Most people collect a certification or two. Karol Wróblewski, also known as AnimSparrow, decided to collect all of them, then write a detailed review of each one, "because apparently I don't have enough hobbies."
By October 2026 he was the first person to hold every TryHackMe certification. Along the way he failed an exam, sat another on a treadmill, and took a mid-exam break to do an escape room with friends. Here's how it went, and what he wishes someone had told him on day one.
Chapter one: the accidental double pass
Karol isn't new to cyber. He moved across from an identity and access management team around four years ago and now works as an architect, manager and mentor. Blue team is his home.
Still, his first TryHackMe certification, SEC1, was also the first hands-on exam he'd ever sat, and it changed how he thought about certifications. No "which menu option does X" questions, just real tasks on real machines. He passed it in March 2026. Then he passed it again a week later, by accident: he clicked "retake" just to read the conditions, the timer started, and rather than risk it, he sat down and did the whole thing again.
That first exam also told him something he didn't expect. He walked in sure he'd lean blue and walked out knowing web pentesting was his strongest lane. Which is exactly why he tells beginners to start with SEC0 and SEC1:
"SEC0 won't impress a recruiter, and that's fine. It's not a trophy, it's a starting line. It tells you whether you actually enjoy this stuff. SEC1 is where it gets real: your first taste of red and blue. Pick a side before you pick a career."
Chapter two: the nemesis
Karol won a PT1 voucher in a Valentine's competition, which he describes as "a soft way to walk into a brawl."
He prepared properly. He worked through the path, practised on CTFs with friends, and felt ready. The first attempt lasted 20 hours straight with no sleep, and the web section took him apart. He failed, but left with something useful: a map of exactly what the exam wanted.
The second attempt went better. The network fell fast, Active Directory followed, and then he hit the web app, a banking application full of logic bugs, and stalled for hours. At one point he stepped away and told his wife he needed just one more flag. He went back, it clicked, and he scraped through. In his words, he hadn't been that happy since his wedding day.
The section that beat him up became his favourite kind of work. And his advice to anyone tempted by the red side still makes us laugh:
"Real pentesting is ninety percent reading, poking every login form and every forgotten port, and ten percent jumping out of your chair yelling 'I got a shell!' at 2 a.m. Your neighbours will love you."
Chapter three: 14 kilometres of AI security
Karol earned his AI1 voucher at our AI Odyssey live CTF, where his team finished sixth. By exam day the material felt familiar, so he added his own difficulty setting: he sat the entire exam walking on a treadmill at 4 km/h. By the time he hit submit, he'd covered 14 km.
What surprised him was the breadth. Alongside jailbreaking live chatbots, AI1 asks you to model threats, spot tampered model artefacts, defend against data poisoning and write risk assessments a non-technical stakeholder could act on. He already held five AI fundamentals certifications from other vendors, and this was the one that made him do the work.
"AI security changes faster than almost anything else in this field, and the only way to keep up is hands-on. Reading about it won't cut it."
Chapter four: the rematch
After PT1, Karol said web was his hardest and most rewarding ground. WEB1 proved it again.
The exam splits one web engagement into blackbox, whitebox and greybox. He cleared the first two in about an hour and felt unstoppable. Then came greybox, worth 60% of the marks, and the rest of the 48-hour window. This time he did the sensible thing: he slept, and halfway through he went to an outdoor escape room with friends to reset his head. It worked. He came back, broke open something odd he'd spotted in the first few minutes, and turned it into a full compromise of the target.
His takeaway: build rest into the window on purpose. "PT1 and WEB1 are where you stop watching hacking and start doing it."
Chapter five: home turf
Back on the blue side, Karol walked into SAL1 quietly confident and came out with a near-perfect result. The two SOC simulations, one tuned and one deliberately chaotic, were "the closest an exam has come, for me, to sitting a real shift."
Then came his favourite. SAL2 is twelve investigations across three shifts, with SLA timers and severity prioritisation built in, and almost every scenario hides something that looks like a signal but isn't. Karol sat down, started it, and didn't get up until it was done.
"My heart is blue team, so my top pick is SAL2. It's a long, messy, multi-stage investigation, exactly like a bad day in a real SOC. Nobody hands you the answer. You dig it out of the logs. Want your first analyst job? SAL1 is the door. SAL2 is the promotion."
The final boss
"When that starts feeling comfortable, PT2 is there to fix it."
PT2 drops you outside one company's network with no credentials. One side is modern web, AI, container and cloud infrastructure, the other a full Active Directory forest, and the hosts chain into each other, so you're compromising an organisation rather than solving puzzles. Karol treated every foothold as a new vantage point rather than a trophy, captured ten of eleven flags and closed the exam with 40 hours to spare.
That made him the first person to hold every TryHackMe certification.
What he'd tell you now
"These certs are for career changers, for analysts levelling up, and for anyone tired of exams you memorise on Monday and forget by Friday. Here you can't fake it. It tests what you can do, not what you memorised."
And one last piece of advice, which we'd happily put on a poster: "Don't chase the badge. The cert is the cherry. The learning is the cake. Go eat some cake."
Read Karol's full reviews on GitHub, then find the certification that fits where you are.
