TryHackMe is the platform most people use for their first steps in cyber security, and with around 49,500 searches a month in the US it is by far the most searched name in this batch. It works through rooms: short guided lessons with a browser-based virtual machine attached, so you can attack something within minutes of signing up. The free tier is generous and Premium costs roughly $10.50 a month when billed annually. The part I am reviewing is the AI Security path and its AI1 certification. The path has 25 lessons built around the OWASP Top 10 for LLM applications: prompt injection, insecure output handling, supply chain problems, data poisoning, excessive agency and the rest.
Every attack is paired with a defence, so you craft the injection and then build the guardrail or permission change that stops it. For developers who have to ship AI features, that pairing is more useful than pure offence. The AI1 exam uses 13 hands-on scenarios in the browser with no multiple choice. At launch it was sold for around $279 with three months of Premium included, though I would check the current price on the site because TryHackMe changes its certification bundles. My reservations are the usual ones for TryHackMe. The guided format is great for momentum and weak for independence.
You get very good at answering the question the room asks and less good at working out what to ask. The AI material also stays at the application layer, so if you want to attack models directly, Hack The Box goes further. And while TryHackMe certifications are growing, most hiring managers treat them as proof of interest rather than competence. My take: the right first step, especially for developers who want to understand how their AI features get attacked, and cheap enough that it is an easy recommendation. Just plan the next step.