/year, cancel any time. Prices change, check their site before you buy.

BTLO's own FAQ says it is designed for defenders who already have experience with security tools and investigations. Take that at face value: in our view it is a great place to keep skills sharp, less so a first stop. If you are weighing Centri's BTL1 certification, read btl1-certification-review-2026.

Want DFIR, threat hunting and malware analysis: CyberDefenders

CyberDefenders runs blue team labs in the browser with zero setup, across DFIR, threat hunting, threat intelligence and malware analysis. It is free to start, and pricing is shown after you create a free account. Its CCDL1 is an entry-level SOC analyst training and certification (Splunk/SPL practice is part of the prep); CCDL2 is a threat hunting and DFIR certification with a 48-hour practical exam.

Choose it if your interest leans forensic, or you want depth in one investigation domain. See CyberDefenders' labs.

Want one free place for fundamentals and a continuous investigation: EpicDetect

EpicDetect focuses on beginners and career changers. It is browser-based, nothing to install. The free plan, with no card and no time limit, includes the Atlas skill map with every free module and track (Linux, Windows, Active Directory, Python and more), Adventures Season Zero, guided analysis cases, Security+ Module 1 and a free 20-question Security+ practice test. Details in the next section.

Want to own the whole stack: a home lab

Security Onion, Splunk Free, Elastic and Wazuh are free software. The cost is your time and hardware. You learn how logs reach a SIEM, but you also write your own attacks and questions, which is slow for a beginner.

How do LetsDefend and the alternatives compare?

Prices as of October 2026; prices change, check each site before you buy.

LetsDefend vs EpicDetect: which should you pick?

They do different jobs, so here is the plain version.

What LetsDefend has that EpicDetect does not: a SIEM-style alert-queue simulator. EpicDetect does not have one. If your goal is to practise working through a stream of individual alerts, LetsDefend is the better fit and you should go there. EpicDetect also has no proctored certification, no memory or disk forensics labs, no malware reverse-engineering labs and no cloud labs.

What EpicDetect focuses on instead:

• A continuous investigation. Adventures Season Zero is five episodes, a single story-driven SOC investigation of roughly 3-4 hours in total, free. The difference from alert-by-alert practice is that what you find early carries into what you do later.
• Fundamentals, free. The Atlas skill map holds every free module and track, including Linux, Windows, Active Directory and Python.
• Security+ in the same subscription. Premium ($25/month, or $180/year, 7-day free trial) adds the Security+ track (8 modules, 46 lessons, in exam order), timed exam simulators for Security+, Network+, A+ Core 1 and Core 2 scored by domain, nine Security+ flashcard decks with spaced review, Adventures Season One and every Premium case.

In our view, the two can sit together: learn fundamentals and work a full incident on EpicDetect for free, then add LetsDefend if you want volume alert practice. If you only have budget for one and your gap is alert triage, choose LetsDefend.

FAQ

Is LetsDefend free?

Yes, there is a free Basic plan. As of October 2026 it includes free courses, challenges, quizzes, 1 hour a month of hands-on labs and limited SOC Analyst alerts. Paid plans add lab hours, and VIP+ adds Incident Responder alerts and courses.

How much is LetsDefend VIP?

As of October 2026, VIP is $24.99/month or $16.99/month billed annually, and VIP+ is $39.99/month or $29.99/month billed annually, per LetsDefend's pricing page. Students get 50% off with a .edu email. Prices change, check their site before you buy.

Is LetsDefend part of Hack The Box now?

Yes. Hack The Box announced it acquired LetsDefend on 16 September 2025, and says 191 LetsDefend defensive courses are now integrated into HTB Academy. LetsDefend's own site still sells its plans.

Should I do LetsDefend or TryHackMe first?

For most beginners we'd start with structured fundamentals (TryHackMe's SOC Level 1 path, or the free Atlas modules on EpicDetect), then move to alert practice on LetsDefend once you know what you are looking at in a log.

Does EpicDetect have an alert-queue simulator like LetsDefend?

No. EpicDetect's investigation practice is a continuous story (Adventures) plus guided analysis cases, not a SIEM-style alert queue. If that queue format is what you want, LetsDefend is the better choice.

How EpicDetect Can Help

If you are shopping for a platform and want to see whether a continuous investigation suits you better than individual alerts, play Adventures Season Zero. It is all five episodes, free, in the browser.

If fundamentals are the real gap, start on the Atlas: every free module and track, including Linux, Windows and Active Directory, with no time limit.

When you are ready, Start free. No card needed.

Sources

• LetsDefend pricing
• Hack The Box acquires LetsDefend
• HTB Academy new pricing
• HTB CDSA
• TryHackMe pricing
• TryHackMe SOC Level 1 path
• TryHackMe SAL1
• Blue Team Labs Online
• Centri BTL1
• CyberDefenders blue team labs
• CyberDefenders CCDL1
• CyberDefenders CCDL2