Find your SOC skill gaps — from evidence.

A real grading report, stored — not run live: the founder's own home-lab projects, graded on 2026-10-16 with the earlier rubric v1.1 and published in grader/validation-v1.1.md (the D1–D7 criteria are unchanged in the current rubric v1.3). Pick a project to see its skill levels, the evidence behind each one, and the gap analysis.

Two questions per domain. Answer honestly — the honesty check at the end downgrades anything you can't evidence.

Self-assessment is a claim. Grading is the check. Paste your evidence, bring your own API key — the rubric grades it, right here in your browser. Your key never leaves this device except to the API provider you choose.

Weekly vulnerability-driven challenges: mechanics → repro → detection → remediation. Built from public CVE data; every card is original work. Tap a card for the full brief.

Worked a card? Grade your evidence with AI — the grader only credits what you can show.

New cards land weekly from the intel feed (CISA KEV first).

Every assessment is saved on this device. Re-assess over time — the curve measures trajectory. Employers buy future performance; this is the closest thing to measuring it.

Eight domains, one rubric. Tap a card for the full level definitions. L3 is never self-awarded — that's the honesty line.

Legend: LAB-READY home-lab project mapped · CORE assessed in every profile · NEW added this month · matrix L1+ = partial evidence (counts 0.5 pts) · L1+* = L2 claimed without the evidence pledge.

A real self-assessment by the project founder — 5 home-lab projects, AI-graded with rubric v1.1 on 2026-10-16 (report in grader/). Rated by the author's own rubric, not by independent reviewers — see limitations.

The journey every candidate takes — assess what you can do, build evidence that proves it, get it graded against the public rubric.

Certs like Security+ or CySA+, BTL1, and platforms like TryHackMe and Hack The Box teach and test knowledge. soc-skills answers a different question: given the work you can actually show, what are you still missing for a SOC analyst role, and where do you learn it? It grades your lab write-ups and code against a public rubric — 8 SOC skill domains mapped to the NIST NICE framework, with levels you can only earn with evidence.

• Know where you stand: a level per domain (L1 → L2), each one tied to the file or report that earned it — ready to walk through in an interview.
• Know what to build next: a gap analysis spells out what's missing for the next level, domain by domain — with links to TryHackMe, LetsDefend, CyberDefenders, MITRE ATT&CK and more.
• Show it, don't claim it: a résumé one-liner, a printable one-pager, and a hash-checked profile file (it proves the file is unchanged, not that it's true). Runs in your browser — no soc‑skills account needed.

Or start with the 16-question self-assessment — no key needed. Not a certification; not affiliated with or endorsed by NIST, NICE or any employer.

▶ Watch: 60 seconds — why evidence beats pedigree (YouTube)

Current rubric: v1.3 (2026-10-20), the version the live grader and new packages use. Read the rubric · domain definitions.

Changelog

• v1.3 · 2026-10-20 — adds D8 AI agent security & governance (8 domains). D1–D7 criteria and grading rules unchanged.
• v1.2 · 2026-10-17 — prompt-injection resistance (evidence is treated as data) + calibration anchors.
• v1.1 · 2026-10-16 — behavioral (process) scores. The stored example and sample profile were graded with this version.
• v1.0 · 2026-10-15 — first rubric and grader.

Older packages still verify; the Verify page links each package to the rubric text of the version it names.

Does this replace Security+, CySA+, BTL1, TryHackMe or Hack The Box?

No — it complements them. Certs and platforms teach and test knowledge; soc-skills is a gap analysis of the work you can show. It tells you what's missing for a SOC analyst role and links to where to learn each gap (TryHackMe SOC Level 1, LetsDefend, CyberDefenders, BTL1, CompTIA objectives, MITRE ATT&CK).

Is this a certification?

No. Grading is advisory and evidence-based. soc-skills is not affiliated with or endorsed by NIST, NICE, CompTIA, Security Blue Team, TryHackMe, Hack The Box or any employer. L3 (production) is never self-awarded.

Do I need an account or an API key?

No account, ever. The example, the self-assessment, the lab cards and the Verify page need no key. Only live AI grading needs your own key — free OpenRouter models cost $0.

Where does my data go?

Nowhere. Everything runs in your browser and history stays on this device. Your evidence and key are sent only to the API provider you choose, and only when you click Grade. Page views are counted anonymously with GoatCounter — no cookies, and nothing you type.

What do the levels mean?

L1 = guided · L1+ = beyond L1, short of L2 · L2 = independent hands-on, with scope (lab / synthetic / reconstructed) · L3 = production, never self-awarded.

What does a verification package prove?

Only that the file is unchanged since its SHA-256 hash was made, and which rubric version it claims. It is not a signature: it doesn't prove the content is true or who made it. Posting the hash in a public GitHub gist adds a dated public record. Try the Verify page.

How reliable are the scores?

Unproven so far: the rubric has only been checked on the author's own projects, with no independent human raters yet, and AI grades can vary between runs. Read the limitations — and help validate if you work in a SOC.

The profile is the surface. Underneath: graded evidence, original lab work, and a public rubric.

Found a bug, confused by a grade, or want a lab card for a CVE you care about? Write to us — a human reads every email.