TryHackMe

Name: TryHackMe
Brand: TryHackMe

TryHackMe is an online, cloud-based, cyber security training platform used by individuals and academics alike.

Est 2018|28 Ref Customers

LinkedIn 808K|Web traffic 6.6M|FTEs 1,002|HQ London, England, GB

MarketsLearning Management System (LMS)

Published Oct 14, 2026

01Common complaints

- Organizations requiring advanced operational realism for blue-team work - Consider specialized SOC simulation platforms (for example, LetsDefend) if priority is on alert triage realism and day-to-day SOC workflows. - Organizations seeking primarily advanced, open-ended offensive challenge platforms - Hack The Box and similar platforms are frequently preferred by learners who have moved beyond guided content. - Organizations with strict procurement and compliance documentation needs - If public, audit-ready evidence of SOC 2, ISO certificate scope, penetration test summaries, and data residency specifics is mandatory, TryHackMe’s publicly available materials (as reviewed here) may be insufficient without direct vendor engagement. - Organizations that rely on an extensive free tier for ongoing training - Community discussions indicate the free tier has been reduced as more rooms moved behind paid tiers, which may affect long-term free-tier suitability. - Current limitations acknowledged by the vendor - Business and Education pricing requires contact with sales and is not fully self-service. - Certification pricing is handled separately from subscription pricing (for example, WEB1 exam pricing per help-center documentation). - Roadmap / content changes - The vendor has retired certain learning paths in the past, which may affect curriculum stability for long-term programs. - Scale limitations - Not publicly documented in the sources reviewed. - Security or compliance gaps (publicly evidenced) - The vendor states ISO27001 compliance on marketing pages, but detailed certification evidence (certificate numbers, accredited bodies, scope) was not located in accessible sources. - SOC 2 reports, penetration test summaries, and data residency details were not publicly documented in the sources reviewed. - API limitations / integration constraints - API and integration documentation beyond SSO was not clearly documented in the sources accessed.

Deal disqualifiers: what makes a poor fit

Organizations that require publicly documented SOC 2 or detailed ISO certification evidence and will not accept NDA-only disclosures.
Organizations that need explicit data residency guarantees and detailed public security architecture documentation.
Teams seeking primarily advanced, open-ended CTF challenges with minimal instruction.

Why some customers left for competitors (churn reasons)

Price/value comparisons versus Hack The Box and other platforms.
Perceived reduction in free-tier value as premium gating increased.
Friction in exam or lab experiences (performance, environment switching).

02Why they buy

- Observed in customer feedback (independent of vendor claims) - Structured learning paths that many users find helpful for reducing initial overwhelm when starting cybersecurity training. - Browser-based labs that reduce the requirement for local environment setup, which can lower the barrier to entry. - Differentiation from competitors (based on reviews and positioning) - More guided and beginner-focused compared with many CTF-first platforms. - A single platform offering content across both offensive and defensive topics. - Areas where competitors clearly have advantages - Hack The Box commonly provides deeper, less-guided challenge depth for advanced practitioners. - PentesterLab offers specialized depth in web security and vulnerability analysis. - LetsDefend and similar platforms typically offer more realistic SOC workflow simulations.

Why customers chose TryHackMe over alternatives (as reflected in reviews)

Guided learning paths and beginner-focused structure compared with more hands-off CTF platforms.
Browser-based labs that reduce the need for local environment setup.
Variety of content across offensive and defensive topics.

03Field reports

Review platforms (G2, Trustpilot)

- G2 - G2 lists TryHackMe reviews and notes some reviews are sourced via G2 invites; a few reviewers reported being offered a nominal incentive. This context is relevant when assessing potential positivity bias. - Common positive themes on G2 include hands-on labs, structured learning paths, and content breadth across offensive and defensive topics. - Common criticisms include UI/UX friction, inconsistent difficulty across labs, and limitations of some simulations compared with real-world operations. - Trustpilot - Trustpilot shows generally favorable ratings at a high level, with individual reviews noting learning value alongside occasional frustration with question phrasing or clarity.

Community/social (Reddit)

- Representative positive themes - Some community members describe TryHackMe as appropriate for beginners and note the structured learning paths can be less overwhelming than unstructured resources. - Several users describe it as a useful on-ramp for skills development rather than a guarantee of employment. - Representative critical themes - Subscription value concerns - Some users describe annual membership as poor value or report they will not renew. - Paid-tier expansion concerns - Users have reported that more rooms have become Premium content over time, which reduces free-tier value. - Exam and product experience issues - A community review of a certification exam (PT1) described frustration with environment switching and exam execution. - Community and promotional conduct - One user alleged they were encouraged to post positively on social platforms; this is anecdotal and not independently verified.

HackerNews discussions

A search of HackerNews did not surface a clear, high-signal discussion thread in the accessible results used for this report.

Specific outcomes customers achieved (with metrics when available)

Public, independently verified ROI metrics were not found in the accessible sources.
Community anecdotes link consistent use to individual learning progress and career transitions, but these are not controlled studies and should be treated as anecdotal evidence.

Case Studies

- Vendor-published case studies - The vendor publishes a case study PDF featuring Google. - Critical view - Case studies are vendor-provided marketing materials and often lack third-party verification of outcomes and methodological detail sufficient to audit ROI claims. - Vendor claims about organizational adoption - The vendor lists recognizable logos (for example Google, KPMG) and states that many organisations use the platform for upskilling. - Critical view - Logo inclusion and case studies do not necessarily indicate broad, enterprise-wide production deployment; such references may represent a team pilot, partnership, or limited-scope training engagement.

04Best fit

Company sizes

Individuals and teams ranging from small IT/security groups to mid-market organisations conducting skills development.
For enterprise procurement, suitability depends on whether TryHackMe can provide private compliance documentation (for example, SOC 2 reports or ISO certificate scope) under NDA.

Industries and verticals

Technology, professional services, education, and organisations building internal cyber capability.

Roles and personas

Decision makers
- Security leaders (SOC managers, AppSec leads, security program managers)
- Learning & Development and training managers for technical workforces
- Academic instructors in cybersecurity programs
End users
- Aspiring SOC analysts, junior penetration testers, IT professionals cross-training into security, and students

Pain points and challenges the product addresses

Need for practical, hands-on practice without building local labs.
Need for structured progression for learners who require stepwise guidance.
Scalable assignment and progress tracking for education and business contexts.

Qualification criteria: what makes a strong fit

Ideal users seek a guided curriculum with browser-based labs.
Organizations that value game-like elements and structured learning paths for learner engagement.
Teams that want broad exposure across offensive and defensive fundamentals rather than a single niche focus.

05The pitch

What the product does (core value proposition in objective terms)

- TryHackMe is a browser-based, hands-on cybersecurity training platform offering interactive labs, rooms, challenges, and structured learning paths that cover offensive and defensive topics. - The vendor describes the platform as incorporating game-like elements and emphasizing hands-on practice, with intentionally vulnerable environments and network simulations to allow learners to practice practical skills in a controlled environment rather than only reading theory. - Vendor-stated scale and adoption claims describe a large catalog of training labs, millions of registered users, and numerous organisations using the platform for workforce upskilling; these figures are vendor statements and have not been independently verified in this report.

Target market and market positioning

- Individuals - Beginners through experienced learners seeking guided, hands-on training. - Learners preparing for entry-level roles or building practical familiarity with tools and workflows. - Education - Instructors assigning pre-built labs and tracking progress via a teaching dashboard (as described in vendor materials). - Business - Teams (including SOC/security teams) using TryHackMe to upskill and practice in a controlled environment.

Get a comprehensive analysis of TryHackMe including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →