Every December, TryHackMe hides a cybersecurity lesson behind each door of an advent calendar. Advent of Cyber gives you one free, guided hacking room per day, wraps it in a holiday story, and turns every finished room into an entry for a prize draw. For a lot of people it is the first time they ever capture a flag. If you want to know what that feels like before December 1, the five-minute Capture the Flag 101 lab runs in your browser and walks you through the whole loop: find the target, poke at it, submit the flag.
This guide explains what Advent of Cyber is, how the daily rooms and the Side Quest work, what the 2025 edition covered day by day, what the prizes looked like, what we know about the 2026 dates, and how to spend the next six weeks so Day 1 feels easy.
TL;DR: Advent of Cyber is TryHackMe's free December event: 24 beginner-friendly rooms released one per day, each teaching a single security topic with step-by-step tasks. In 2025 it covered everything from Linux and phishing to IDOR, Splunk and AWS, and each completed room was an entry in a draw for a $150,000 prize pool. You need no experience, just a free account and about an hour a day.
What Is Advent of Cyber?
Advent of Cyber is a free, month-long cybersecurity event run by TryHackMe every December. A new hands-on room opens each day, teaching one topic such as Linux, phishing analysis, web attacks or log analysis through guided questions. Completing rooms earns prize draw entries, and finishing every task by December 31 earns a certificate.
TryHackMe has run it every year since 2019, and the old editions are still playable as numbered rooms (Advent of Cyber 2 was 2020, Advent of Cyber 3 was 2021). The event has grown into one of the largest beginner events in security: the Advent of Cyber 2024 room page shows more than 155,000 users joined. PortSwigger, the company behind Burp Suite, sponsored the 2025 edition and described each day as a "beginner-friendly" challenge.
Why It Works So Well for Beginners
Most CTF competitions drop twenty challenges on you at once and walk away. Advent of Cyber does the opposite. Each room starts with a short story, explains the concept in plain English, gives you a machine to practice on, and then asks questions that move you through the technique one step at a time. In 2024, every day also came with an official walkthrough video, so being stuck never meant being stuck for a week.
The drip-feed pace is the real trick. One topic a day is small enough to finish after work or school, and 24 days in a row is long enough to build a habit. People who would never finish a 40-hour course end up doing 24 hours of hands-on security practice without noticing.
How Advent of Cyber Works
You sign up for a free TryHackMe account and join the event room. Each day, a new task appears inside that room. A typical day looks like this:
- Read the story: a few paragraphs about what went wrong in the fictional town today, which sets up why the skill matters.
- Learn the concept: a short explanation with screenshots and example commands.
- Start the machine: a target VM boots for you, and you attack or investigate it from the AttackBox (a Linux machine in your browser) or from your own VM over OpenVPN.
- Answer the questions: each answer is a flag, a value from a log, a password or a filename. Get them all and the day is complete.
The Story: Wareville and King Malhare
Each edition comes with a story. In 2025, players defended the town of Wareville and The Best Festival Company (TBFC) from King Malhare and his Eggsploit Bunnies, who were trying to wreck the "SOC-mas" holiday season. McSkidy, the series' recurring hero, leads the investigation. The story is light, but it does useful work: each day's attack is framed as an incident, so you learn the technique and the reason a defender or attacker would care about it at the same time.
The Prep Track
Before the 2025 event, TryHackMe released a warm-up room called the Advent of Cyber Prep Track, with ten short missions:
- Password security and a suspicious
Chocolate.exefile to analyze - Setting up the AttackBox, the Windows command line and Linux fundamentals
- Grepping through logs, Wi-Fi security and application security
- Prompt injection against a chatbot, and browser history forensics
If you have never typed a Linux command, do the Prep Track first. It is the difference between enjoying Day 1 and spending it googling what cd does.
The Side Quest
For experienced players, TryHackMe also runs a Side Quest: a set of much harder challenges whose access keys are hidden inside the regular daily rooms. In 2025, the key for the first Side Quest was tucked into a hidden note in McSkidy's home folder on the Day 1 machine, and you only found it if you went looking beyond the questions. TryHackMe's 2024 announcement said completing the Side Quest also improved your odds in the prize draw.
Our advice for beginners: ignore it this year. The Side Quest is built for people who already solve medium boxes on their own. Finish the 24 main rooms, collect the certificate, and come back for the Side Quest next December.
What Advent of Cyber 2025 Covered, Day by Day
The best way to know what is coming is to look at last year. Here is the 2025 schedule by topic, as listed in community write-up indexes of the event:
| Days | Topics |
|---|---|
| 1 to 6 | Linux CLI, phishing, Splunk, AI in security, IDOR, malware analysis |
| 7 to 12 | Network discovery, prompt injection, password cracking, SOC alert triage, XSS, phishing |
| 13 to 18 | YARA rules, containers, web attack forensics, registry forensics, CyberChef, obfuscation |
| 19 to 24 | ICS/Modbus, race conditions, malware analysis, C2 detection, AWS security, exploitation with cURL |
Two things stand out. First, roughly half of the days are defensive: reading logs in Splunk, triaging SOC alerts, writing YARA rules, spotting command-and-control traffic. If you only ever thought of hacking as breaking in, Advent of Cyber is a good, painless introduction to the blue team side. Second, the order is not a smooth difficulty curve. The containers room on Day 14 can feel harder than the CyberChef puzzles on Day 17, so a tough day does not mean the rest will be worse.
Day 1: Linux Command Line
The 2025 opener, "Shells Bells", dropped you onto McSkidy's machine and asked you to find a few flags. That meant listing directories, reading files and filtering logs. The core skill is searching a log for the lines that matter, with commands like these:
$ ls -la ~
$ cat notes.txt
$ grep "Failed password" /var/log/auth.log | head
$ sudo -lThe grep line is the one to remember. Filtering thousands of log lines down to the five that matter is the skill behind half of the defensive days that follow.
Day 5: IDOR
An insecure direct object reference happens when a web app hands you data based on an ID you control, without checking it belongs to you. If your profile loads from /api/user?id=1042, you change it to 1041 and see if someone else's data comes back. In practice, this is one of the most common bugs in real bug bounty reports, and it needs nothing more than your browser's Network tab to find.
Advent of Cyber Prizes and Certificate
The prize draw is a big part of the appeal, and it is not a competition you have to be good at. According to TryHackMe's official terms for 2025, "each correct room completed constitutes an entry." More finished days meant more chances, and the winners were drawn at random. The 2025 prize page listed a total prize pool value of $150,000, up from "over $100,000" in 2024. Highlights from the 2025 list:
- Tech: 3 iPhone 17s, 5 MacBooks, 10 monitors, 10 gaming keyboards and 15 pairs of AirPods 4.
- Hacker tools: 20 USB Rubber Duckies, 10 Flipper Zeros and 10 Raspberry Pi Compute Module 5 IO boards.
- Career: 3 DEF CON tickets, 100 Burp Suite Web Security Certification exams, 100 TryHackMe PT1 and 100 SAL1 certifications.
- Subscriptions and swag: 980 TryHackMe subscriptions from 1 to 12 months, plus 650 swag gift cards.
The rules that tripped people up in 2025: you had to be 16 or older, use a single TryHackMe account, verify that account, and complete rooms between December 1 and December 31. Winners were drawn on January 7, 2026, and had until January 30 to claim. Sharing Side Quest questions or hints publicly was grounds for disqualification.
The Certificate
Finish every task in the event room by December 31 and TryHackMe awards a certificate of completion and a badge on your profile. The name on the certificate comes from your account settings, so set your real full name before you start. It is not a professional certification, but it is a dated, verifiable link that proves you did 24 days of hands-on work. On a junior resume or LinkedIn profile, that is a reasonable talking point.
When Does Advent of Cyber 2026 Start?
As of mid-October 2026, TryHackMe has not announced Advent of Cyber 2026. Recent editions have opened on December 1, and the 2025 prize draw covered rooms completed between December 1 and December 31, 2025. Expect the same window unless TryHackMe says otherwise.
Two practical consequences:
- You can start late. All rooms stay open for the month, so joining on December 10 just means catching up on nine days. You still get every draw entry if you finish before December 31.
- Do the Prep Track first. In 2025, the warm-up room was available before the main event. Watch TryHackMe's site in November and do it as soon as it appears.
Bookmark the official Advent of Cyber page on TryHackMe. The 2026 edition will very likely live at a similar address.
How to Prepare for Advent of Cyber in 6 Weeks
You do not need to prepare at all. The event is designed for people with zero experience. But six weeks of light practice turns December from "follow the instructions" into "understand what I am doing", and that is where the real learning happens. A few hours a week is enough:
- Week 1 - Linux basics: move around the file system, read files, search with
grepandfind, and understand file permissions. Day 1 and many later machines assume you can do this without thinking. - Week 2 - Networking and Nmap: what an IP address and a port are, how to run
nmap -sVagainst a target, and how to connect to what you find withncorcurl. - Week 3 - Web basics: open your browser's DevTools, read requests and responses in the Network tab, edit a cookie, change a parameter. This covers IDOR, XSS, race conditions and the cURL day.
- Week 4 - Logs: read a web server access log and an SSH auth log, and find the attacker's IP. This is the foundation for the Splunk, SOC triage and web forensics days.
- Week 5 - Phishing and encoding: read raw email headers, decode Base64 and hex in CyberChef, and recognize a hash type. Three or four 2025 days lived here.
- Week 6 - Take notes: solve two small challenges and write each one up in half a page. You will use the same template every day in December.
Tips for Your First Advent of Cyber
- Watch the AttackBox clock. Free TryHackMe accounts get one hour of AttackBox a day. Read the day's text before you start the machine, and if you have your own Kali VM, connect over OpenVPN instead, which the daily limit does not apply to.
- Do the day, then watch the video. The official walkthrough videos are excellent, but watching first turns the room into copy-paste. Try for 30 minutes on your own, then watch.
- Keep a notes file. Paste every command that worked and one sentence on why. By December 24 you will have a personal cheat sheet you actually understand.
- Do not chase every day on the day. Missing three days over a weekend is fine. Rushing to catch up is how people quit.
Advent of Cyber vs SANS Holiday Hack Challenge
December has two big free events, and people often ask which one to pick. You can do both, but they suit different players. Our SANS Holiday Hack Challenge guide covers the other one in depth.
| Feature | TryHackMe Advent of Cyber | SANS Holiday Hack Challenge |
|---|---|---|
| Cost | Free | Free |
| Format | One guided room per day, 24 in 2025 | Explorable 8-bit game world, or CTF mode |
| Pace | Daily drip, December 1 to 24 | Everything released together, about two months to play |
| Guidance | Step-by-step teaching in every room, plus videos | Hints from characters, little hand-holding later |
| Difficulty ceiling | Mostly beginner, with an optional hard Side Quest | Expert-level capstones |
| How you win (2025) | Each completed room is a draw entry, $150,000 pool | Write-up judged on quality and creativity |
Our take: if this is your first year in security, Advent of Cyber is the better start. The teaching is more explicit, the daily rhythm keeps you going, and you never face a blank screen with no idea what to try. If you already have a few CTFs behind you, do Advent of Cyber in the evenings for the breadth and spend your weekends on Holiday Hack, where a judged write-up teaches you more than a random draw.
What to Do When December Ends
This is where most people stall. Advent of Cyber works because something new shows up every day. On January 1 the habit has no trigger anymore, and a month later the skills fade.
The fix is to replace the calendar, not the motivation. A few options that keep the same daily rhythm:
- HackerDNA's Daily Hack: one short, self-contained challenge every day of the year, free, in the browser. Recent ones asked players to find data hidden after the last byte of a CV photo, catch a prompt injection planted in a company wiki, and build a password reset link they should never have been able to forge. Most take three to seven minutes. It is the closest thing to Advent of Cyber that does not stop on December 24.
- Old Advent of Cyber editions: previous years remain available as rooms on TryHackMe. Doing one past edition in January is a good way to revisit the topics you rushed.
- A real CTF with a scoreboard: after 24 guided days, a beginner Jeopardy CTF is the natural next test. picoCTF is the easiest place to land.
Legal and Ethical Considerations
Critical reminder: Always get explicit written authorization before testing any system. Advent of Cyber authorizes attacks only on the machines each room deploys for you.
- Stay in scope: attack the target IP the room gives you, nothing else. Do not scan TryHackMe's own infrastructure, other users' machines or the website itself.
- Respect the Side Quest rules: TryHackMe's 2025 terms banned sharing Side Quest questions or hints. Post your daily write-ups if you like, but keep Side Quest spoilers to yourself.
- Play fair in the draw: one account per person. Creating extra accounts to multiply entries breaks the terms and gets you disqualified.
- Leave the techniques in the lab: changing an ID in a URL feels harmless in a holiday room. On a real website without permission, the same request can break computer misuse laws in most countries.
Frequently Asked Questions
Is Advent of Cyber free?
Yes. Advent of Cyber is free to join with a free TryHackMe account, and TryHackMe's terms state that no purchase is necessary to enter the prize draw. The only limit free users notice is the one hour of AttackBox time per day, which you can avoid by connecting your own VM over OpenVPN.
Is Advent of Cyber good for complete beginners?
Yes. It is one of the most beginner-friendly events in security. Each room explains its topic before asking questions, the 2024 edition shipped an official walkthrough video for every day, and the warm-up Prep Track covers Linux and command-line basics for people who have never used them.
When does Advent of Cyber 2026 start?
TryHackMe had not announced the 2026 dates as of October 2026. Recent editions have opened on December 1, and the 2025 prize draw counted rooms completed between December 1 and December 31. Check TryHackMe's Advent of Cyber page in November for the announcement.
How do you win prizes in Advent of Cyber?
Prizes are given by random draw, not by score. In 2025, each completed room counted as one entry, so finishing more days meant more chances. Participants had to be 16 or older and use one verified account. Winners were drawn on January 7, 2026.
Do you get a certificate for Advent of Cyber?
Yes. Completing every task in the event room by December 31 earns a certificate of completion and a profile badge. The certificate uses the name in your TryHackMe settings, so update it before you finish the last day.
What is the Advent of Cyber Side Quest?
The Side Quest is a separate set of harder challenges for experienced players. Access keys are hidden inside the regular daily rooms, so you have to explore beyond the questions to find them. Beginners should focus on the 24 main rooms first.
Last verified: October 2026. Prize list, entry rules and draw dates checked on TryHackMe's Advent of Cyber 2025 prize page and official terms. Sponsorship details checked on PortSwigger's December 2025 announcement. The 2025 day-by-day topics were cross-checked against published community write-up indexes.
Your Next Steps
Advent of Cyber is the easiest yes in beginner security: free, guided, one hour a day, with a story to keep you going and prizes that reward showing up rather than being the best. Create your TryHackMe account now, set your real name for the certificate, do the Prep Track when it lands, and spend the six weeks before December on Linux, logs and web basics.
For that prep, practice where you get guidance. Start with the free Capture the Flag 101 lab, hunt an attacker in Log Hunter, and fill in the networking and Linux basics with HackerDNA's Hacking 101 course. Then keep the daily habit alive after Advent of Cyber ends with the Daily Hack. Start with HackerDNA's free tier - no credit card required, and every lab runs in your browser.
