SOCSimulator is a Security Operations Center training platform where you practice alert triage, incident investigation, and threat analysis using realistic SIEM, XDR, and Firewall interfaces. Built for career-switchers, security teams, students, and bootcamps, it provides hands-on experience with production-modeled security tools and MITRE ATT&CK-mapped scenarios drawn from the current threat landscape. No prior security experience required, and there is a free tier.
Investigate real intrusions inside production-style SIEM, XDR, and Firewall consoles, working from the same live data a SOC sees. Built for cybersecurity learners, security teams, and classrooms.
Everything here is built on the actual, current threat landscape: real attack patterns, real indicators of compromise, and real techniques.
Investigate a breach targeting exposed edge security appliances. An attacker exploits Ivanti Connect Secure CVE-2025-22457 to obtain unauthenticated code execution, spawns a shell from the gateway web process, retrieves a Linux payload, and attempts to preserve access using edge-device service abuse patterns similar to FortiGate SSL-VPN post-exploitation tradecraft. Trace the intrusion across SIEM, XDR, and firewall telemetry.
70+operations
Weeklyreleases
Every operation rebuilds a real breach from its telemetry, so what you investigate is what actually happened.
Free. Pro unlocks the full catalog.
Edge Device Exploitation: VPN Zero-Day
PreviewInvestigationA glimpse of one console. Inside: eight tasks tracing the attacker from the Ivanti gateway exploit to a 4.5 GB exfiltration, across SIEM, XDR, and firewall telemetry.
Start with guided walkthroughs, or challenge yourself with investigations.
Browse all operationsEvery decision is graded, mapped to the MITRE ATT&CK techniques you worked, and scored on how cleanly you separate real threats from false alarms. Progress you can watch grow, and prove.
Eight competency dimensions. Speed, accuracy, cross-tool correlation, methodology, and more, each scored 0 to 100.
Full MITRE ATT&CK coverage. Every operation maps to ATT&CK, so your coverage fills across all 12 tactics, Initial Access to Impact.
Decision accuracy, graded like a real SOC. True positives caught, false alarms avoided, scored per verdict. A detection score, not a quiz score.
Free to start, upgrade when ready. Pro for individual training. Enterprise and Educational for teams. Full comparison on the pricing page.
30-day money-back guarantee. Cancel anytime.
See the full comparisonWhat aspiring SOC analysts ask before they start training.
Yes, genuinely free, not a trial. You get real beginner walkthroughs, three tool consoles, and progress tracking. Pro adds Shift Mode and unlimited rooms when you're ready.
Ready to start? Create your free account
Measurable SOC training on the current threat landscape. Free to start.
The same hands-on operations that get individuals hired also help companies sharpen their analysts and let educators run a real SOC lab, with zero infrastructure to set up.
For business
Give your team realistic reps on the attacks they actually face, and turn training into evidence: verifiable skill progression and framework coverage you can put in front of auditors.
For education
Bring hands-on, job-relevant training to your university, bootcamp, or course. Assign operations, follow progress in a teaching dashboard, and review real investigations, with no lab to build or maintain.
