LetsDefend in 2026: Beginner's Guide and What's Changing

What Is LetsDefend?

LetsDefend is an online blue team training platform where you learn SOC analyst skills by investigating simulated attacks in a browser-based security operations center. You triage alerts such as phishing emails, web attacks and malware infections, follow investigation playbooks, and take courses on topics like SIEM, log analysis and incident response.

The company was founded in 2021. Its homepage now claims 400K learners in more than 150 countries. On September 16, 2025, Hack The Box announced it had acquired LetsDefend, describing it at the time as a community of over 320,000 users.

Why Beginners Like It

Most security platforms teach you a technique, then give you a box to attack. LetsDefend teaches you a job. The SOC simulator looks and feels like the queue a junior analyst works through on shift: an alert with a rule name, a severity and a few fields, plus a set of tools to investigate it. That makes it one of the few places where a beginner can practice the actual daily routine of a tier 1 analyst before getting hired.

It is also not a CTF in the usual sense. There is no scoreboard race against other teams. If you want the bigger picture of where SOC work fits in a security career, our guide on how to become a SOC analyst covers the tiers, skills and pay data.

LetsDefend and Hack The Box: What Changed in 2026

If you read a LetsDefend review from 2024, a lot of it is now out of date. Here is the timeline, taken from Hack The Box's announcements and the notice on LetsDefend's own pricing page:

• September 16, 2025: Hack The Box acquires LetsDefend. A LetsDefend help article from the same week told community users they could keep their subscription and access on LetsDefend's website, with "no immediate plans to move platforms."
• August 28, 2026: Hack The Box announces that 191 LetsDefend courses are now modules in HTB Academy, and that LetsDefend challenges have been turned into Sherlocks, HTB's defensive investigation challenges.
• September 30, 2026: Hack The Box launches its HTB PRO plan ($49 a month or $490 a year), which includes the LetsDefend-derived Sherlocks. Its SOC Range, "built on LetsDefend's SOC simulation capability," is announced for Q4 2026.
• October 15, 2026: According to the LetsDefend pricing page, Hack The Box platforms become "the exclusive home for all newly released courses and challenges." The same notice says annual LetsDefend subscriptions are no longer sold, and that SOC alerts will follow to Hack The Box by the end of 2026.

Is LetsDefend Shutting Down?

Not as of October 2026. The site still works, the free Basic plan is still open, and monthly VIP plans are still on sale. But the direction is clear: new content goes to Hack The Box, and the alert simulator is scheduled to follow. Our read is that LetsDefend is being wound down into Hack The Box over time, even though no closing date has been published.

What that means for you in practice:

• Free users: nothing to lose. Use the free courses and monthly alerts while they exist.
• Thinking about VIP: pay month to month only, and only for a month you will actually use. Do not expect new content.
• Want the same material long term: it now lives in HTB Academy and HTB Labs, under Hack The Box's own pricing.

How the LetsDefend SOC Simulator Works

The simulator is the reason people search for LetsDefend, so it is worth understanding before you sign up. Community walkthroughs of LetsDefend alerts all describe the same loop:

1. Pick an alert from the queue: the Monitoring page lists incoming alerts with an event ID, a rule name such as "Phishing Alert - Deceptive Mail Detected", a severity and key fields like source and destination addresses.
2. Take ownership: you claim the alert so it moves into your Investigation Channel, the way a real analyst claims a ticket so two people do not work the same case.
3. Create a case and open the playbook: the playbook asks a series of questions. When was the email sent? Who received it? Is there an attachment? Did anyone click?
4. Investigate with the built-in tools: answer each question using simulated Email Security, Log Management, endpoint (EDR) and threat intelligence screens. Some steps ask you to act, such as deleting a malicious email or containing an infected host.
5. Close the alert: you mark it as a true positive or a false positive, and the platform checks your answers against the expected ones.

Example: Triaging a Phishing Alert

Here is what the thinking looks like on a typical phishing alert. The email below is our own illustration, not copied from LetsDefend, but it shows exactly what a playbook expects you to check. The raw headers of the reported message read:

Return-Path: <[email protected]>
Received: from mail.bulk-mailer.example (unknown [203.0.113.45])
    by mx.acme.example with ESMTP
From: "Acme Payroll" <[email protected]>
Reply-To: [email protected]
Subject: Action required: confirm your direct deposit details
Authentication-Results: mx.acme.example;
    spf=fail smtp.mailfrom=bulk-mailer.example;
    dkim=none; dmarc=fail header.from=acme.example

Three things should jump out. The From address claims to be internal, but the message came from an outside server at 203.0.113.45. SPF fails for the bounce domain and DMARC fails for acme.example, so nothing proves this message really came from Acme. And the Reply-To points to a look-alike domain, so any reply goes straight to the attacker.

That makes the email malicious. The next question in the playbook is the one beginners forget: did anyone click? You search the proxy or firewall logs for the link's domain and the recipient's IP address. A hit like this changes everything:

2026-10-20 09:14:52  172.16.20.31  GET  https://acme-hr-portal.example/login  200

A 200 response means the page loaded on the employee's machine. Now it is no longer just a phishing email: the user may have typed their password into a fake portal. You close the alert as a true positive, contain or flag the host, and escalate so the account's password gets reset. If the log search had come back empty, you would still delete the email from every mailbox that received it, but the incident would stop there.

In practice, this is the skill that separates a good junior analyst from a nervous one: not knowing every tool, but asking the next question in the right order.

LetsDefend Courses, Paths and Challenges

Alongside the simulator, LetsDefend offers text-based courses, learning paths and standalone challenges. The courses mix short lessons with questions, and some include hands-on labs or alerts tied to the topic.

The SOC Analyst Learning Path

This is the flagship path and the one most beginners should look at. It lists 25 items, starting with these:

• SOC Fundamentals (9 lessons): what a SOC does and how analysts work together.
• Cyber Kill Chain and MITRE ATT&CK Framework: the two models you will use to describe every attack. The MITRE ATT&CK knowledge base is free, and it is worth browsing alongside the course.
• Phishing Email Analysis: 7 lessons, a challenge and 4 alerts, very close to the example above.
• Detecting Web Attacks: spotting SQL injection, XSS and similar attacks in web server logs.
• How to Investigate a SIEM Alert?, Malware Analysis Fundamentals, Network Log Analysis, SIEM 101 and Splunk later in the path.

LetsDefend does not give a fixed duration. Its FAQ says the path can take "anywhere from a few weeks to a few months," depending on your pace. SOC Fundamentals and Phishing Email Analysis are both listed as free beginner courses on the LetsDefend homepage, so you can start the path without paying.

Other Paths and Challenges

Beyond SOC Analyst, LetsDefend lists Incident Responder, DFIR and SIEM Engineer paths, plus preparation tracks for CompTIA CySA+ and the Google Cybersecurity Certificate. The challenges are standalone investigations: you get evidence such as a log file, a memory image or a malicious document and answer questions about it. If you enjoy those, you will probably enjoy CyberDefenders too, which is built entirely around that format.

Is LetsDefend Free? Plans and Pricing

Yes, LetsDefend has a free plan. The Basic account gives you the free courses, challenges and quizzes, plus 15 SOC analyst alerts to investigate each month, according to LetsDefend's help center. You need to pay for full courses, learning paths and more alerts.

Students who sign up with a .edu email get 50% off at checkout. You can cancel from your profile page at any time, and access lasts until the end of the billing cycle.

Our take: do not buy VIP+ as a beginner. The extra content is incident responder material, which only makes sense after the SOC Analyst path. And with new content now going to Hack The Box, a single focused month of VIP is the most we would spend on LetsDefend today.

How to Get the Most Out of the Free Plan

Fifteen alerts a month sounds small, but it is plenty if you treat each one as a lesson instead of a box to tick. A four-week plan that fits around work or school:

1. Week 1 - SOC Fundamentals: do the free course and read the first chapters of the MITRE ATT&CK site. Learn what "true positive", "false positive" and "escalation" mean before you touch an alert.
2. Week 2 - Phishing: take the free Phishing Email Analysis course, then work three or four phishing alerts. For each one, write down which header gave it away.
3. Week 3 - Logs: pick web attack and brute force alerts. These force you to search logs, which is the core skill of the whole job.
4. Week 4 - Write it up: spend your remaining alerts slowly, and write a short incident note for each: what fired, what you checked, your verdict, and what you would do next. That note is what employers want to see in an interview.

A tip from the walkthroughs: keep the playbook and your notes open side by side. Rushing to close alerts teaches you nothing, and a wrong verdict on a real SOC shift can mean a missed breach. The NIST incident response guide, SP 800-61 Revision 3, is dense but worth skimming once to see how real teams structure this work.

LetsDefend vs TryHackMe, CyberDefenders and Hack The Box

"Which is better for beginners, TryHackMe or LetsDefend?" is one of the most common questions about the platform. The honest answer depends on what you already know.

TryHackMe is the better first step if you have never used Linux or read a log file. Its rooms explain each concept in more detail and guide you step by step. Our guide to the TryHackMe SOC Level 1 path covers its 14 modules and what Premium costs.

LetsDefend is the better second step. Once you know what SPF or a Windows event ID is, the alert queue shows you how that knowledge gets used under realistic conditions.

CyberDefenders is where you go when you want harder investigations on real PCAPs, memory dumps and disk images. Our CyberDefenders beginner guide explains its free labs and the CCDL1 certification.

HackerDNA fits alongside all of them. Our SOC Analyst course has you write SIEM queries in Splunk and Elastic, build Sigma and Suricata rules, and map alerts to MITRE ATT&CK. Because HackerDNA also teaches offense, you see attacks like SQL injection or a password spray from the attacker's seat first, which makes their traces much easier to spot in a log.

Legal and Ethical Considerations

• Handle samples safely: LetsDefend challenges can include real malware and malicious documents. Open them only in an isolated virtual machine, never on your everyday computer.
• Do not look up real people: investigating a simulated phishing campaign is training. Running the same lookups against a real company's staff or infrastructure without permission is not.
• Keep real data private: if you practice log analysis at work, do not paste company logs or IP addresses into public write-ups or online tools.
• Respect write-up rules: check each platform's policy before publishing solutions, and never share answers to certification exams.

Frequently Asked Questions