Cybersecurity Portfolio Projects
Develop practical cybersecurity experience in a safe lab environment. These project guides cover defensive security, detection, incident response, and security automation, with clear deliverables you can show in a portfolio.
Career areas
- SOC Analyst
- Security Engineer
- Security Analyst
Browse Cybersecurity projects
- Automated Cybersecurity Compliance & Patch Auditor
A security auditing tool that scans systems for vulnerabilities, missing patches, and config drift — outputs a professional PDF report.
Level: advanced · Tools: Python, Nmap, ReportLab, Bash
- Adversarial Prompt Injection Detector for LLM Applications
A real-time security gateway between users and an LLM that blocks prompt injections and jailbreak attempts.
Level: intermediate · Tools: Python, LangChain, OpenAI API, Scikit-learn
- Deepfake Audio Detection System for VoIP Security
A real-time audio analysis engine that detects synthesized or cloned voices in VoIP streams using MFCC features.
Level: advanced · Tools: Python, Librosa, TensorFlow/PyTorch, FastAPI
- Behavioral Biometrics Engine for Continuous Authentication
A security system that authenticates users based on typing rhythm and mouse movement patterns — not static passwords.
Level: intermediate · Tools: Python, Scikit-learn, Flask, JavaScript
- AI-Powered SOC Analyst Agent Home Lab
A beginner-friendly home lab that pairs Kali + Ubuntu VMs with an AI penetration-testing agent — your first hands-on security project that produces real artifacts.
Level: beginner · Tools: VirtualBox, Kali Linux, Ubuntu, Python
- SIEM Home Lab with Detection Engineering
A working Wazuh SIEM ingesting Windows and Linux logs, with custom detection rules mapped to MITRE ATT&CK — and a simulated attack that proves they fire.
Level: intermediate · Tools: Wazuh, Sysmon, Sigma, MITRE ATT&CK
- Phishing-Resistant Login with Passkeys (WebAuthn)
A working web app where users register and sign in with a passkey — a fingerprint, face, or security key — instead of a password. You build the relying party end to end and can explain why a phishing site cannot steal the credential.
Level: beginner · Tools: Node.js, SimpleWebAuthn, React, SQLite
- LLM Red-Team Lab with Garak, PyRIT, and Promptfoo
A safe, local lab where you run automated adversarial testing tools against a model you host yourself — jailbreaks, prompt injection, data leakage, toxic output — and produce a findings report with severity ratings and mitigations, the way an AI security engineer would.
Level: intermediate · Tools: Ollama (local model), Garak, PyRIT, Promptfoo
- Software Supply-Chain Guard: SBOM, Signing, and Provenance in CI
A CI pipeline that produces a signed container image with a software bill of materials, SLSA provenance attestation, and a vulnerability scan on every build — and a deployment gate that refuses any image without a valid signature. The defenses against the attack class behind the biggest incidents of recent years.
Level: advanced · Tools: GitHub Actions, Syft, Trivy, Cosign / Sigstore
- Detection Engineering for AI Agent Telemetry
A security analytics pipeline for AI systems — synthetic logs of prompts, model responses, retrievals, and tool calls streamed into OpenSearch, with Sigma-style detection rules that fire on jailbreak loops, credentials pasted into prompts, and abnormal retrieval volume. Blue-team skills applied to a brand-new attack surface.
Level: advanced · Tools: OpenSearch Security Analytics, Sigma Rules, Python (log generator), Docker Compose