Introducing TryHackMe MAX

MAX is our most powerful plan to date. It brings together the content that working practitioners have been asking for most: advanced learning paths that map to mid-career security roles, including AWS and Azure cloud security labs, a persistent AttackBox, recent threats content, and more. Built for practitioners who need to stay ahead, and for anyone who wants access to everything TryHackMe has to offer.

TryHackMe has been used by over 8 million people to learn and develop Cyber Security skills. A significant number of those people are working practitioners: SOC analysts, security engineers, penetration testers, incident responders. They came to TryHackMe to learn, and they stayed because it works.

That's why today (29 June 2026) we are launching MAX: a new plan built specifically for that audience.

What is MAX and how does it compare to Premium?

MAX sits above Premium, which continues to cover the broad range of learning paths and hands-on content that practitioners at every stage use. MAX adds the most advanced specialist paths, cloud labs, and current threat content on top.

Some of the paths currently in Premium are moving to MAX for new subscribers from 29 June 2026. If you subscribed to Premium on or before 29 June 2026, you keep access to those paths until July 2027. See the table below for the full picture.

⚠️ Web Application Red Teaming, Advanced Endpoint Investigations, Red Teaming and SOC Level 2 are moving exclusively to MAX for anyone signing up after 29 June. If you are an existing Premium subscriber, see below for how this affects your access.

⚠️ Attacking and Defending AWS & Defending Azure were previously only available on Business plans. MAX is the first time individuals can access them.

What's new in MAX

Advanced paths

The four paths at the top of a lot of practitioners' lists are now in MAX: Red Teaming, SOC Level 2, Web Application Red Teaming, and Advanced Endpoint Investigation. These are the paths that map directly to mid-career security roles: the work you are actually doing. Not the work you are preparing to do.

Cloud security paths

Until now, AWS and Azure labs on TryHackMe have only been available to organisations on Business plans. MAX changes that. AWS 101 (Attacking and Defending AWS) and Azure 101 (Azure Security) are now open to individual subscribers. The AWS 101 path will also be significantly updated, so if you have been through it before it is worth starting again.

Recent Threats

CVEs do not wait for course catalogues to catch up. Recent Threats is a continuously updated module with hands-on labs for the latest vulnerabilities. All new recent threats released from today now require MAX, with new labs added as threats emerge.

Persistent AttackBox

The Persistent AttackBox is exactly what it sounds like: a machine that stays alive between sessions. No more losing your work when a session ends. Files persist, installed tools persist, and spin-up is faster. If you spend serious time in the AttackBox, this is the feature you have been waiting for.

One thing to be clear about: if you downgrade from MAX, your AttackBox storage is permanently deleted and cannot be recovered. If you come back to MAX later, you start fresh.

⚠️ Important: Downgrading from MAX permanently deletes your AttackBox storage. This cannot be recovered. If you resubscribe to MAX later, you will start with a clean machine.

Certification discount

MAX annual plan subscribers get 40% off one TryHackMe certification per year. This applies to annual subscribers only, not monthly.

Pricing and how to upgrade

MAX is available on monthly and annual billing. If you are on an annual plan, you also get 40% off one TryHackMe certification per year. Visit the pricing page to get started.

🌍 On a legacy currency plan?

If you are currently billed in AUD, PLN, MXN, SAR, EGP, or another legacy currency, you will see a notification to contact our support team to upgrade to MAX.

What does this mean for you?

The launch of MAX involves some changes to how paths are distributed across plans, particularly for existing Premium subscribers. We have tried to make this as clear as possible. Below we cover the following scenarios, please skip to the situation that applies to you.

• Existing Premium subscribers (on or before 29 June 2026)
• New Premium subscribers after 29 June 2026
• Free TryHackMe users

The grace period applies to Premium subscribers who subscribed on or before 29 June 2026.

Note: if you cancel your Premium subscription at any point, your grace period access ends immediately and permanently, even if you resubscribe.

Existing Premium subscribers (subscribed on or before 29 June 2026)

If you are an existing Premium subscriber, you are not losing anything straight away. The four paths that are moving to MAX (SOC L2, Web Application Red Teaming, Red Teaming, and Advanced Endpoint Investigation) remain available on your Premium plan until July 30, 2027, provided your subscription stays active and uninterrupted.

⚠️ Important: If you cancel your Premium subscription, you will permanently lose access to the four paths included under the grace period. This applies even if you resubscribe to Premium later. The grace period does not reinstate once broken.

This grace period applies only if your Premium subscription was active on or before 29 June 2026.

Example, Case 1: You subscribed to Premium Annual in January 2026. You renew in January 2027. You keep the four paths until July 2027. After that, they move to MAX only.

Example, Case 2: You subscribed in January 2026, cancel or let your subscription lapse in January 2027, and resubscribe in February 2027. The grace period does not apply to the renewed subscription. The four paths will not be included in your Premium from February 2027.

⚠️ During cancellation, we will show a notice confirming you will lose access to these paths on Premium if you cancel.

New Premium users signing up after 29 June 2026

If you are creating your TryHackMe Premium account after 29 June 2026, the new plan definitions apply to you from day one.

Free TryHackMe Users

If you are on a free TryHackMe account, the four paths moving to MAX: Red Teaming, SOC Level 2, Web Application Red Teaming, and Advanced Endpoint Investigation - will no longer be accessible from 29 June.

If you want to keep going with any of those paths, MAX is the plan to be on.

FAQ

Q: Can I stay on Premium?

Yes. Premium is not going anywhere. However some paths (outlined in the table above) will be moving to MAX. Please check the section "What does this mean for you?" to find out more about when this will affect you. MAX adds the advanced practitioner content on top of Premium for those who need it.

Q: What happens to my AttackBox files if I downgrade from MAX?

Your AttackBox storage will be permanently deleted when you downgrade. This cannot be recovered. If you return to MAX later, you will start with a clean machine.

Q: I'm billed in AUD / PLN / MXN / SAR / EGP. How do I upgrade to MAX?

You will see a notification in your account prompting you to contact support. Our team will handle the upgrade for you. Please be aware that once upgraded, you will not be able to return to your previous legacy currency pricing.

Q: Will more content be added to MAX in the future?

Yes. New paths are planned throughout 2026 and 2027. See the roadmap table above.

Q: Does the 40% certification discount apply to monthly subscribers?

No. The certification discount is available to MAX annual plan subscribers only, and redeemable once per year.

Q: What happens to my grace period path access if I cancel my Premium subscription?

If you cancel, you permanently lose access to the four paths included under the grace period, even if you resubscribe to Premium afterwards. The grace period does not reinstate.

Q: When do the plan changes take effect?

For new sign-ups, the new plan definitions apply from 29 June. Existing Premium subscribers who subscribed on or before 29 June 2026 keep access to the four paths until 30 July 2027, provided their subscription stays active and uninterrupted.

Ready to level up?