15 Cybersecurity Projects for Beginners to Build a Job-Ready Portfolio

Objective

Create an isolated virtual environment where you can safely practise Windows security, Linux, networking, log analysis and incident investigation.

Suggested components

• One Windows Server virtual machine
• One Windows client virtual machine
• One Linux virtual machine
• A supported virtualisation platform
• An isolated virtual network
• Optional SIEM or log-management platform
• Sysmon for enhanced Windows telemetry

Activities

1. Create a private virtual network.
2. Install Windows Server and a Windows client.
3. Install a Linux virtual machine.
4. Configure IP addressing and DNS.
5. Generate normal login and network activity.
6. Install Sysmon on the Windows endpoint.
7. Forward security logs to a SIEM.
8. Create a basic security-events dashboard.

Portfolio evidence

• Lab architecture diagram
• Virtual-machine inventory
• Network configuration
• Log-source list
• Screenshots of collected events
• Security-controls summary

Explore CybersecurityTRAIN practical labs if you need guided exercises alongside your home environment.

Objective

Analyse a simulated or safely obtained phishing email and determine whether it is malicious.

What to examine

• Sender and reply-to addresses
• Display-name mismatch
• Return path
• Email headers
• SPF, DKIM and DMARC results
• URLs and domain reputation
• Attachment names and file hashes
• Urgency, impersonation and social-engineering indicators

Investigation process

1. Preserve the original email safely.
2. Review the sender and reply-to information.
3. Examine the email headers.
4. Extract URLs without opening them directly.
5. Analyse domains and hashes using approved tools.
6. Identify the likely phishing technique.
7. Map relevant behaviour to MITRE ATT&CK.
8. Write a verdict and recommended response.

Deliverable

Create a phishing-investigation report containing:

• Executive summary
• Indicators of compromise
• Header findings
• URL and attachment analysis
• Risk rating
• Recommended containment
• User-awareness advice

Use the phishing email investigation guide as your project reference.

Objective

Generate and investigate Windows events related to authentication, accounts, privileges and suspicious processes.

Activities

1. Enable appropriate Windows audit policies.
2. Generate successful and failed logins.
3. Create, disable and re-enable a test account.
4. Add a test user to a security group.
5. Run PowerShell and administrative commands.
6. Review the resulting events.
7. Build an activity timeline.
8. Explain which events would require investigation.

Read Windows Event IDs Every SOC Analyst Should Know before starting.

Objective

Create a small Windows domain and demonstrate identity administration, Group Policy and security monitoring.

Activities

1. Install Active Directory Domain Services.
2. Create a test forest and domain.
3. Build OUs for users, computers and administrators.
4. Create test users and security groups.
5. Join a Windows client to the domain.
6. Create password and account-lockout policies.
7. Apply a basic security GPO.
8. Generate domain-authentication events.
9. Monitor account and group changes.
10. Document security-hardening recommendations.

Suggested business scenario

Create fictional departments such as:

• Finance
• Human Resources
• SOC
• IT Administration

Give each group access only to the resources required for its role. Then demonstrate how an incorrect group assignment could create excessive access.

Portfolio evidence

• Active Directory architecture
• OU design
• Group-membership matrix
• GPO screenshots
• Authentication-event analysis
• Hardening checklist

Objective

Collect security events and build detections for suspicious activity.

Possible detections

• Multiple failed logins followed by a successful login
• One source attempting to access several accounts
• A user added to a privileged group
• PowerShell using encoded commands
• Security logs being cleared
• A new administrative account being created
• Unusual logins outside expected hours

Detection-development process

1. Define the behaviour you want to detect.
2. Identify the required log source.
3. Locate the relevant fields and Event IDs.
4. Write the detection query.
5. Generate safe test activity.
6. Validate the detection.
7. Identify possible false positives.
8. Document the analyst’s investigation steps.

Learn the fundamentals through the SIEM tools guide and Microsoft Sentinel tutorial for beginners .

Objective

Scan an isolated lab system, validate selected findings and create a professional vulnerability report.

Activities

1. Define the authorised scope.
2. Identify lab assets.
3. Perform basic service discovery.
4. Run a vulnerability scanner.
5. Review and validate findings.
6. Remove obvious false positives.
7. Assign severity based on context.
8. Recommend remediation.
9. Retest after applying fixes.

Deliverable

• Scope and methodology
• Asset inventory
• Executive summary
• Technical findings
• Evidence and severity
• Business impact
• Remediation
• Retest status

Objective

Learn how common web vulnerabilities appear and how they should be documented. Use only intentionally vulnerable training applications such as OWASP Juice Shop .

Areas to study

• Broken access control
• Authentication weaknesses
• Input validation
• Injection
• Security misconfiguration
• Sensitive-data exposure
• Session management
• Insecure design

Activities

1. Install the vulnerable application locally.
2. Record the authorised testing scope.
3. Identify one or two beginner-level vulnerabilities.
4. Capture safe, sanitised evidence.
5. Explain the root cause.
6. Describe the likely business impact.
7. Recommend secure development controls.

Produce a sanitised penetration-testing report. Avoid publishing harmful payloads or instructions that could be readily misused against real systems.

Objective

Capture and analyse network traffic generated inside your own lab.

Activities

1. Capture DNS queries and responses.
2. Observe a TCP handshake.
3. Compare encrypted and unencrypted protocols.
4. Apply Wireshark display filters.
5. Identify source and destination systems.
6. Review normal protocol behaviour.
7. Investigate a simulated suspicious connection.
8. Build a short network timeline.

Concepts to demonstrate

• IP addresses and ports
• TCP flags
• DNS requests
• HTTP headers
• TLS sessions
• Repeated connection attempts
• Unusual outbound destinations

Deliverable

Create a network-analysis report explaining:

• What happened
• Which systems communicated
• Which protocols were used
• Whether the activity was expected
• Which additional logs would be required

Objective

Research a publicly documented threat and convert the information into actionable security intelligence.

Choose one topic

• A ransomware group
• A phishing campaign
• An information-stealing malware family
• A cloud-focused threat
• An identity-based attack campaign

Report structure

1. Threat overview
2. Targeted industries
3. Initial-access methods
4. Attacker behaviour
5. Indicators of compromise
6. MITRE ATT&CK mapping
7. Detection opportunities
8. Mitigation recommendations
9. Source assessment
10. Intelligence limitations

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. Use the MITRE ATT&CK Enterprise Matrix to map behaviours accurately.

You can also review our MITRE ATT&CK beginner guide .

Objective

Create a practical playbook explaining how a security team should respond to suspected ransomware.

Preparation

• Define roles and escalation paths
• Identify critical assets
• Validate backups
• Establish communication channels
• Prepare evidence-collection procedures

Identification

• Confirm the nature of the alert
• Identify affected users and devices
• Determine the apparent initial access
• Look for encryption and data exfiltration

Containment

• Isolate affected systems
• Disable compromised accounts
• Block malicious indicators
• Preserve evidence
• Prevent further lateral movement

Eradication and recovery

• Remove persistence
• Reset affected credentials
• Patch exploited weaknesses
• Restore from validated backups
• Monitor for recurrence

Deliverable

Develop a five-to-eight-page playbook containing a decision flow, roles, escalation matrix, containment checklist and lessons-learned process.

Objective

Analyse a small test cloud environment and identify excessive identity permissions.

Areas to review

• Human users and service accounts
• Administrative roles
• Inactive identities
• Access keys
• Multifactor authentication
• Role assignments
• Publicly exposed resources
• Logging configuration
• Separation of duties

Activities

1. Build a small test cloud environment.
2. Create different test roles.
3. Assign controlled permissions.
4. Intentionally create one excessive permission.
5. Identify and explain the risk.
6. Replace it with a least-privilege role.
7. Document the before-and-after access.

If cloud security is your preferred career path, follow the Cloud Security Career Roadmap .

Objective

Identify, evaluate and treat cybersecurity risks for a fictional small business.

Example environment

Assume a 50-person organisation uses:

• Microsoft 365
• Cloud file storage
• Employee laptops
• Remote access
• A customer web application
• Third-party payroll software

Possible risks

• Phishing and ransomware
• Weak access controls
• Data leakage
• Unpatched systems
• Third-party compromise
• Lost laptops
• Inadequate backups
• Excessive administrative access
• Unauthorised AI usage

Risk-register fields

• Risk ID and affected asset
• Threat and vulnerability
• Existing controls
• Likelihood and impact
• Inherent risk
• Recommended treatment
• Risk owner and target date
• Residual risk

Use the Cybersecurity Risk Register guide for the project structure.

Objective

Assess a fictional organisation’s information-security practices against selected ISO 27001 requirements.

Suggested assessment areas

• Information-security policies
• Asset management
• Access control
• Supplier security
• Incident management
• Business continuity
• Risk assessment
• Security awareness
• Logging and monitoring
• Corrective actions

Deliverables

• Scope statement
• Interview questionnaire
• Evidence-request list
• Gap-assessment workbook
• Findings summary
• Corrective-action plan
• Management presentation

This project is valuable for learners following the GRC Career Roadmap .

Objective

Use Python or PowerShell to automate a simple defensive security task.

Possible project ideas

• Count failed logins by username
• Identify repeated source IP addresses
• Extract indicators from a log file
• Flag logins outside approved hours
• Detect changes to a monitored directory
• Compare file hashes
• Convert raw events into a summary report

Example logic

1. Read a sanitised authentication log.
2. Count failed logins by account and source.
3. Apply a configurable threshold.
4. Produce a CSV report.
5. Explain why flagged activity may require investigation.

Portfolio evidence

• Sanitised source code
• Sample input
• Sample output
• README instructions
• Detection logic
• Known limitations
• Improvement roadmap

Objective

Assess the security and governance risks of an AI agent that can access corporate applications and take limited actions.

Example scenario

A fictional company wants to deploy an AI agent that can:

• Read internal documents
• Summarise emails
• Create service tickets
• Search customer records
• Generate reports
• Take actions through connected tools

Risks to assess

• Excessive agent permissions
• Prompt injection
• Sensitive-data disclosure
• Unapproved actions
• Weak user verification
• Insecure integrations
• Insufficient logging
• Third-party data retention
• Lack of human approval
• Agent identity confusion
• Inadequate incident response

Recommended controls

• Least-privilege access to tools and data
• Data classification and handling rules
• Human approval for sensitive actions
• Input and output filtering
• Strong identity and authentication controls
• Complete activity logging
• Secure secrets management
• Testing before production
• Emergency disablement capability
• Periodic access review

Deliverable

• AI agent data-flow diagram
• Asset and information inventory
• Threat scenarios
• AI risk register
• Control recommendations
• Human-oversight matrix
• Incident-response process

Connect this project with the article on Shadow AI risks and controls .