Lab Cost, Licensing and Hardware

Lab cost is three budgets, not one: the hardware you already own, the licences that expire while you are not looking, and the cloud resources that outlive the exercise. This page puts the ten lab profiles on one hardware envelope, compares the hypervisors that can run them, and shows where the money goes after the terminal closes.

Hardware Envelope

These are the per-lab figures from the lab profiles, not a shopping list. They describe one lab running at a time, and the hardware is shared: the Kali VM you built for the web lab is the attack host for the AD lab, and the same 80 GB disk is not multiplied by ten.

Host Overhead and the Two-VM Floor

The guest RAM figures are not the whole bill. The host OS needs 4-6 GB, the hypervisor 1-2 GB, and Windows guests grow after updates. A working rule is to sum the guest RAM and add 6 GB; if that exceeds physical RAM, the host swaps and snapshot rollbacks become unreliable. The AD lab is the honest test: 16 GB is the stated minimum, but a 16 GB laptop running DC01, WS01, Kali and a browser is at the edge, and 32 GB is the figure that makes the lab pleasant rather than painful. Malware analysis has the same shape — two guests plus the host — with the added rule that the victim never gets a second adapter.

Running two VMs plus the host is the realistic floor for the AD and malware labs. Everything else fits in one guest, in containers, or in the provider's account.

What the Table Does Not Count

• • Snapshots. A retained snapshot can approach the disk size. A 160 GB AD disk with three snapshots can consume 400 GB or more.
• • Images and updates. ISOs, OVAs and Windows updates cost 10-20 GB before the lab is useful.
• • SIEM indices. Retention is a disk decision; 200 GB fills faster than the profile suggests once agents are enrolled.
• • Evidence. BloodHound exports, pcaps and password-protected malware archives belong outside the VM disk.

Choosing a Hypervisor

Pick by host OS and guest architecture before anything else. This comparison is about running these labs, not about production virtualisation: a desktop hypervisor and a type-1 hypervisor both do the job, and the expensive choice is the one that cannot run your guest.

Windows: Hyper-V, WSL2 and VirtualBox on One Machine

On Windows the hypervisor is a host-wide switch, not a per-application setting. Enabling Hyper-V — or WSL2, Windows Sandbox, Device Guard/Credential Guard, or the Android subsystem — puts Windows itself under the Microsoft hypervisor. VirtualBox and VMware can still run, but they run on the Windows Hypervisor Platform rather than raw VT-x, which costs performance and removes nested VT-x. If you need WSL2 every day, run the lab on Hyper-V and keep VirtualBox for the guest that needs it; do not assume you can switch per VM.

# Is the Microsoft hypervisor present?
Get-ComputerInfo -Property HyperVisorPresent, HyperVRequirementVirtualizationFirmwareEnabled
bcdedit /enum "{current}" | Select-String hypervisorlaunchtype

# Which engine did VirtualBox actually use for the VM?
VBoxManage showvminfo "Kali" | Select-String "Execution engine"

Apple Silicon: Arm Guests Only

Apple silicon is Arm64, and that is the end of the x86 story. VirtualBox's manual lists only Arm64 guests on Arm64 hosts — Windows 11 Arm is supported, x86 guests are not — and Fusion on Apple silicon likewise runs Arm guests. UTM can emulate x86 through QEMU, but an AD lab built on emulated domain controllers is not a lab you will enjoy. Use an x86 laptop or a small server for the AD, malware and purple-team labs; use the Mac for the Docker labs, the cloud lab and Arm Windows work.

Windows and Other Evaluation Licences

Evaluation media is a licence with a clock. Microsoft's Evaluation Center publishes the Windows Server 2025 evaluation. The evaluation is 180 days and can be rearmed, but the rearm count depends on the edition and the installation media. Plan on one 180-day term; do not build a lab that needs more.

What Expiry Actually Does — and What You Have to Do

Expiry does not brick the VM. Windows Server enters an hourly shutdown cycle and keeps booting between shutdowns; the client SKU nags and shuts down periodically. That is the trap: the lab still looks usable, so it stays in rotation long after it stopped being licensed. An expired evaluation is out of compliance, has no support entitlement, and is a bad template to clone.

Do this before day 150: check the clock, rearm only if your edition and media allow it, and otherwise rebuild from fresh media or activate with a licence you own. Keep the build steps in version control so a rebuild is a script, not an archaeology project.

# Remaining time and licence state (elevated)
slmgr /dlv

# Rearm if this edition and media allow it; reboot afterwards
slmgr /rearm

Cloud Spend: What the Free Tiers Actually Are

The free tier is a trial with an end date, not a budget. All three providers now give new accounts a credit with a clock and then either close the account or start billing. None of them gives you a permanent allowance that covers an intentionally vulnerable scenario.

Two caveats the table does not carry. The old AWS 12-month per-service allowance is gone, so check the plan terms on your own account rather than following an older tutorial. On GCP, upgrade the billing account before the trial ends if you want to keep anything — without the upgrade, the resources are stopped and then deleted after the 30-day grace period.

Wire the Budget Alert Before the First Apply

Create the budget before the first terraform apply, not after the first bill. A budget is a notification, not a hard cap: AWS Budgets, Azure Cost Management budgets and GCP Cloud Billing budgets all send alerts at thresholds you set, and none of them stops a resource by itself. Set at least two thresholds — 50% and 80% of your comfort limit — and make the first one low enough that you can still act. AWS Budgets actions can stop or terminate instances, but that is an action you configure, not a default.

# Create the guardrail before deploying anything. Change the amount and address.
aws budgets create-budget \
  --account-id "$(aws sts get-caller-identity --query Account --output text)" \
  --budget '{"BudgetName":"lab-monthly","BudgetLimit":{"Amount":"25","Unit":"USD"},"TimeUnit":"MONTHLY","BudgetType":"COST"}' \
  --notifications-with-subscribers '[{"Notification":{"NotificationType":"ACTUAL","ComparisonOperator":"GREATER_THAN","Threshold":80,"ThresholdType":"PERCENTAGE"},"Subscribers":[{"SubscriptionType":"EMAIL","Address":"you@example.com"}]}]'

# Prove it exists before you deploy
aws budgets describe-budgets --account-id "$(aws sts get-caller-identity --query Account --output text)"

Azure and GCP do the same job under Cost Management > Budgets and Cloud Billing > Budgets & alerts. Scope the budget to the lab subscription or project, not the whole tenant, and use an address you actually read.

Destroy, Then Verify

Write the teardown command before the setup command. terraform destroy only removes what is in the state file, and it stops at the first error; cloudgoat destroy only removes the scenario you name. Then verify the account, in every region you touched, because the CLI's configured region is not the same as "all regions".

# 1. Destroy what Terraform still tracks
terraform destroy -auto-approve

# 2. CloudGoat 2.x destroys one scenario at a time; "all" clears the rest
cloudgoat destroy iam_privesc_by_rollback
cloudgoat destroy all

# 3. Verify the account for every region you touched:
#    see Lab Lifecycle -> Proof of Teardown for the commands and what clean looks like

The verification commands live in Proof of Teardown so this page keeps one list instead of two that drift apart.

Read the destroy output. A bucket with objects, an RDS instance with deletion protection, or a prevent_destroy lifecycle block will fail the destroy, and Terraform leaves the rest of the stack in place. That is a command with a non-zero exit code, not a clean teardown — check both.

What a Forgotten Lab Costs per Month

These are the resources that most often outlive the lab. Figures are AWS us-east-1 list prices on 17 October 2026, assuming a 730-hour month.

Paid Tooling Inside the Lab

Nothing in the ten labs requires a paid tool. The paid tiers buy scanning, reporting, team features or a GUI. The free tools are enough to complete the lab, and the licence question only becomes real when you use them for paid work or inside a company.

The Docker Desktop Threshold

Docker Desktop is free for personal use, education, non-commercial open source, and small businesses with fewer than 250 employees and less than $10 million in annual revenue. Above either threshold it needs a paid subscription for every user who runs it. Docker Engine on Linux is Apache 2.0 and does not carry the Desktop licence, which is why the web, CI/CD and purple-team labs can run entirely free on a Linux host.

What the Free Alternatives Actually Give You

Burp Community is not a demo: it proxies, repeats, decodes and runs extensions, but it has no scanner and throttles Intruder. ZAP is Apache 2.0 and includes an active scanner. mitmproxy is a scriptable CLI and TUI proxy that is excellent for automation. Podman is a daemonless, rootless container engine with a desktop equivalent. For the web lab, Burp Community or ZAP is enough; the paid proxy is a work tool, not a lab requirement.

Budgeting Checklist

Five things to do before you deploy anything billable. The list below is numbered for reference; if any one of the five is missing, you are not ready to run the scenario.

The cheapest lab is the one you can destroy in one command. The most expensive is the one you forgot in a second region.