KC7 Review: How These Free Cyber Detective Games Sharpen Your Threat Hunting Mindset

For anyone trying to break into cybersecurity or level up their Security Operations Center (SOC) skills, a common hurdle appears: How do you gain meaningful hands-on investigative experience without already working in a live SOC?

Reading textbooks and memorizing definitions for certifications like Security+ is useful, but reciting the definition of “phishing” or “lateral movement” is very different from investigating an incident. In the real world, analysts have to work through noisy data, form hypotheses, query logs, identify suspicious behavior, and connect seemingly unrelated events.

That is where KC7 Cyber comes in.

KC7 turns defensive cybersecurity training into story-driven investigations. Instead of sitting through another series of passive video lectures, you take on the role of a security analyst and investigate incidents using SIEM-style data and Kusto Query Language (KQL).

And this isn’t a review based on reading KC7’s website.

I’ve been using KC7 myself. As of August 2026, I have completed 5 of the 7 modules in the Security Analyst I career path under my j2rmciso profile. I also earned KC7’s Super Fan badge on August 13, 2026.

After spending that much time actually working through the investigations, KC7 has become one of the better free resources I’ve found for practicing the analytical mindset behind threat hunting.

My Hands-On Experience With KC7

I think this distinction is important when reviewing cybersecurity training.

There is a big difference between saying a platform looks useful and actually sitting down, querying the data, getting an answer wrong, adjusting your query, following an investigation, and eventually figuring out what happened.

I’ve done the latter.

At the time of this review, I’ve completed 5 of the 7 modules required for KC7’s Security Analyst I path, putting me just two modules away from completing that track.

On August 13, 2026, I also earned KC7’s Super Fan badge, which KC7 awards to players who complete three or more modules.

At the time the badge was issued, KC7 reported:

• Badge: Super Fan
• Earned: August 13, 2026
• Profile: j2rmciso
• Players who had earned it: 6,781
• Percentage of players: 4.39%

You can also see my progress on my KC7 j2rmciso profile.

So when I talk about the strengths and weaknesses of KC7 below, I’m speaking from firsthand experience actually working through the platform.

Quick Overview: What Makes KC7 Unique?

Format: Interactive, story-driven cyber investigations

Cost: Free

Best For: Beginners, IT professionals moving toward cybersecurity, aspiring SOC analysts, and defenders who want more log-analysis practice

Key Technical Skill: KQL (Kusto Query Language)

Setup Required: Essentially none. The investigations run through the browser, which removes much of the friction associated with building your own cybersecurity lab.

What separates KC7 from many training platforms is that it doesn’t simply explain what analysts do.

It asks you to investigate.

Hands-On Experience: Finding the Needle in the Haystack

This is probably my favorite part of KC7.

As I’ve progressed through the Security Analyst I modules, I’ve had to sift through increasingly noisy datasets looking for the one event, connection, account, domain, or other indicator that moves the investigation forward.

KC7 starts changing the way you approach security data.

You Start Forming Hypotheses

Instead of staring at logs waiting for something suspicious to jump out, you begin asking questions.

If the attacker sent a malicious attachment, what happened after the user interacted with it?

Which host communicated with the suspicious infrastructure?

Did another account authenticate from the same source?

That shift from simply searching logs to asking questions of the data is an important part of developing a threat-hunting mindset.

Your Queries Become More Precise

KC7 also makes it painfully obvious when your query isn’t specific enough.

Write something too broad and you can end up looking at an enormous amount of irrelevant information.

You then have to refine the query, eliminate normal activity, correlate fields, summarize results, and keep narrowing the dataset until the evidence becomes clearer.

That’s much closer to analytical problem-solving than memorizing KQL commands from a cheat sheet.

Solving the Investigation Is Actually Satisfying

There is also a gaming element that works surprisingly well.

Finding one clue leads to another. A suspicious email may lead you toward a domain, which leads to network activity, which leads to another system or user.

Eventually, the individual pieces start forming an attack story.

When you finally figure something out after struggling with the data for a while, you remember why the query worked.

That’s one reason I’ve continued working through the modules.

How the KC7 Investigation Loop Works

Unlike offensive-security labs centered around exploiting systems, KC7 focuses primarily on defensive investigation, threat hunting, log analysis, and analytical reasoning.

1. You Start With an Incident

KC7 gives you a scenario and enough information to begin investigating.

Something happened.

Your job is to determine what.

You aren’t immediately handed the answer or told exactly where to look.

2. You Query SIEM-Style Data

This is where the technical work begins.

You use KQL to interrogate different datasets and answer questions about the investigation.

A simplified query might look something like:

EmailEvents| where Subject contains "Invoice"| where SenderDomain != "company.com"| summarize count() by SenderAddress

The important part isn’t memorizing that particular query.

It’s learning the process:

Question ? Query ? Results ? Interpretation ? New Question.

That cycle repeats throughout the investigations.

3. You Build the Attack Story

As you uncover evidence, you start connecting events across the incident.

Depending on the scenario, you may investigate areas such as:

1. Initial Access — How did the attacker get in?
2. Execution — What happened after the initial compromise?
3. Command and Control — Did a compromised system communicate with suspicious infrastructure?
4. Account Activity — Which users or credentials were involved?
5. Impact — What systems, accounts, or information were ultimately affected?

That progression is one of KC7’s biggest strengths because individual log entries begin to have context.

Modules I’ve Worked Through on the Security Analyst Path

KC7 organizes investigations into career paths, including Security Analyst tracks.

My current focus is Security Analyst I, where I’ve completed 5/7 modules.

Some of the training includes areas such as:

KQL Fundamentals

The introductory material helps you become comfortable filtering, searching, summarizing, and manipulating data with KQL.

If you’ve never touched KQL before, this is particularly useful.

Investigation Scenarios

The scenarios then make you apply those skills rather than simply repeating syntax.

You may find yourself investigating suspicious emails, domains, network activity, authentication behavior, malware indicators, or other evidence depending on the case.

Threat-Intelligence Enrichment

Some investigations also push you beyond simply querying a dataset.

You have to think about indicators of compromise, enrichment, context, and whether something is actually malicious instead of assuming every suspicious-looking artifact represents an attack.

That’s an important habit.

Security analysis isn’t about finding weird things. It’s about determining whether those weird things actually matter.

Why KC7 Belongs in a Cybersecurity Learning Toolkit

After completing most of Security Analyst I, I see several areas where KC7 provides real value.

1. It Gives Beginners Something Concrete to Discuss

One of the hardest questions for someone trying to enter cybersecurity is:

“What experience do you have?”

You shouldn’t represent a training investigation as professional SOC experience.

But you absolutely can discuss how you approached an investigation.

For example:

I investigated a simulated incident using KQL, identified suspicious activity, pivoted between datasets, refined my queries, and followed the evidence to determine what occurred.

That’s considerably more meaningful than saying:

I watched a KQL course.

2. The KQL Skills Transfer

This is another major advantage.

KQL isn’t a made-up language that only exists inside the KC7 game.

It’s used throughout Microsoft’s security and data ecosystem, including Microsoft Sentinel.

Learning how to filter, summarize, correlate, and investigate data using KQL gives the training practical relevance beyond KC7 itself.

3. There Is Almost No Lab Setup

Cybersecurity labs can become projects of their own.

Virtual machines.

Networking.

Licensing.

Storage.

Configuration problems.

Broken dependencies.

KC7 removes most of that overhead.

You can open a browser and start investigating.

That makes it particularly useful when you want 20–30 minutes of actual analytical practice rather than spending that time maintaining a lab.

What KC7 Is — And What It Isn’t

I wouldn’t position KC7 as a replacement for a full cybersecurity lab.

You’re not going to learn every part of incident response, endpoint forensics, malware analysis, network engineering, or SOC operations from one platform.

And solving guided investigations isn’t identical to responding to an unpredictable production incident at 2:00 a.m.

That’s okay.

KC7 does one particular thing very well: it gives you repeated practice thinking through security investigations.

Combine it with certification study, a home lab, SIEM practice, networking fundamentals, Windows/Linux knowledge, and other hands-on training and it becomes even more valuable.

My KC7 Verdict So Far

After completing 5 of 7 Security Analyst I modules, KC7 has earned a permanent spot in my cybersecurity learning toolkit.

The biggest benefit isn’t simply learning KQL.

It’s learning to look at a pile of security data and ask:

What happened?

What evidence supports that conclusion?

What should I query next?

How does this event connect to everything else I’ve discovered?

That’s the mindset threat hunters and security analysts need.

And KC7 manages to make practicing it fun.

I’m currently two modules away from completing Security Analyst I, so I’ll update this review once I’ve completed the entire path.

For now, if you’re studying cybersecurity, trying to move from IT into security, preparing for SOC work, or simply want to sharpen your investigative thinking, KC7 is absolutely worth adding to your training rotation.

TTWTA Review: 4.6/5

????? 4.7/5

Best for: Aspiring SOC analysts, IT professionals moving into cybersecurity, students, and defenders learning KQL.

What I like most: KC7 makes you investigate rather than simply consume training.

What I’d change: I would still pair it with a broader hands-on lab environment rather than relying on KC7 as your only practical cybersecurity training.

Tested by TTWTA: Personally used by the reviewer; 5/7 Security Analyst I modules completed; Super Fan badge earned August 13, 2026.