What Hack The Box's 2026 benchmarks say about AI in technical training

Technical security training was built on a simple idea: an analyst learns a skill by doing it by hand, many times, until it is routine. Two benchmark reports Hack The Box published in 2026 suggest that idea needs an update.

What did the reports find?

The first, an AI-augmented versus human-only performance benchmark covered by Cybersecurity Insiders on 6 March 2026, compared teams that used AI with teams that did not. AI-using teams reached 27% challenge success against 16% for the top human-only teams, and Hack The Box said elite AI-augmented teams produced up to 4.1 times the output. The same report warned of a talent-pipeline risk: the mid-tier tasks that juniors traditionally learn on are the ones AI absorbs fastest.

The second, the 2026 Global Cyber Skills Benchmark Research Brief, published on Hack The Box's blog on 26 August 2026, looked at a large competition. It says 68% of the top 25 teams used AI agents, although agents made up only 2.7% of registered accounts. Median solve time fell from 26.1 hours in 2024 to 13.8 hours in 2026, and the number of teams completing the full board rose from 2 to 15.

These are vendor reports about competition settings, not field studies of SOCs. They are still the most detailed public numbers we have on how AI changes hands-on security work.

What changes for analyst training?

Three things follow.

First, analysts need practice with AI tools as part of the job, not as a side topic. If top teams solve problems with agents, a training programme that forbids them trains for a workplace that no longer exists. Platforms are moving this way: Immersive Labs announced an AI In-Lab Assistant and AI Lab Builder 2.0 in January 2026.

Second, the fundamentals still need testing without help. The talent-pipeline warning is the important part of the March report. If juniors never do the mid-level work by hand, they may not recognise when an AI tool is wrong. A lab programme can do both: some paths with AI assistance allowed, some assessed without it.

Third, speed expectations rise. When median solve times halve in two years, an analyst who takes a day over a task that peers finish in hours stands out. Training should measure time as well as completion.

Does this change which training type to buy?

Not directly. AI changes how individuals work, which is the lab level, and how teams work, which is the range level. It does not remove the need to exercise decisions at the organisational level; if anything, faster technical work makes the slow part of an incident more likely to be the decision, not the investigation.

What it does change is the questions to ask a lab or range vendor:

• Can learners use AI assistants inside labs, and can a manager turn that off for assessed work?
• Does reporting show time to complete, not only completion?
• Is there content on attacking and defending AI systems themselves?

Where does Hack The Box fit?

Hack The Box is a technical training platform first, with Academy modules, Professional Labs and capture-the-flag content, and it publishes a business price: $2,500 per seat per year on its Professional plan. On 21 September 2026 it also announced HTB PRO, an individual plan at $49 a month or $490 a year that lists SOC Range access from Q4 2026. Its benchmarks come from its own competitions, so read them as the vendor's data, but they are unusually specific.

What should a training lead do this quarter?

Pick one lab path and run it twice with a small group: once with AI assistance allowed and once without, and compare completion time and accuracy. The difference will tell you more about your team than any benchmark. Then decide which paths should allow assistance and which should not, and write that into the programme.

The hands-on labs guide covers what lab libraries train and which platforms publish a free tier or price.