Every few months somebody in your company asks where they could learn the basics of security properly, and you go looking for free cybersecurity courses. What comes back is a page of lists that all name the same handful of programs. Most of those lists were written a while ago and nobody has opened the links since. That matters, because at least one of the courses they recommend is no longer free.
We opened every page in this article during the last week of August 2026 and checked what it costs today.
Why most lists of free cybersecurity courses are out of date
For three years, the single most recommended free option was the entry-level certification from ISC2, one of the large membership bodies that certifies security professionals. The offer was real and it was generous. ISC2 gave a million people around the world free access to both the course and the exam.
That program closed to new entrants on May 20, 2026. Anyone who already holds an unused exam code can still sit the exam until the end of the year. Everybody else now pays $199.
Nothing dishonest happened here. The program reached its goal and ended, exactly as announced. The problem is that dozens of articles still recommend it as free, and an owner who follows one of them will send an employee to a checkout page. So before the three recommendations, here is the habit worth keeping: open the page and look at the price before you forward the link to anyone.
The 3 courses are free
Introduction to cyber security, from the Open University
This is the one to give somebody who knows nothing yet and is slightly embarrassed about it.
The Open University publishes a course called Introduction to cyber security: stay safe online. It runs across eight weeks and asks about twenty-four hours in total, which works out at roughly three hours a week. The level is introductory, so it assumes no background at all. It covers passwords and how accounts get broken into, what malware actually does, how networks carry information, and how identity theft works in practice.
Two details make it unusually easy to start. You can open the first week and read it without creating an account. And when you finish, both the digital badge and the statement of participation are included at no cost, which is rare.
Send this one to: everybody. It is the closest thing to a company-wide baseline that costs nothing.
CISA Learning, from the federal cybersecurity agency
The federal agency responsible for defending the country’s networks runs its own training platform, and most business owners have no idea it exists. It is called CISA Learning.
The common assumption is that it serves government staff only. It does not. The platform is explicitly open to federal, state and local government, to the private sector, to veterans, and to the general public. There is no fee. You register through a Login.gov account, which many Americans already have from filing something else.
The catalogue holds around 850 hours of material, arranged by level from complete beginner up to specialist subjects such as risk management and malware analysis. Nobody should attempt all of it. Treat it as a library rather than as a course.
Send this one to: whoever looks after your computers, whether that is an employee who fell into the role or a junior person at your IT provider. It goes deep enough to be worth their working hours.
CS50’s Introduction to Cybersecurity, from Harvard
Harvard’s introduction to cybersecurity was written, in the university’s own words, for technical and non-technical audiences alike. That is unusual and it is the reason it belongs on this list.
The course runs five weeks and asks between two and six hours a week, taken at your own pace. It covers how to protect data, devices and systems at home and at work, and it spends real time on how to judge a threat you have not seen before rather than only on the ones that exist today.
Harvard lists the course itself as free. The optional verified certificate is the paid part, and unless somebody needs the line on a resume, it can be skipped without losing any of the teaching.
Send this one to: yourself. It is the course that will change how you read your IT provider’s next email.
What free training will and will not do for your company
Free courses are worth the time. They are not a security program, and it helps to be honest about the gap.
Three people finishing an online course will not stop a fraudulent invoice from being paid, will not close an account belonging to somebody who left in March, and will not tell you whether anybody is watching your systems at night. Those outcomes come from decisions and from contracts, not from training.
What training does is change the quality of the questions your team asks. An employee who has spent eight weeks learning how accounts get broken into will hesitate over a message that looked ordinary to them last year. That hesitation is worth more than most software.
How to actually get this done
Companies rarely fail at this because the courses are hard. They fail because nobody is assigned the thirty minutes.
Put it on one afternoon this week. Choose one of the three, send the link to one group of people, and write down the date you will ask them whether they started. That is the entire task. A second link sent to a second group next month works far better than a company-wide email that nobody opens.
There is one decision worth making deliberately, and it is the one that decides whether anybody finishes. Are people doing this on your time or on their own? Three hours a week of unpaid evening study will be started by almost everyone and completed by almost nobody. An hour blocked out on a Friday afternoon, on the clock, with the course open, gets finished. If security training matters enough to send the link, it matters enough to be paid for, and saying so out loud is what tells your team you mean it.
Two other things worth doing while you are there. Check that any list you found the course on has been updated this year, and look at the price on the actual page rather than in the article describing it.
