Blue Team Labs Online (BTLO)
A gamified defender practice platform covering incident response, digital forensics, security operations, reverse engineering and threat hunting, with a usable free tier.
Type: Free & low-costStudentsCareer changersWorking practitioners
Offered by Centri
The facts
- Cost
- Free tier gives access to challenges as downloadable artefacts. PRO is £15 per month, £40.50 for three months, £76.50 for six months or £144 per year.Figure read 2026-09-12 from blueteamlabs.online
- Prerequisites
- None.
- Format
- Browser-delivered and downloadable challenges and investigations across five defensive disciplines.
- Length
- Self-paced and open-ended.
- Renewal
- No renewal or recertification requirement is published for this entry.
- Accreditation
- No accreditation is claimed for this entry, and none should be inferred.
- Who it suits
- Anyone who needs hands-on practice cheaply, including people studying for a paid certification elsewhere.
- Audience
- Students · Career changers · Working practitioners
- Official page
- blueteamlabs.online
Strengths
- One of the cheapest ways to get genuine hands-on reps on forensic artefacts — £15 a month against $8,780 for a SANS course.
- The free tier is usable rather than a teaser: challenges are available as downloadable artefacts.
- Covers forensics alongside IR, threat hunting and reverse engineering, so you can find out what you actually like.
Limitations
- No credential. It builds skill; it does not produce anything to put on a CV beyond platform rankings.
- The graded, scored investigation environment sits behind the paid tier — the free tier is the artefacts, not the assessment.
- Gamified scoring rewards reaching the answer, which is not the same discipline as documenting a method someone else could reproduce.
- Priced in pounds sterling, so the cost to a US buyer moves with the exchange rate and any card conversion fee.
Sources
Costs, prerequisites and exam formats in this field change often, and several providers price by region, cohort or employer agreement. Every figure on this page carries the date it was read and a link to the page it was read from. Confirm current terms with the provider before you spend anything.