Skip to content
Range Compare

The Range Desk · Note

Free starting points: what you can do before spending anything on training

Short answer

You can start three of the four training types without spending anything: labs through free tiers and trials, tabletop exercises through CISA's free packages, and awareness through free campaign material. A free cyber range for teams does not appear among the platforms here. Free gets you started; it rarely gets you evidence.

By The Range Desk · Cyber Range Compare · Published 2026-10-02 · Updated 2026-10-11

Desk research from public vendor, standards and regulator pages read on 27 September, 11 October and 13 October 2026. Profiles follow our published method; we did not run the products.

4 min readBuyingHands-on labsCrisis simulation

Sources: dated 11 August 2026, with vendor and pricing pages read 27 September and 11 October 2026.

Budget questions come first in most training decisions, which is why the finder on this site counts them double. Before asking for budget, though, it is worth knowing how far you can get for free. On the pages we read in September 2026, quite far for three of the four training types.

Where can labs start for free?

  • TryHackMe publishes a free individual tier alongside paid individual plans.
  • HTB Academy advertises a free start, and lists paid certifications at $490 and $1,260.
  • Hack The Box's Lite business plan lists a 14-day free trial. Its Professional plan is published at $2,500 per seat per year.

A free tier is a good way to test the one thing no demo shows: whether your people will actually use the platform. Run a short pilot with a few named analysts and protected time, and measure completions.

The limits are predictable. Free individual tiers lack the assignment, reporting and admin features a manager needs, and they do not produce evidence an auditor will accept as a team training record.

Can tabletop exercises be free?

Yes. CISA publishes over 100 free Tabletop Exercise Packages. Each includes objectives, a scenario, discussion questions and references, plus a slide deck, a feedback form and an after-action report template. The cyber scenarios include ransomware, insider threats, phishing and industrial control system compromise, with versions for different sectors.

What CISA does not provide is the facilitator, the time to tailor the scenario to your organisation, or the follow-up. Those are the real costs of a tabletop, and they are why many organisations run one a year at most. Platforms in the crisis simulation lane sell, in different ways, a reduction in that preparation and facilitation work.

KnowBe4's free Cybersecurity Awareness Month kit for October 2026, announced on 11 August 2026, also includes four tabletop exercise documents alongside its awareness material.

What about awareness training?

The same KnowBe4 kit includes posters and signage in multiple languages, training videos and modules, planning resources and webinars, organised around four weekly themes. Because October is Cybersecurity Awareness Month, this is the time of year when free awareness material is easiest to find. A free kit can run a one-month campaign; an ongoing programme with simulated phishing and reporting is a paid product.

Is there a free cyber range?

Not among the platforms on this site. None of the platforms that sell a team range, including Cloud Range and SimSpace, publishes a free tier or a price for it. Individual plans with range-like content exist: Hack The Box's HTB PRO, an individual plan announced in September 2026, lists SOC Range access from Q4 2026. That is useful for an individual's development but is not a team exercise.

Where does free stop?

Free routes share three limits:

  1. Evidence. Free tiers and templates rarely produce the records an auditor, board or regulator expects: who took part, what was found, what was fixed.
  2. Fit. Free content is generic. Scenarios built from your own environment, or ranges on your own tools, are paid features.
  3. Time. Free material shifts the cost to your own people's preparation and facilitation time.

What is the cheapest paid step?

Where prices are published, they set a floor for budgeting. Hack The Box's Professional plan lists at $2,500 per seat per year; Conducttr's smallest crisis exercise licence, Raven, lists at £11,950 a year for up to 40 participants per session; KnowBe4's awareness training lists from $1.63 to $3.75 per seat per month on a 3-year term. TryHackMe lists business plans at $99 and $199 per month, but we could not confirm whether those are per user, so check before budgeting. The other platforms on this site are quoted.

How should you run a free pilot?

Keep it small and time-boxed. Pick one training type, one group of named people and one question the pilot must answer, such as whether analysts complete a lab path in protected time, or whether the leadership team can get through a CISA scenario and agree three fixes. Write the answer down at the end. That short record will be your strongest argument when you ask for budget.

The training type finder will put free-start platforms first if you choose Start free for the budget question.

Sources