Skunkworks Academy • Practical Cybersecurity

Build a Cybersecurity and Cloud Home Lab in 2026

A complete beginner-to-professional blueprint for building a secure, segmented and portfolio-ready lab using Windows, Linux, Kali Linux, Wazuh, Security Onion, REMnux, FLARE-VM, Azure and Microsoft Sentinel.

Beginner to professional Cybersecurity + cloud Hands-on projects Portfolio focused

Affiliate disclosure: This article contains selected affiliate links. Skunkworks Academy may earn a commission when you purchase through these links, at no additional cost to you. We recommend products according to their relevance to the lab architecture and learning outcomes described below.

Windows Security alert displayed on a laptop used for cybersecurity testing — Endpoint security alerts provide useful telemetry for investigation and detection-engineering labs. Photo by Ed Hardie on Unsplash.

Cybersecurity is not mastered by watching demonstrations alone. Operational capability develops when you configure systems, generate telemetry, investigate abnormal activity, correct mistakes and rebuild the environment until you understand what occurred.

A cybersecurity and cloud home lab provides a controlled environment for practising the work performed by security operations centre analysts, cloud administrators, incident responders, penetration testers, malware analysts, identity engineers and DevSecOps professionals.

The objective is not to install the largest number of tools. The objective is to create a repeatable environment in which you can complete defined technical tasks and produce credible evidence of your competence.

1. What a cybersecurity home lab should achieve

A useful lab should allow you to complete a complete technical cycle:

Build

Deploy and configure

Install operating systems, configure networks, create identities, deploy services and apply security controls.

Observe

Generate and collect telemetry

Collect endpoint, identity, application, firewall, network and cloud logs in a central analysis platform.

Prove

Investigate and document

Analyse evidence, explain what happened, recommend corrective action and publish a sanitised portfolio project.

For every substantial exercise, produce:

An architecture diagram
A statement of objectives and assumptions
A build or deployment procedure
Configuration files, scripts or infrastructure templates
Relevant screenshots and sanitised logs
Detection queries or security rules
An incident timeline or findings table
A remediation plan
A lessons-learned section

This approach aligns with the task-, knowledge- and skill-oriented structure of the NIST NICE Workforce Framework for Cybersecurity.

2. Choose a career track before installing tools

Installing every security platform at once creates complexity without learning depth. Select one initial career track and deploy the smallest viable environment that supports it.

Track 1

SOC analyst and threat hunting

Windows Server and Windows 11
Active Directory Domain Services
Sysmon and PowerShell logging
Wazuh or Microsoft Sentinel
Windows Event Forwarding
MITRE ATT&CK mapping

Track 2

Ethical hacking and application security

Kali Linux and Nmap
Burp Suite
OWASP Juice Shop
OWASP WebGoat
Linux and Windows targets
Professional vulnerability reporting

Track 3

Malware analysis and digital forensics

REMnux
FLARE-VM
Disposable Windows analysis systems
Packet capture
Static and dynamic analysis
Memory and file-system forensics

Track 4

Cloud security

Microsoft Azure
Microsoft Entra ID
Azure Monitor
Microsoft Sentinel
Microsoft Defender for Cloud
Azure Arc and RBAC

Track 5

Linux, cloud-native and DevSecOps

Use Ubuntu or Red Hat Enterprise Linux together with Git, GitHub, Docker, Kubernetes, Ansible, OpenShift, CI/CD pipelines, dependency scanning, secret scanning, container-image scanning and infrastructure as code.

3. Four design principles for a safe lab

Isolation

Separate the lab from household, office and production systems. Use host-only networks, virtual networks, VLANs or a dedicated lab router. Malware-analysis and deliberately vulnerable systems must not be casually bridged onto your normal LAN.

Repeatability

Take clean snapshots before installing major software, changing security controls, simulating attack techniques or analysing suspicious files. A failed exercise should be recoverable in minutes.

Observability

Collect authentication events, process execution, PowerShell activity, DNS requests, network connections, firewall events, application logs, file-integrity changes, cloud audit events and identity sign-ins.

Evidence

Preserve scripts, queries, detection rules, sanitised logs, diagrams, configuration exports and findings. A screenshot should support the analysis, not replace it.

4. Hardware tiers

You do not need a server rack to begin. You do need enough memory and solid-state storage to run several systems reliably.

Server cabinets connected with fibre and network cables in a computing lab — Dedicated lab hardware becomes valuable when you need persistent services, additional memory and isolated network segments. Photo by Fabio Sasso on Unsplash.

Tier 1: Starter lab

Component	Recommended baseline	Suitable for
Processor	Four physical cores or better	Linux fundamentals, Kali Linux, basic Windows and web-security labs
Memory	16 GB RAM	Two or three lightweight VMs at a time
Storage	500 GB SSD	Operating systems, snapshots and small datasets
Backup	External USB drive	VM exports, reports and configuration backups

Tier 2: Intermediate lab

Component	Recommended baseline	Suitable for
Processor	Six to eight physical cores	Active Directory, Wazuh and multiple endpoints
Memory	32 GB RAM	Best general-purpose learner configuration
Storage	1 TB NVMe SSD	Windows, Linux, SIEM storage and snapshots
Networking	Gigabit Ethernet plus optional USB adapter	Separate management and target networks

Tier 3: Professional lab

Component	Recommended baseline	Suitable for
Processor	12–16 cores or more	Distributed security platforms and larger simulation environments
Memory	64–128 GB RAM	Security Onion, several Windows servers and Kubernetes
Storage	1–2 TB NVMe plus separate 2–4 TB telemetry storage	Packet capture, SIEM data and long-running labs
Networking	Multiple NICs, managed switch and dedicated firewall	VLAN segmentation and network-monitoring exercises
Power	UPS	Protects persistent lab services and storage

Buying priority: upgrade RAM and SSD capacity before purchasing specialised networking hardware. Memory pressure is usually the first constraint in a multi-VM home lab.

Budget mini PC

Useful as a dedicated x86 hypervisor or companion to an ARM-based laptop.

View recommended mini PC

Memory upgrade

A 32 GB or 64 GB memory upgrade typically delivers the greatest immediate improvement.

View compatible RAM

NVMe storage

Fast storage improves boot times, snapshot operations and SIEM indexing.

View NVMe SSD options

5. Choose a hypervisor

VirtualBox

Suitable for beginners, cross-platform use and prebuilt Kali, REMnux or Wazuh appliances.

Hyper-V

Suitable for Windows Professional or Enterprise users, PowerShell automation and Microsoft infrastructure training.

VMware Workstation or Fusion

Suitable for mature snapshot workflows, advanced desktop networking and professional VM management.

Proxmox VE

Suitable for a dedicated server, browser-based management, VLAN experimentation and persistent multi-VM environments.

ARM architecture warning: Apple Silicon and other ARM systems can run ARM-compatible Kali images, but some specialist appliances and tools remain x86/AMD64-specific. The current REMnux virtual appliance, for example, requires x86/AMD64.

6. Recommended network architecture

Ethernet cables connected to a managed router and network switch — A managed switch or dedicated lab router supports practical segmentation, routing and monitoring exercises. Photo by Albert Stoynov on Unsplash.

                              Internet
                                  |
                        [Home or Office Router]
                                  |
                         [Lab Firewall/Router]
                                  |
                    [VLAN-Capable Managed Switch]
                                  |
          +-----------------------+-----------------------+
          |                       |                       |
     VLAN 10                  VLAN 20                VLAN 30
    Management                Monitoring              Targets
          |                       |                       |
     Hypervisor             Wazuh / SIEM          Windows Server
     Admin PC              Security Onion          Windows Endpoint
     Backups                Log Collectors          Linux Servers
                                                  Vulnerable Apps

          +-----------------------+-----------------------+
          |                                               |
      VLAN 40                                          VLAN 50
      Attacker                                      Malware Analysis
          |                                               |
     Kali Linux                                   REMnux / FLARE-VM
     Test Clients                                No direct LAN access

Management network

Hypervisor administration, firewall management, backup systems and a trusted administrator workstation.

Monitoring network

Wazuh, Security Onion, SIEM systems, log collectors and packet-capture interfaces.

Target network

Windows Server, Windows endpoints, Linux servers, Active Directory and vulnerable applications.

Attacker network

Kali Linux and approved testing systems with controlled access to designated targets.

Malware-analysis network

REMnux, FLARE-VM, disposable Windows analysis VMs and fake internet services. Disable shared folders, shared clipboard and drag-and-drop when working with suspicious files.

7. Core virtual machines

Virtual machine	Purpose	vCPU	RAM	Storage
Kali Linux	Security testing	2–4	4–8 GB	60–100 GB
Windows 11	Endpoint monitoring	2–4	6–8 GB	80–120 GB
Windows Server	AD DS, DNS and services	2–4	6–10 GB	80–120 GB
Ubuntu Server	Linux administration and services	2	2–4 GB	40–80 GB
REMnux	Malware analysis	2–4	6–8 GB	80–120 GB
FLARE-VM	Windows reverse engineering	4	8–16 GB	100–150 GB
Wazuh	SIEM/XDR lab	4	8–16 GB	100–200 GB
Security Onion	Network security monitoring	4+	24–32 GB+	200 GB+
OWASP Juice Shop	Web-security target	1–2	2–4 GB	20–40 GB
Docker host	Containers and DevSecOps	2–4	4–8 GB	60–100 GB

8. Phase 1: Build the foundation

Secure the host computer

Enable full-disk encryption, automatic updates, MFA, a password manager, tested backups, the host firewall and Secure Boot where supported.

Enable hardware virtualisation

In BIOS or UEFI, enable Intel VT-x, Intel Virtualization Technology, AMD-V or SVM Mode.

Create separate virtual networks

Create at least LAB-MGMT, LAB-TARGET, LAB-ATTACK, LAB-MONITOR and LAB-MALWARE.

Apply a naming convention

Use predictable names such as LAB-DC01, LAB-WIN11-01, LAB-KALI01, LAB-WAZUH01 and LAB-REMNUX01.

Create a clean baseline snapshot

After patching, naming and assigning network settings, create a snapshot called 00-CLEAN-BASELINE.

9. Phase 2: Build an identity and endpoint lab

Deploy:

One Windows Server domain controller
One Windows 11 workstation
One administrator workstation or jump box
One Linux member server
Organisational units, standard users, administrator accounts and security groups

Create fictional departments such as Finance, Human Resources, Sales, IT Operations and Security Operations. Then implement:

Password and account-lockout policies
Windows Firewall policy
PowerShell logging
Advanced audit policy
Microsoft Defender settings
Restricted local-administrator membership
Windows Event Forwarding
Sysmon telemetry

Send Sysmon and Windows events to Wazuh or Microsoft Sentinel. This environment supports detection exercises involving suspicious PowerShell, failed sign-ins, group membership changes, scheduled tasks, new services, remote administration and persistence.

10. Phase 3: Add a SIEM

Option A

Wazuh

Choose Wazuh for endpoint agents, file-integrity monitoring, configuration assessment, log analysis and a lower-resource self-hosted entry point.

Option B

Security Onion

Choose Security Onion for packet capture, intrusion-detection data, network-security monitoring and deeper network investigations.

Option C

Microsoft Sentinel

Choose Sentinel for Azure-native analytics, Kusto Query Language, cloud and hybrid log collection, incident investigation, workbooks and security automation.

11. Phase 4: Build the cloud lab

Cloud computing architecture illustrated with connected computing nodes and servers — A cloud lab extends local virtualisation into identity, monitoring, policy, cost governance and hybrid management. Image by Growtika on Unsplash.

A basic Azure security lab should include:

A dedicated resource group
A virtual network and two subnets
Network security groups
A small Windows or Linux VM
A Log Analytics workspace
Microsoft Sentinel
Azure Monitor
Azure Key Vault
Managed identities
Microsoft Defender for Cloud
Resource tags and cost budgets

Important 2026 change: Microsoft Learn’s previous Azure sandbox environments are no longer available. Learners now require access to an Azure subscription, such as a free trial or pay-as-you-go account, for many practical exercises.

Cloud cost controls

Create a dedicated lab resource group.
Configure a small monthly budget.
Add alerts at 50%, 80% and 100%.
Use low-cost VM sizes.
Stop and deallocate VMs after each exercise.
Delete unused disks, public IP addresses and snapshots.
Tag resources with Environment=Lab.
Record expected hourly cost before deployment.
Review costs daily during active projects.
Delete the resource group when the project is complete.

Identity and hybrid controls

Apply least privilege. Do not use Global Administrator or subscription Owner for routine lab tasks. Where appropriate, connect selected on-premises lab machines to Azure through Azure Arc. Do not connect malware-analysis systems or deliberately compromised machines to your production tenant.

12. Phase 5: Add web-application security

Deploy OWASP Juice Shop or WebGoat inside the target network and practise:

Application mapping
Authentication and session testing
Input validation
Access-control testing
Injection and cross-site scripting
Security-header analysis
API testing
Remediation verification

Professional practice: do not stop after identifying a vulnerability. Document the title, severity, affected component, preconditions, reproduction procedure, evidence, impact, remediation and retest result.

13. Phase 6: Build a malware-analysis environment

Safety boundary: use only legally obtained, instructor-provided or purpose-built training samples. Never execute suspicious software on your normal computer.

FLARE-VM <---- Host-only network ----> REMnux
    |                                      |
 No bridged access                   Simulated services
 No shared folders                  Packet capture
 No real credentials                DNS/HTTP inspection

Before analysis

Disable shared clipboard, shared folders and drag-and-drop.
Remove all real credentials and cloud-sync clients.
Take a clean snapshot.
Verify network isolation.
Start packet capture.
Record file hashes and sample provenance.

During analysis

Observe process creation, child processes, file creation, registry changes, services, scheduled tasks, network connections, DNS requests, persistence and system changes.

After analysis

Export sanitised evidence.
Record indicators of compromise.
Map behaviour to MITRE ATT&CK.
Write detection recommendations.
Revert the VM.
Verify that other networks and the host were unaffected.

14. Twelve portfolio projects

Project 1

Build an Active Directory domain

Deliver an architecture diagram, OU design, DNS configuration, Group Policy report, administrative model and backup procedure.

Project 2

Harden a Windows endpoint

Implement Defender, firewall policy, auditing, Sysmon and restricted administrator access. Produce a before-and-after report.

Project 3

Centralise Windows and Linux logs

Send Sysmon, Windows, Linux, web-server and firewall logs to Wazuh or Sentinel.

Project 4

Detect password spraying

Create an approved simulation, detection query, alert rule, investigation timeline and containment plan.

Project 5

Investigate a phishing email

Analyse headers, sender infrastructure, authentication results, links, attachments and indicators.

Project 6

Detect suspicious PowerShell

Generate approved activity, collect telemetry, create a query, analyse false positives and recommend controls.

Project 7

Assess OWASP Juice Shop

Produce a scoped assessment with methodology, evidence, remediation and retest results.

Project 8

Investigate a network intrusion

Use Security Onion or packet capture to investigate scanning, suspicious DNS and unusual outbound traffic.

Project 9

Analyse a safe malware sample

Record hashes, static findings, dynamic behaviour, network indicators and detection recommendations.

Project 10

Secure an Azure environment

Apply least privilege, NSGs, Defender for Cloud, logging, budgets, Key Vault and secure administration.

Project 11

Build a Sentinel workbook

Visualise failed sign-ins, privileged activity, endpoint alerts, incidents and data-ingestion volume.

Project 12

Build a DevSecOps pipeline

Add secret scanning, dependency scanning, static analysis, container scanning, validation and approval gates.

Recommended repository structure

cybersecurity-home-lab/
├── README.md
├── architecture/
│   ├── logical-diagram.png
│   ├── network-diagram.png
│   └── data-flow-diagram.png
├── build/
│   ├── prerequisites.md
│   ├── installation.md
│   └── configuration.md
├── detections/
│   ├── wazuh-rules/
│   ├── sentinel-kql/
│   └── sigma/
├── evidence/
│   ├── screenshots/
│   ├── sanitised-logs/
│   └── packet-captures/
├── reports/
│   ├── findings-report.md
│   ├── incident-report.md
│   └── lessons-learned.md
├── scripts/
│   ├── powershell/
│   ├── bash/
│   └── terraform/
└── references/
    └── sources.md

Never publish passwords, access tokens, API keys, personal information, real client data or live malware.

15. A 12-week implementation roadmap

Period	Focus	Key outcomes
Weeks 1–2	Infrastructure	Secure host, hypervisor, networks, Kali, Windows, Ubuntu, snapshots and documentation
Weeks 3–4	Identity	Windows Server, Active Directory, users, groups, Group Policy and auditing
Weeks 5–6	Monitoring	Wazuh, agents, Sysmon, Linux logs, searches and alerts
Weeks 7–8	Detection and response	Approved simulations, alert investigations, ATT&CK mapping and incident reports
Weeks 9–10	Application and network security	Juice Shop assessment, packet capture, findings and remediation verification
Weeks 11–12	Cloud integration	Azure, budgets, Sentinel, logging, least privilege and a final hybrid project

16. Common mistakes

Installing too many tools

A collection of unused VMs is not a learning environment. Build one use case at a time.

Ignoring isolation

Do not connect intentionally vulnerable or potentially compromised systems directly to your normal network.

Skipping snapshots

Without snapshots, each failed experiment becomes an unnecessary rebuild.

Treating alerts as answers

An alert begins an investigation. Validate evidence, affected assets, sequence and impact.

Publishing sensitive evidence

Sanitise logs, screenshots, configuration files and cloud identifiers before publishing.

Forgetting cloud resources

Stopped services can still generate charges through disks, IPs, snapshots or data ingestion.

17. Move from beginner to professional

Automate

Replace manual builds with PowerShell, Bash, Ansible, Terraform, Bicep and cloud-init.

Engineer detections

Develop KQL queries, Wazuh rules, Sigma rules, Sysmon configurations and ATT&CK coverage maps.

Add governance

Introduce naming standards, change records, access reviews, data classification, backup tests and risk registers.

Communicate

Produce reports for analysts, administrators, security managers, executives, auditors and clients.

Recommended career pathways

Career objective	Suggested focus
SOC analyst	Windows security, Sysmon, SIEM, Sentinel and incident response
Cloud administrator	Azure administration, Entra ID, networking and governance
Cloud security analyst	Defender for Cloud, Sentinel, Azure Monitor and identity
Ethical hacker	Linux, networking, web security and vulnerability assessment
Malware analyst	Windows internals, REMnux, FLARE-VM and reverse engineering
DevSecOps engineer	Git, CI/CD, containers, Kubernetes and security automation
Linux administrator	Linux administration, networking, automation and Red Hat
Security engineer	Identity, endpoints, logging, cloud security and zero trust

Build practical capability

Start your cybersecurity and cloud pathway

Combine guided theory, practical laboratories, certification preparation, portfolio development and role-based skills assessments through Skunkworks Academy.

Explore cybersecurity training Explore Microsoft training Explore Linux and Red Hat Request a skills assessment

Conclusion

A cybersecurity and cloud home lab does not need to begin with expensive hardware. Start with one secure host, one hypervisor, one Kali Linux VM, one Windows VM, one Linux server, one isolated target, one monitoring platform and one clearly defined project.

Add Active Directory, Wazuh, Security Onion, REMnux, FLARE-VM, Microsoft Sentinel and Azure as your capability expands.

The most important output is not the lab itself. It is what the lab allows you to prove: that you can build systems, collect evidence, investigate activity, correct mistakes, automate recovery and communicate the result.

References and technical documentation

Replace all {{PLACEHOLDER}} links before publishing. Keep external reference links as documentation sources, and use rel="sponsored" on affiliate links.