Training type · LABS

Hands-on cybersecurity labs: what lab libraries train and who sells them

Short answer

Hands-on labs are short, guided technical tasks one person completes in a browser, drawn from a library of hundreds or thousands. They are the cheapest and most flexible way to build individual skill, and the type with the most free tiers. They do not test whether a team, or its leaders, can run an incident together.

By The Range Desk · Cyber Range Compare · Published 2026-10-11 · Updated 2026-10-13

Desk research from public vendor, standards and regulator pages read on 27 September, 11 October and 13 October 2026. Profiles follow our published method; we did not run the products.

What does it train?

One skill at a time, at the keyboard: reading logs, analysing a phishing email, investigating an endpoint, writing a detection, exploiting and fixing a web application flaw. Good libraries cover defensive and offensive topics, cloud, application security and newer areas such as AI, and let a manager assign paths by role. Because each lab is short, people can fit them into a working week.

Who should take part?

Individual analysts, engineers, developers and new joiners, and anyone moving into a security role. Labs also suit people preparing for certifications. Some platforms extend labs to non-technical employees; Immersive Labs lists non-technical staff among its lab audiences.

What does a session look like?

Minutes to an hour per lab, done alone, at a time the learner chooses. A manager assigns paths or leaves people to pick. Platforms add progress tracking, certificates and, in some cases, AI help inside the lab. Larger libraries list hundreds or thousands of labs: TryHackMe lists 800+, Cyberbit 2,800+ solo labs.

What should it leave behind?

Completion records by person and skill, and on some platforms certificates or accredited programmes. Cyberbit states that four RangeForce certificate programmes were accredited by ANAB in July 2026. What labs do not leave behind is evidence that the team can respond together; completion rates measure effort, not readiness.

Which platforms sell it?

From each platform's own pages, read 27 September or 11 October 2026. Alphabetical order.
Platform	Status	What their pages describe	Source
Reflex Security	Not in our sources	Not described on the pages we read.	None
BreachRx	Not in our sources	Not described on the pages we read.	None
Cloud Range	Sold	1,500+ hands-on labs and team exercises (Cloud Range gives one combined figure).	Source: Cloud Range homepage · Read 11 Oct 2026
Conducttr	Not in our sources	Not described on the pages we read.	None
Cyberbit	Sold	2,800+ solo labs on the same platform.	Source: Cyberbit homepage · Read 27 Sep 2026
Cytactic	Not in our sources	Not described on the pages we read.	None
Hack The Box	Sold	Academy modules, Professional Labs, machines and capture-the-flag content for business teams.	Source: Hack The Box for business · Read 27 Sep 2026
iluminr	Not in our sources	Not described on the pages we read.	None
Immersive Labs	Sold	Browser-based labs across AI, application security, cloud, OT and offensive security, with an AI Lab Builder.	Source: Immersive Labs: labs · Read 27 Sep 2026
KnowBe4	Not in our sources	Not described on the pages we read.	None
SimSpace	Not in our sources	Not described on the pages we read.	None
TryHackMe	Sold	800+ labs, with a Custom Content Studio for business teams.	Source: TryHackMe for business · Read 27 Sep 2026

5 of 12 platforms sell it; 0 sell it with a condition; 7 are not in our sources.

When is it the wrong choice?

When the problem is coordination or decisions. A team of individually skilled analysts can still lose hours in an incident because nobody owns the escalation or the handover. Labs are also the wrong tool for executives and for the wider workforce's phishing habits, which awareness training covers.

What does it cost, and what do platforms publish?

This is the most transparent type on price. Free tiers and trials exist, and at least one business price is public.

Cloud RangeNot published
Not published on the homepage; the route in is a demo request.
Source: Cloud Range homepage · Read 11 Oct 2026
CyberbitNot published
Not published. The cyberbit.com/pricing address returned a 404 when we read it.
Source: cyberbit.com/pricing (returned 404) · Read 27 Sep 2026
Hack The Box
Professional: $250 per seat per month or $2,500 per seat per year. Lite, Base and Ultimate are not priced publicly; Lite lists a 14-day free trial. Crisis Control: price not published.
Source: Hack The Box business pricing · Read 27 Sep 2026
Immersive LabsNot published
Not published.
Source: Immersive Labs homepage · Read 27 Sep 2026
TryHackMe
Business: Foundation $99 per month and Advanced $199 per month; Enterprise on request. Whether these prices are per user, and the billing period, were not confirmed in our read, so check before budgeting. A free individual tier and paid individual plans are also published.
Source: TryHackMe business pricing · Read 11 Oct 2026

Questions people ask

Are free cybersecurity labs good enough for a business?

They are good enough to start and to test whether people will use a platform. Business plans add assignment, reporting and admin controls. TryHackMe has a free individual tier and Hack The Box lists a free start on HTB Academy and a 14-day trial on its Lite business plan.

How many labs does a platform need?

Enough to cover the roles you train for at more than beginner level. Library size is a weak signal on its own; check whether the paths match your stack and whether you can build your own content.

Do labs prepare analysts for real incidents?

They build the individual skills an incident needs. They do not rehearse the incident itself, with its pressure, handovers and incomplete information. That is what ranges and crisis exercises are for.