LetsDefend

What LetsDefend is

LetsDefend is a blue team training platform: it teaches defensive security by having learners investigate attacks inside a simulated Security Operations Center (SOC). The home page puts it plainly: "LetsDefend helps you build a blue team career with hands-on experience by investigating real cyber attacks inside a simulated SOC." It serves three readers at once. Individuals use it to get into SOC work or move up from there, security managers use it to train their teams, and hiring managers use it to test candidates before an offer.

The site counts 400K learners in 150+ countries and 20M labs completed. A news item on the home page, "LetsDefend Joining Hack The Box", says the company "has officially signed an agreement to be acquired by Hack The Box." The LetsDefend site still sells its own plans and runs its own sign-up.

Courses, learning paths and labs

The platform menu lists five building blocks: learning paths that "Follow the roadmap for you career", "Hands-on blue team courses", MITRE ATT&CK content ("Our content is mapped with MITRE ATT&CK Framework"), "Browser based blue team challenges", and a community. Everything runs in the browser, so learners open alerts, logs and compromised systems in the simulated SOC rather than building their own lab.

The popular courses on the home page show the range. Short courses carry a Free tag: SOC Fundamentals ("Very good start for beginners"), Phishing Email Analysis, Detecting Web Attacks, Network Fundamentals and Windows Fundamentals. Malware Analysis Fundamentals teaches learners to analyze malware at an easy level. The longer learning paths carry a Certificate tag:

• Cybersecurity for Students, a beginner path that "equips students with essential cybersecurity knowledge"
• SOC Analyst Learning Path, at medium level
• Malware Analysis Skill Path, which "teaches students to identify, analyze, and mitigate malware threats"
• Career Switch to Cybersecurity, a beginner path for people changing fields
• CompTIA CySA+ Preparation Path, to "Prepare for the CompTIA CySA+ certification with this hands-on learning path"
• Google Cybersecurity Certificate, a path "prepared for those who want to study Google Cyber Security Expert Certification"
• Incident Responder Path, at hard level
• DFIR Learning Path, covering "practical skills in digital forensics and incident response"
• SIEM Engineer Career Path, for people in cybersecurity who "want to become a SIEM Engineer"

Each item is labeled with a role (Security Analyst, Malware Analyst, Incident Responder, DFIR, SIEM Engineer) and a level from Beginner and Easy to Medium and Hard. The two preparation paths help with exams run by CompTIA and Google; the certificate LetsDefend itself issues is a certificate of completion. For learners who are not sure where to begin, a quiz points to a roadmap: "It is OK if you feel lost. We have built the perfect roadmap to help you build your SOC Analyst career."

The business page groups the content into active roles: SOC Analyst, Incident Responder and Detection Engineering, with Threat Hunter marked "Coming soon". The footer adds a blog with technical how-tos (installing Zeek or tcpdump on Linux), a Discord server, a Contribute link, a store and vouchers.

Plans and pricing

The pricing section has Individual and Team tabs and a monthly or yearly toggle. For individuals:

• Basic: $0, "Always free", described as "Start learning something new with basic access". The comparison table lists 1 user and a limited credit limit.
• VIP (Learn a Skill): $16.99/mo billed annually, with "Savings of $100 when paid annually", or $24.99/mo on monthly billing. The comparison table shows it at $25 with a "Start the trial" button, covering the Student and SOC Analyst roles with a credit limit "Limited with roles", plus individual user analytics, behavior analytics, and daily and weekly reports.
• VIP+ (Build a Career): $29.99/mo billed annually, with "Savings of $120 when paid annually", or $39.99/mo monthly. The comparison table shows it at $40, with "Everything from VIP plan" plus the Incident Responder role, and monthly and custom reports on top.

Students get 50% off. The steps are: register with a ".edu" email (or tell the company your student email if you do not have one), then "When you login with your student email, you automatically get a 50% discount." The home page also nudges visitors toward the Basic account: "Sign up for free and reach your goals."

For teams and training managers

The Team tab offers two plans, both sold through Contact Us or a demo. Enterprise Basic is described as "Upskill your team with hands-on learning" and Enterprise Plus as "Customize and accelerate skills development for your team". Both cover every role with an unlimited credit limit, and both include individual user analytics, behavior analytics, and daily, weekly, monthly and custom reports. The comparison table's feature rows for the plans include unlimited content, hands-on labs, the SOC environment, analysis labs, a certificate of completion, business support, a customer success manager, team onboarding, user management, detailed business reporting, content assignment, scalability for larger teams, skill assessment for interviews, custom learning paths and table-top exercises.

The business page sums up the offer as "realistic hands-on training in the SOC environment for your cybersecurity team to improve in Blue Team." A team "will investigate real cyber attacks in the security operations center" to practice what it learned. Managers can buy licenses directly or book a demo first.

Skill assessment for hiring

A separate product turns the labs into an interview tool. The page explains it in three steps: pick an incident and "Just put their email address on LetsDefend", wait while the candidate works the challenge, then review "a detailed report about the candidate". The challenges are real-world style incidents such as "phishing emails, ransomware attacks, malware campaigns", and the challenge can be a SIEM alert or a compromised system. The page adds: "You can track every activity that the candidate did during the investigation." It is pitched to teams that want to "Find top-level engineers with top-level interviewing" and says the tool is "Trusted by security managers".

Community and partners

Learners can join the blue team community on Discord, and the home page links real stories from users, with titles such as "From student to getting CySA+ certificate", "Becoming a SOC Analyst in a Bank" and "Upskill yourself as Cybersecurity Expert". A Global Partnership program invites resellers to bring the hands-on blue team training to their own customers, and the partner page says the platform is easy to sell "to cybersecurity teams, universities and individuals".

Who it suits and who it does not

LetsDefend suits people heading into a first SOC job: the free courses let them try the format, the student discount halves the cost, and the paths run from fundamentals to incident response, DFIR and SIEM engineering. Analysts preparing for CompTIA CySA+ or the Google certificate get a hands-on path for each. Security managers can put a team on a shared library with assignments and reporting, and hiring managers can test candidates on a realistic incident before an offer.

The focus is narrow by design. Everything centers on defense and SOC work, so someone after penetration testing or red team skills will need another platform. The Threat Hunter role is still marked as coming soon. Team pricing is quoted on request, so a manager has to talk to sales before budgeting for more than a few individual seats.