SAL1 Certification: Complete Guide for 2026
Everything about TryHackMe's Security Analyst Level 1 — exam format, preparation path, real costs, and whether it's the right next step for SOC analyst careers.
SAL1 is TryHackMe's flagship defensive certification — a hybrid exam combining multiple-choice and hands-on simulation, priced at $349 with 3 months Premium and one retake included. It maps directly to Tier 1 SOC analyst roles. Plan for 3–6 months of focused prep via the SOC Level 1 path. Worth it for serious SOC candidates, but pair with Security+ for stronger HR-filter presence.
The Security Analyst Level 1 (SAL1) certification launched in 2025 as TryHackMe's answer to a real gap in the cybersecurity certification market: most entry-level credentials test what candidates know, not whether they can actually do the job. SAL1 changes that with a hybrid exam where the majority of the score comes from a working SOC simulation rather than multiple-choice questions.
That practical emphasis matters because Tier 1 SOC analyst roles are dominated by the same misalignment everywhere: hiring managers want demonstrated skill, applicants arrive with theoretical certifications, and the gap shows up in technical interviews. SAL1 directly addresses this — passing the exam means you've actually triaged alerts, analyzed logs, and written incident reports under time pressure.
This guide covers everything about SAL1 in 2026: the exact exam structure, realistic preparation timelines, total costs (including hidden ones), how it compares to Security+ and other defensive certifications, and clear answers on whether it deserves a place in your roadmap.
SAL1 by the numbers
The essential facts before diving deeper.
How the exam works
Two sections. The hands-on portion carries the most weight.
Multiple-choice section
Tests theoretical knowledge across cyber defense fundamentals: attack types, network protocols, security tooling, incident response phases, and threat intelligence concepts.
Key topics tested
- Cyber kill chain and MITRE ATT&CK framework
- Common attack vectors and indicators of compromise
- SIEM concepts and log analysis fundamentals
- Network security and traffic analysis
- Endpoint security and EDR concepts
- Threat intelligence and OSINT
Hands-on simulation
Realistic SOC environment with active alerts, suspicious activity, and incidents to investigate. Demonstrates whether you can actually do the job, not just describe it.
Key topics tested
- Triage incoming SIEM alerts
- Analyze logs across multiple data sources
- Investigate phishing campaigns
- Document findings in incident reports
- Use detection tooling under time pressure
- Distinguish true positives from false positives
4-phase preparation roadmap
Sequential phases. Most candidates need 3–6 months total.
Complete the SOC Level 1 path
10–14 weeksTryHackMe's SOC Level 1 path is the foundation. The exam draws heavily from this content — covering cyber defense fundamentals, network security, endpoint security, SIEM, threat intelligence, and digital forensics. Expect 100–150 hours of focused study to complete properly.
Action items
- · Cyber Defense Frameworks module
- · Cyber Threat Intelligence module
- · Network Security & Traffic Analysis module
- · Endpoint Security Monitoring module
- · Security Information and Event Management (SIEM)
- · Digital Forensics & Incident Response
Reinforce with hands-on practice
3–4 weeksTheory alone won't pass the practical section. Complete additional rooms beyond the path, focusing on log analysis, alert triage, and incident investigation. Build muscle memory for SIEM workflows.
Action items
- · Splunk-focused rooms (the exam tests Splunk-style queries)
- · Phishing analysis rooms
- · Wireshark / network forensics rooms
- · Investigating Windows event logs
- · MITRE ATT&CK navigator practice
Build documentation skills
OngoingThe simulation requires writing incident reports under time pressure. Practice clear, structured documentation throughout your room work — most candidates underestimate this and lose points on the practical.
Action items
- · Write detailed walkthroughs for completed rooms
- · Practice the 'what / why / impact / next steps' incident format
- · Time yourself: aim for clear documentation in under 15 minutes per incident
Take the exam
1 daySchedule when you've completed all SOC Level 1 modules and feel comfortable with simulated investigations. The 24-hour window allows breaks — use them. Most candidates finish active exam time in 8–10 hours.
Action items
- · Schedule when fully prepared, not based on subscription expiry
- · Take strategic breaks (sleep, food, decompression)
- · Document everything as you go — saves time on final report
- · Use the retake voucher if needed; no shame in second attempts
What candidates actually report
Common patterns from SAL1 holders in 2026.
The simulation feels real
Unlike multiple-choice-only exams, the SAL1 simulation puts you in a working SOC environment with active alerts. That realism is the certification's biggest strength — and what makes it harder than the price tag suggests.
Time pressure is significant
The 24-hour window seems generous until you start working through actual incidents. Documentation alone can consume 30–50% of your time. Most candidates report feeling time pressure even with the long window.
TryHackMe Premium isn't optional
While the exam includes 3 months of Premium, you'll likely need significantly more time on the platform before attempting the exam. Plan for 6–9 months of Premium access total ($90–$135 above exam cost).
Hands-on score matters more
The 60% weighting on the simulation means strong performance there can carry weaker multiple-choice results. Conversely, dominating multiple-choice cannot save a poor simulation score. Practice the practical work hardest.
The real cost of SAL1
$349 is the sticker price. Here's what it actually costs to pass.
Compare this to OSCP ($1,749) or CEH ($1,199 + training that pushes total past $2,500). SAL1's total cost-to-recognition ratio is favorable for SOC-targeted candidates, even after the hidden costs.
Is SAL1 worth pursuing?
A direct yes/no for the most common scenarios.
Yes — if you're targeting SOC analyst roles
SAL1 maps directly to Tier 1 job descriptions and provides hands-on validation that theoretical certs lack. Pair with Security+ for HR filter coverage and you have one of the strongest entry-level SOC profiles available in 2026.
Yes — if you learn best by doing
The SOC Level 1 path is hands-on by design. Candidates who struggle with pure theory exams (Security+, ISC2 CC) often perform better with SAL1's practical format. Skill compounds faster when you're investigating real-feeling incidents.
Maybe — if you don't have Security+ yet
SAL1 alone won't pass HR filters at most large employers in 2026. If budget allows for only one certification, Security+ has broader applicability. SAL1 makes more sense as a second cert, after Security+ has cleared the HR layer.
No — if you want offensive security
SAL1 is purely defensive. If your target role is penetration testing or red team work, eJPT v2 ($249), TCM PJPT ($199), or HackTheBox CPTS ($210) are more relevant credentials. SAL1 won't help you in offensive interviews.
Frequently asked questions
Tap any question to expand.
01 What is SAL1 and what does it test?
What is SAL1 and what does it test?
02 Is SAL1 worth $349?
Is SAL1 worth $349?
03 How does SAL1 compare to CompTIA Security+?
How does SAL1 compare to CompTIA Security+?
04 How long does SAL1 take to prepare for?
How long does SAL1 take to prepare for?
05 Does SAL1 require Security+ as a prerequisite?
Does SAL1 require Security+ as a prerequisite?
06 What's the SAL1 pass rate?
What's the SAL1 pass rate?
07 What jobs can I get with SAL1?
What jobs can I get with SAL1?
08 Should I take SAL1 before or after Security+?
Should I take SAL1 before or after Security+?
The bottom line
SAL1 is one of the strongest entry-level defensive certifications available in 2026. The combination of hands-on validation, reasonable cost, and direct alignment with SOC analyst job descriptions makes it a worthwhile investment for serious candidates targeting that career path.
The two real caveats: brand recognition still trails CompTIA Security+ at the HR-filter level, so SAL1 works best as a complement rather than replacement; and the time investment (3–6 months on the SOC Level 1 path) is significant. Candidates who shortcut the preparation typically struggle on the simulation.
For the right candidate — someone targeting SOC roles, comfortable with hands-on learning, with budget for both Security+ and SAL1 — this is the strongest one-two punch available for entry-level defensive cybersecurity in 2026.
Ready for the SOC analyst path?
See the complete 6-step path from zero to your first SOC role — including how SAL1 fits in.
Read the SOC analyst guide