Is There a Real SOC Analyst Simulator? What Exists in 2026

You typed "SOC analyst simulator" hoping for the cybersecurity version of a flight simulator: alerts come in, you investigate, you find out whether you would survive a shift. Several platforms now offer something in that space. They simulate different parts of the job, and none of them simulate all of it.

This guide sorts out what "simulator" means in practice, which platforms offer which kind, and what to pick for the practice you need.

Last checked: October 2026.

What does "SOC analyst simulator" actually mean?

People use the phrase for three different things:

1. Alert simulation. Alerts arrive in an environment that stands in for a SOC console. You open each one, gather evidence and decide what it is. This is the closest thing to the Tier 1 shift rhythm.
2. Investigation labs. You get a bundle of evidence (logs, emails, packet captures, disk or memory images) and questions to answer. Less like a shift, more like being handed one case.
3. Story investigations. A continuous incident told across several parts, where what you found earlier matters later. Less like a queue, more like following one incident from first sign to resolution.

All three are useful. None of them is a quiz, and a multiple-choice question bank about SOC terms is not a simulator under any of these definitions.

Which platforms have a SOC simulator in 2026?

LetsDefend: a simulated SOC environment with alerts

LetsDefend's core format is a simulated SOC environment where alerts arrive and you investigate them. That is the closest match to what most people mean by the phrase. Hack The Box acquired LetsDefend in September 2025, and HTB says 191 LetsDefend defensive courses are now integrated into HTB Academy; LetsDefend's own site still sells its plans.

As of October 2026, from LetsDefend's pricing page: Basic is free (free courses, challenges, quizzes, hands-on labs 1 hour/month, limited SOC Analyst alerts); VIP is $24.99/month or $16.99/month billed annually (140 lab hours/month); VIP+ is $39.99/month or $29.99/month billed annually (unlimited lab hours, Incident Responder alerts and courses, connecting to endpoint machines). Prices change, check their site before you buy.

If what you want is alert-by-alert triage practice, in our view this is the first place to look. Our full LetsDefend review covers the plans in detail.

TryHackMe: a SOC simulator used in the SAL1 exam

TryHackMe has a SOC simulator, and it is part of how TryHackMe certifies people: the SAL1 (Security Analyst Level 1) certification combines multiple-choice questions with a practical section in TryHackMe's SOC simulator. In our view that is a useful signal: a simulator a certification relies on for its practical is meant to test whether you can do the work, not just recall terms.

The learning path that feeds into it is SOC Level 1: 14 modules, 65 hands-on labs, estimated at 65h 29m, rated Easy. As of October 2026, from TryHackMe's pricing page, shown to a US visitor (may vary by region): Free $0; Premium $18.11/month or $11.19/month billed annually; MAX $30.73/month or $18.99/month billed annually. Prices change, check their site before you buy.

Hack The Box: Sherlocks and the CDSA

Hack The Box is best known for offensive labs, but its defensive options include two that fit the "simulator" search. Sherlocks are HTB's defensive investigation challenges: evidence plus questions, which puts them in the investigation-lab category. The HTB CDSA (Certified Defensive Security Analyst) is aimed at entry-level SOC analysts; you must complete 100% of the "SOC Analyst" job-role path to start the exam, which is hands-on (security analysis, SOC operations, incident handling) and requires a commercial-grade report.

In our view, the report requirement mirrors one real part of the job: writing up what you found for someone else to act on. HTB Academy prices change on 12 October 2026; see HTB's pricing post (Student $10/month, Silver Monthly $30/month from that date, as of October 2026). Prices change, check their site before you buy.

Blue Team Labs Online: investigations

BTLO, run by Centri (formerly Security Blue Team), sits in the investigation-lab category. The free tier includes all security challenges, with downloadable content such as memory dumps, phishing emails, packet captures and logs. PRO adds 274 investigation labs that run in the browser with no VM or VPN. As of October 2026, from BTLO, PRO is £15/month or £144/year, with 3- and 6-month options. Prices change, check their site before you buy.

BTLO's own FAQ says it is designed for defenders who already have experience with security tools and investigations. If you are new, keep that in mind.

CyberDefenders: browser labs

CyberDefenders runs blue team labs in the browser with zero setup, covering DFIR, threat hunting, threat intelligence and malware analysis. It is free to start; pricing is shown after you create a free account. Its CCDL1 is entry-level SOC analyst training and certification, with Splunk/SPL practice as part of the prep. These are investigation labs rather than an alert stream.

For a wider list of free options, see free-soc-analyst-labs-and-exercises-2026.

EpicDetect Adventures: a continuous story investigation

EpicDetect is in the third category, and to be clear about it: EpicDetect does not have a SIEM-style alert-queue simulator. If alert-by-alert practice is what you are after, LetsDefend's simulated SOC environment is built around exactly that, and TryHackMe's SOC simulator is also worth a look.

What EpicDetect has is Adventures. Season Zero is five episodes forming one continuous, story-driven SOC investigation, roughly 3-4 hours in total, free with no card and no time limit. The point of the format is continuity: an early finding shapes what you check next, the way one incident unfolds across a real investigation. Season One (five more episodes) is in Premium. Alongside it, EpicDetect has guided analysis cases (free, plus Premium ones) and the Atlas skill map for fundamentals.

How do the SOC simulators compare?

Prices as of October 2026; prices change, check each site before you buy.

What does no SOC simulator replicate?

This part is opinion, and we include ourselves in it.

• Real volume. A training environment gives you a curated set of alerts. A real queue on a bad day is a different animal, and much of the skill is deciding what to ignore.
• Real colleagues. You will not get a senior analyst asking why you closed something, a handover note from the night shift, or an engineer who disagrees with your escalation.
• Real consequences. In practice a wrong call costs you a point. At work it costs someone a weekend, or misses something that matters. That pressure changes how people think, and nothing in training reproduces it.
• Your organisation's quirks. Every environment has its own noisy service account, its own odd naming, its own "that alert always fires on Tuesdays". You learn those on the job.

None of that makes simulators pointless. It means they train the reasoning and the tool fluency, and the job trains the rest. For a picture of what the real thing feels like, read what-a-real-soc-investigation-feels-like.

Which SOC analyst practice should you start with?

In our view, for most beginners:

1. Fundamentals first. If a Windows event ID or a process tree means nothing to you yet, any simulator will feel like guessing. TryHackMe's SOC Level 1 path or EpicDetect's free Atlas modules both cover that ground.
2. Then the queue. Once you can read a log, LetsDefend's alert environment or TryHackMe's SOC simulator builds triage rhythm. Pair it with how to tell a true positive from a false positive.
3. Then whole incidents. A continuous investigation (EpicDetect Adventures) or evidence-heavy labs (BTLO, CyberDefenders, HTB Sherlocks) teach you to connect findings into one story.
4. Then a practical cert, if you want one. SAL1 (simulator practical), CDSA (hands-on exam plus report) and BTL1 (practical exam) all test doing, not just knowing.

FAQ

Is there a free SOC analyst simulator?

Several have free options. As of October 2026, LetsDefend's free Basic plan includes limited SOC Analyst alerts, TryHackMe has a free plan, and EpicDetect's Adventures Season Zero (a continuous story investigation, not an alert queue) is free with no card.

What is the TryHackMe SOC simulator?

It is the simulator TryHackMe uses for the practical section of its SAL1 (Security Analyst Level 1) certification, which also includes multiple-choice questions.

Does a SOC simulator count as experience on a CV?

It counts as practice, not employment. In our view, list it under projects or training and be ready to talk through one investigation in detail. That is far more convincing in an interview than a count of completed labs.

Is LetsDefend a SOC simulator?

Its core format is a simulated SOC environment where alerts arrive and you investigate them, so yes, it is one of the closest matches to the phrase. Hack The Box has owned it since September 2025.

Does EpicDetect have a SOC simulator?

Not an alert-queue one. EpicDetect's Adventures are a continuous story investigation across episodes, plus guided analysis cases. If you want alert-by-alert triage, LetsDefend is the closer fit, and TryHackMe's SOC simulator is another option to look at.

How EpicDetect Can Help

If you want to know what working one incident from start to finish feels like, play Adventures Season Zero. It is five episodes, roughly 3-4 hours, free and in the browser.

If the logs in any simulator still look like noise, build the fundamentals on the Atlas first: Linux, Windows, Active Directory and more, free with no time limit.

Start free. No card needed.

Sources

• LetsDefend pricing
• Hack The Box acquires LetsDefend
• HTB Academy new pricing
• HTB Labs subscriptions
• HTB CDSA
• TryHackMe pricing
• TryHackMe SOC Level 1 path
• TryHackMe SAL1
• Blue Team Labs Online
• Centri BTL1
• CyberDefenders blue team labs
• CyberDefenders CCDL1