Blog Post
Build these five practical cybersecurity projects to develop hands-on skills, understand real-world attacks, and stand out to employers. Start building today.
Checking sign-in status...
A GitHub repository with three documented security projects beats ten certifications with no evidence. That is the reality of cybersecurity hiring in 2026. Hiring managers want to see a Sigma rule you wrote, a screenshot of an alert it fired, and a two-line disposition of what you would escalate.
The projects below are sequenced from easiest to hardest. Each one produces an artefact you can show: a report, a tool, a detection rule, or a write-up. Start with Project 1. Do not skip ahead.
Related: CISSP Certification Study Guide ↗
| Order | Project | Core Skill | Time | Difficulty |
|---|---|---|---|---|
| 1 | Python Vulnerability Scanner | Coding and networking | 10-15 hrs | Beginner |
| 2 | Phishing Email Analysis | Investigation and reporting | 8-12 hrs | Beginner |
| 3 | Threat Hunting with MITRE ATT&CK | Analytical thinking | 10-15 hrs | Intermediate |
| 4 | Cloud Honeypot | Cloud deployment | 6-10 hrs | Intermediate |
| 5 | Mini SOC Lab | SIEM and detection | 20-30 hrs | Advanced |
Each project builds on the skills from the previous one. The Python scanner teaches you how ports and services work. Phishing analysis teaches investigation. Threat hunting teaches hypothesis testing. The honeypot teaches cloud basics. The SOC lab combines everything.
Goal: Write a tool that scans a local target for open ports, service versions, and web misconfigurations.
Tools: Python 3.11+, standard library only (socket, ipaddress, http.client, ssl).
Time: 10 to 15 hours.
What you build: A command-line scanner that checks 23 common TCP ports, grabs service banners, checks HTTP security headers (HSTS, CSP, X-Frame-Options), and generates a formatted report. It only scans localhost or authorized local targets to prevent misuse.
Why this project matters: Writing a scanner teaches you how ports expose services and why misconfiguration is dangerous. It also shows you can build tools, not just run them.
Starting point: Search GitHub for "Python port scanner beginner" and study the simplest repositories first. Extend one by adding checks for new ports, integrating a vulnerability database, or building a simple web interface.
Related: Cybersecurity Specialist Roadmap ↗
Goal: Investigate a real phishing sample and document the incident response steps.
Tools: VirusTotal, AbuseIPDB, URLScan.io, MXToolbox, a text editor.
Time: 8 to 12 hours.
What you build: Take a phishing email from a public dataset. Extract the sender IP, analyze the URL, check file hashes against VirusTotal, and map the attack to MITRE ATT&CK techniques. Write an incident report with findings, indicators of compromise (IOCs), and a recommended response.
Why this project matters: Phishing is the most common initial access vector. SOC analysts triage phishing alerts daily. A written report with IOCs proves you can investigate, not just identify.
Starting point: Use the TryHackMe "Phishing Emails in Action" room or download a sample from the PhishTank API. Study completed investigations on GitHub as templates.
Goal: Hunt for a specific threat technique in a dataset and document your findings.
Tools: TryHackMe, KC7, MITRE ATT&CK Navigator, Sigma.
Time: 10 to 15 hours.
What you build: Choose one MITRE ATT&CK technique, such as T1110 (Brute Force) or T1059 (Command and Scripting Interpreter). Use a free TryHackMe room or the KC7 platform to access a dataset. Write KQL or SPL queries to hunt for evidence of the technique. Document your hypothesis, queries, findings, and verdict.
Why this project matters: Threat hunting is a distinct skill from alert triage. It requires forming a hypothesis and testing it against data. A written hunt report with queries and findings shows analytical thinking that employers value.
Starting point: The free TryHackMe SOC rooms include "Threat Hunting Without Logs," "APT Detection (Volt Typhoon)," and "Windows Threat Detection 1". The KC7 platform is designed for threat hunting practice with realistic datasets.
Goal: Set up a honeypot in the cloud and analyze the attacks it attracts.
Tools: AWS EC2 free tier or Azure free tier, T-Pot or Cowrie, CloudWatch or Azure Monitor.
Time: 6 to 10 hours.
What you build: Deploy a Cowrie SSH honeypot on a cloud VM. It logs login attempts, commands run, and files downloaded. After 48 hours, export the logs and analyze the attack patterns: which IPs connected, which usernames and passwords were tried, what commands the attackers ran.
Why this project matters: A honeypot generates real attack data. You can write a blog post about what you found. That is content employers can read. It proves you understand attacker behavior and cloud deployment.
Safety note: Never deploy a honeypot on a network you do not own. Use an isolated cloud VPC with no connection to your home network.
Goal: Simulate a multi-phase attack against a vulnerable target and detect it using a SIEM.
Tools: Docker, Elastic Stack (Elasticsearch + Kibana), Packetbeat, Nmap, Hydra, Kali Linux, Metasploitable2.
Time: 20 to 30 hours.
What you build: A containerised SOC lab on your laptop. An attacker container (Kali Linux) performs reconnaissance with Nmap, exploits a misconfiguration, and launches a brute force attack with Hydra. A victim container (Metasploitable2) runs vulnerable services. Packetbeat captures all traffic. Elastic Stack indexes it, and you investigate the attack in Kibana.
Why this project matters: SOC analyst job descriptions list Elastic Stack, Nmap, and traffic analysis as core skills. This project proves you have used them together in an attack scenario, not just read about them.
Hardware requirement: You need at least 16 GB of RAM to run the Elastic Stack, the victim, and the attacker containers simultaneously. 8 GB is the bare minimum with trimmed configurations.
Starting point: Search GitHub for "MiniSOC threat detection lab" or "homelab SOC Docker" to find complete architecture diagrams, Docker Compose files, and attack scripts.
Related: SOC Analyst Roadmap ↗
Do not list projects as bullet points on a resume. Create a GitHub repository for each one. Include:
One well-documented project with a clear write-up is worth more than five undocumented labs. Employers want evidence of process, not just completion.
Start with Project 1, not Project 5. The SOC lab is the most impressive project but also the hardest. Build your confidence with the Python scanner first.
Use AI as a tutor, not a crutch. When you get stuck, ask an AI assistant to explain the error message. Do not ask it to write the code for you. The struggle is where learning happens.
Document as you go. Keep notes on what broke, how you fixed it, and what you learned. These notes become your project write-up.
Do not wait until you feel ready. You will never feel ready. Start with the simplest version of Project 1 and add features as you learn.
Join a community. The TryHackMe Discord, r/cybersecurity, and r/homelab are full of beginners asking the same questions you will have. Search before you ask. Someone has already answered it.
Set a schedule. Thirty minutes a day beats five hours on Saturday. Consistency builds momentum.
Celebrate small wins. Getting your first port scan to work is a real accomplishment. Acknowledge it and move to the next step.
Build a public portfolio. Push every project to GitHub. Link your repositories on LinkedIn and your resume. Recruiters check.
Start with the Python vulnerability scanner. It teaches networking fundamentals, requires no virtual machines, and produces a working tool you can show immediately. Even basic Python knowledge is enough to begin.
Only the Mini SOC Lab has significant hardware requirements. It needs 16 GB of RAM. The other four projects run on any machine with 8 GB of RAM and a modern processor.
Create a GitHub repository for each project. Include a README with architecture, screenshots, queries, and findings. Link the repositories on your resume and LinkedIn. In interviews, walk through one project in detail: what you built, what broke, and how you fixed it.
Plan for 60 to 80 hours total if you build them sequentially. Spread across evenings and weekends, that is roughly three to four months. The goal is not speed. The goal is depth.
Pick one project. Start today. Push it to GitHub this week. ExamOS can help you validate the concepts you learn along the way with Daily Sprints and Mock Exams across Security+, CySA+, and CISSP.-*+