5 Hack The Box Alternatives for Practical Cybersecurity Training

An invoice lands in a shared inbox on a Friday afternoon. The sender name matches a regular supplier, the amount looks right, and the message asks for payment to a new bank account. Spotting that warning sign is a job for every member of staff. Working out where the email came from, and whether anything else was affected, usually falls to one IT generalist with no formal security training.

Hack The Box is a familiar name for hands-on security practice, but its catalogue leans toward attack-side labs, and its pricing and access tiers have changed over time. For a growing business, the better question is which platform matches the job your security lead actually does. Many owners start by bringing in outside help, such as the cyber security companies for UK SMEs that offer monitoring and support, and then build skills in-house for day-to-day investigation.

The five alternatives below are compared by learning goal, practice format and purchase model. Prices were checked on 27 October 2026 and can change, so confirm current terms before buying.

Staff Awareness vs Technical Training

Two different kinds of training are often confused:

• Staff awareness: every employee needs to recognise and report a suspicious message. The NCSC's free Top Tips for Staff course covers this baseline in a short online module.
• Technical practice: the person who investigates reported problems needs hands-on work with phishing emails, logs and evidence. The platforms below are built for that person, not the whole workforce.

Quick Comparison

‍

The 5 Hack The Box Alternatives

1. TryHackMe

Overview: TryHackMe organises content into rooms, which are short lessons with tasks, and learning paths that put rooms in a recommended order. Its AttackBox runs in the browser, so there's no specialist software to install.

Learning goal: Technical foundations across attack and defence, for an IT generalist new to security.

Access and cost: A Free plan includes free rooms and one hour of AttackBox use per day. Premium was shown at €10.50 and MAX at €17.99 per month, both billed annually.

Consider: The catalogue is broad, so set a clear goal first. Ask the learner to finish one relevant free room and explain how it applies to their work before paying.

2. Centri

Overview: Centri, formerly Security Blue Team, offers practical defensive cybersecurity training and certifications, with more than 150,000 students worldwide and a hands-on lab platform, Blue Team Labs Online.

Learning goal: Defensive investigation and response. Blue Team Level 1 (BTL1) covers phishing analysis, digital forensics, threat intelligence, SIEM and incident response, in about 30 hours.

Access and cost: BTL1 and the Certified Detection Engineering Associate (CDEA) were each £399 for training and exam. Blue Team Level 2, covering malware analysis, threat hunting and vulnerability management, was £1,999.

Consider: These are one-off course purchases rather than subscriptions, so protect study time and match the level to the learner's current experience before buying.

3. PortSwigger Web Security Academy

Overview: PortSwigger's Web Security Academy pairs short explanations with deliberately vulnerable web applications, so learners can practise finding flaws safely.

Learning goal: Web application security, for an employee responsible for a website, booking system or web app.

Access and cost: The Academy labs were free, with progress tracking. Separate commercial products and certifications aren't included.

Consider: The focus is narrow. If the role centres on email fraud or incident response, start elsewhere. Keep practice inside the Academy's labs, since testing a live site needs written authorisation.

4. CyberDefenders

Overview: CyberDefenders offers browser-based Blue Team Labs built around case-style investigations, so learners can examine evidence and work out what happened.

Learning goal: Repeated defensive investigation practice, for someone who has finished introductory study and needs more cases.

Access and cost: CyberRange, its premium lab subscription, was $25 per month. One-time certification purchases are sold separately.

Consider: Ask the learner to pick three labs that resemble their actual duties. If few cases fit, reconsider before committing to recurring access.

5. OffSec Proving Grounds

Overview: OffSec Proving Grounds provides dedicated lab machines for penetration testing, the authorised, simulated attacking that helps owners find and fix weaknesses.

Learning goal: Attack-side practice, for an employee with an authorised testing role or preparing for a penetration-testing qualification.

Access and cost: PG Play is free with a three-hour lab limit. PG Practice was $19 per month or $199 per year. Certification exams cost extra.

Consider: This doesn't cover everyday tasks like spotting a fake invoice. Practise only in the provider's labs or systems you have written permission to test.

How to Choose the Right Platform

Start from the job, not the platform. Four questions narrow the shortlist quickly:

• Who investigates reported problems? Defensive investigation and response training fits this person.
• Does anyone maintain a website or web app? Focused web-security labs may matter more than general security practice.
• Is anyone authorised to test systems? Only then does penetration-testing practice belong in the plan.
• Is the learner new to security? Guided foundations come before specialist courses.

Run a Small Training Pilot

Keep the first commitment narrow enough to assess before spending more:

1. Name an owner. Write down who investigates suspicious activity and who they escalate to, even if that's the business owner.
2. Pick one relevant exercise. Match it to that person's actual responsibilities.
3. Ask for a short summary. Have the learner explain, in plain English, what happened, what they found and when they'd escalate. Read it before funding more training.
4. Protect study time. Schedule learning alongside other work so it doesn't get pushed aside by support requests.
5. Test the wider team. Separately, send staff a fictional email asking to change a supplier's bank details, and note who reports it and who verifies the change through a known contact.
6. Review after changes. Repeat the exercise after a new payment process, cloud system or finance hire.

‍

Conclusion

Hack The Box is one option among several, and the right alternative depends on the job your security lead does. Guided foundations suit someone new to security, structured defensive courses suit the person who investigates and escalates, web-security labs suit whoever maintains your site, and penetration-testing labs suit an authorised tester. Pair any of them with free awareness training for the whole team, start with a small pilot, and expand once you've seen the learner apply what they've practised.

FAQ

Do all staff need hands-on cybersecurity training?

No. Most staff need awareness training to recognise and report suspicious messages. Hands-on labs are for the person who investigates and responds.

Is there a free alternative to Hack The Box?

Yes. PortSwigger Web Security Academy labs are free, and TryHackMe and OffSec Proving Grounds both have free tiers with limits.

What's the difference between blue team and red team training?

Blue team training covers defence: spotting, investigating and responding to attacks. Red team or penetration-testing training covers authorised, simulated attacks to find weaknesses.

Can employees practise on our own systems?

Only with explicit written authorisation. Keep practice inside the provider's labs unless testing has been formally approved and scoped.

‍