5 Free Tools for Your Cybersecurity Portfolio

One of the main things holding back new professionals in cybersecurity is the idea that you need expensive tools or full access to live environments to build a portfolio. This is in part true, but you can do something about it.

Some of the best projects in my journey came from free tools that anyone can use to create, resolve, and explore different scenarios that resemble real issues. For my capstone project, I didn’t have expensive hardware or a lab budget exceeding zero dollars. I had VirtualBox, a few Linux and Windows ISOs, and a very clear plan. Before I knew it, I had created what would resemble a demo setup for a small company running on my gaming computer. It comprised a domain controller, an Apache server, a firewall, and a few 'client' devices. The machines were configured to communicate via routes I designed, providing me with the perfect space to complete my risk management project.

If you’re trying to build a portfolio that shows employers you’re serious and able to learn independently, these free tools will be great contributors to your portfolio. Each of these gives you the opportunity to create real work that showcases your skills.

VirtualBox + Free Windows & Linux VMs

VirtualBox is one of the best ways to build a home lab from scratch without spending any money. Once you install it, you can download free Linux distributions (Ubuntu, Kali, Debian, Rocky, etc.) and free Windows Evaluation VMs from Microsoft. You can use these to create a full environment that mimics a small company. It’s a great way to learn Active Directory, Group Policy, patching, server roles, firewalls, and lots more.

In my case, I built a virtual environment with nine VMs for my risk management capstone. I had a domain controller, a pfSense firewall, an Apache web server, and multiple client machines. I ran vulnerability scans against them, documented the findings, created a risk register, implemented controls, and documented my entire process. You can easily create a similar environment and document it as a portfolio project. The key here is to show the steps you took, the problems you encountered, how you solved them, and the reasoning behind your solutions.

Some things you can explore in your VirtualBox lab include Active Directory group policies, firewall configurations, simulated phishing attempts, log analysis with Windows Event Viewer, Linux permissions practice, patching workflows, and SOC alerts, if you can find the right monitoring tools. A simple, well-documented home lab goes a long way in your portfolio.

Splunk Free Tier

Your portfolio becomes much stronger when you can demonstrate that you understand logs and interpret system behavior; it's not just system configuration that matters in cybersecurity. Splunk’s free tier lets you ingest your own logs, run SPL queries, create dashboards, and practice alert investigation. If you send logs from your VirtualBox VMs into Splunk, you can build small case studies for failed login analysis, PowerShell abuse detection, or firewall event correlation.

Splunk also gives you space to learn how searches work and how analysts should think. For example, searching for 4625 events (failed logins) or connecting process creation with network activity is something you can simulate in your own lab. When you show this kind of work in your portfolio and talk about it in interviews, employers will understand that you can actually investigate.

A great addition to your exercises is to create a short report describing how you ingested the logs, which events you focused on, and the insights you discovered. Even a one-page log investigation report can make your portfolio stand out.

Okta Integrator Free Plan

Identity & Access Management (IAM) is one of the hottest areas in cybersecurity right now. Okta’s free developer tenant gives you a fully functional environment to experiment with authentication flows, MFA, group policies, SSO, and OAuth. Your IAM practice and learning are not limited to a live enterprise environment; you can also strategically build a complete identity workflow using Okta's free developer tenant.

You can also create a small environment where you register a demo application, configure OAuth, enable MFA, and test login flows. Once you've completed your practice, be sure to document the entire process in your portfolio to show your understanding of identity systems.

This practice will prepare you for job interviews for cloud, IAM, GRC, and SOC roles because identity is one of the most targeted areas in security.

Jamf Now & Jamf Trials

Jamf offers a Jamf Now free tier that supports up to three Apple devices, which comes in handy if you want to showcase MDM skills. If you’ve ever wondered how IT teams deploy policies to Macs, this tool will be a helpful guide to you. You can practice device enrollment, experiment with restrictions, and explore profiles. Even if you don’t have Apple devices, Jamf provides documentation that helps you understand the structure.

After your practice, you can confidently say "I’ve configured an MDM profile, created a device group, tested ADE, and enforced security baselines.” MDM skills are still highly desirable in cybersecurity.

Azure, GCP & AWS Free Tiers

Cloud skills will always separate you from other candidates, and luckily, each cloud provider offers a generous free tier. Azure offers free Entra ID configurations, access to the Microsoft Developer sandbox, 1 year of free VM credits, and identity and role-based access control features to explore. GCP offers access to a micro VM, Cloud Logging, IAM, and Cloud Shell. AWS gives you EC2 micro instances, S3 buckets, IAM policies, CloudWatch logs, and Lambda functions in a free tier with some limitations.

You can use these environments to deploy a small app, configure firewall rules, test IAM, secure storage buckets, set up simple monitoring, or practice incident response. Something as small as “Securing a cloud VM and documenting the configuration” becomes a great portfolio piece. Showing that you know how cloud identity, firewall configs (NSGs or VPC rules), logging, and VM hardening work proves you’re thinking like a security practitioner.

A great practice is to build a small cloud project, integrate security tools, and document your actions, share your reasoning, and thought process as a security practitioner.

ServiceNow Developer Instance (Free)

ServiceNow is one of the most widely used ITSM platforms in cybersecurity, yet very few entry-level applicants ever touch it. This experience is valuable because almost every SOC, GRC team, and IT department uses ServiceNow in some capacity.

In your portfolio, you can show workflow diagrams, describe mock incidents you processed, or demonstrate how tickets move through their lifecycle. Even if you don’t want to be an ITSM specialist, understanding ServiceNow on this level makes you instantly more prepared for live environments.

Final Thoughts

You don’t need a large budget to start building your cybersecurity portfolio. You can simulate your own environment with VirtualBox, investigate logs with Splunk, experiment with identity using Okta, secure cloud resources in Azure or GCP, enroll devices with Jamf, and practice ticketing workflows in ServiceNow, all for free or at a very low cost.

Don’t let money or lack of access hold you back. Start with what you have, build what you can, and document everything.