Blue Team challenges on TryHackMe are getting a schedule and a story
Starting 31 July, a new Blue Team challenge lands on TryHackMe every two weeks. Same cadence, every time, across all six defensive disciplines. You'll always know when the next case is coming.
And they're built differently to anything we've released before.
The problem with most Blue Team challenges
You get handed a PCAP or a disk image, you answer some questions, you move on. That's fine for learning a tool, but it's nothing like the job. Real defensive work happens inside an organisation, on a case that matters to someone, with a team around you and a client waiting on your findings. The context is what makes the skills stick.
So instead of releasing standalone exercises, we built a firm.
Welcome to THM Security Services
THM Security Services (TSS) is TryHackMe's fictional cyber defence firm, and every challenge in the series is one of its cases. When a client suspects a breach or finds something they can't explain, the case comes to TSS and you're the analyst assigned to it.
Each room starts in the TSS Operations Hub, where you'll read the situation report, get a brief from your lead analyst, and understand what the client actually needs to know before you touch any evidence. Did data leave the network? How did they get in? What did they do while they were inside? Your findings feed into the wider engagement, alongside the rest of the team working other threads of the same investigation.
Every closed case joins the TSS archive in the Operations Hub, so if you join late, you can always go back and work the ones you missed.
Six disciplines, one series
Cases rotate across the full breadth of Blue Team work:
- Digital Forensics
- Incident Response
- Threat Hunting
- Malware Analysis
- Detection Engineering
- Threat Intelligence
Whether you're working toward your first SOC role or sharpening skills you already use on shift, the series is designed to meet you where you are — difficulty varies case by case, and some investigations connect directly into our professional-tier content for those who want to go deeper.
The case schedule
The series launches at the end of July and releases a new case every two weeks from there. Here is what is confirmed so far:
- 31 July 2026: Silent Transfer (Premium)
- 7 August 2026: DetectMare (Premium)
- 21 August 2026: The Vantara Leak (Premium)
- 4 September 2026: Trusted by Default (Premium)
- 18 September 2026: The Clean Exit (Premium)
- And more!
More cases are in the pipeline beyond November. Every room adds to the TSS case archive, which stays visible in the Operations Hub so new players can always go back and work the cases they missed.
TSS is open. The first case drops 31 July. Are you ready to be assigned?
Join the community
Join us in Discord and jump into the #blue-team-lounge
Carah Els