Build a SOC analyst training plan

Three questions, one plan. The planner picks from the certifications and platforms in our dataset, totals only prices we could verify, and flags the rest. Nothing you choose is stored or sent anywhere — the plan is built in your browser.

How the planner decides

These are editorial rules, not predictions about hiring. They are written down so you can disagree with them.

1. Fundamentals first for newcomers. If you are new to IT, step one is TryHackMe Premium (cheapest, hands-on) when your budget is minimal or your goal is practical proof; otherwise the Google Cybersecurity Certificate (a structured course series).
2. The first credential follows your goal. Recognised credential: ISC2 CC on a minimal budget, otherwise CompTIA Security+. Practical proof: TryHackMe SAL1, BTL1 or CCDL1 as budget rises. Microsoft or Splunk shops: SC-200 or the Splunk Cybersecurity Defense Analyst exam.
3. People already in security move up a level: CySA+, or GCIH where an employer pays.
4. A "later" step is suggested but excluded from the total.

Assumptions behind the estimates

• TryHackMe Premium for 3 months at the monthly price; Google certificate for 4 months (Google says many learners take 3–6); CyberDefenders labs for 2 months.
• Only USD prices marked verified are added. Non-USD prices (BTL1 is listed in GBP) are not converted, and unverified or conflicting prices are listed separately.
• Taxes, retakes beyond what is included, study books and hardware are not included.