# Cybersecurity graduation project: a worked example and a checklist for students

> **The short answer**: A strong cybersecurity graduation project assesses a system you own in an isolated lab, with a written scope and a known method, then reports each weakness, its category and its fix. Base the testing on references such as OWASP and NIST, and never test a system without written permission.[^1][^3]

**Key takeaways**

- Pick a system you own or an isolated training lab, never a real system without written permission.
- Write the scope, tools and method before you start testing.[^3]
- Tie each weakness to a known category such as the OWASP Top 10 and to a fix you can carry out.[^1]
- Re-test after the fix: the project is the difference between before and after.

![Cybersecurity graduation project](https://tiswa.app/assets/blog/cybersecurity-graduation-project-example/cybersecurity-graduation-project-example-cover-en.webp)

A final-year student shows the committee a screen of scanning tools running. The committee asks: what scope were you allowed? Where is the permission? What did you fix? He has no answer. The tools were fine. What was missing was the frame that makes the work a cybersecurity project rather than an experiment.

> **tiswa's take**: The weakest security projects at a defence demonstrate an attack with no report. The strongest build a small environment themselves, assess it with a method, fix what they found and measure again. A committee needs to see your decisions written down, not only tools running on a screen.

## How do you choose a cybersecurity graduation project?

Pick an idea you can carry out completely on your own machine or in your department’s lab, with a start and an end you can measure. Broad offensive ideas such as “hack a network” usually need permission you do not have. Defensive and assessment ideas are safer and stronger: assessing the security of a web app you build yourself, building a log collection and alerting setup in a virtual environment, or comparing hardening settings for one service before and after. A wider list by major is in [graduation project ideas](https://tiswa.app/en/blog/graduation-project-ideas/).

Before settling on the idea, ask your supervisor about the department’s policy on testing: where are penetration tests allowed, does the department provide an isolated environment, and does the committee want a copy of the permission? The answers set what you can do, and they differ between universities.

## What is a worked example of a cybersecurity graduation project?

Here is an illustrative example of a hypothetical project titled “Assessing the security of an appointment-booking web app before and after hardening.” It shows the method; it is not a set of published results:

1. **Build the target yourself**: Install a simple web app (an appointment booking form) in a virtual machine isolated from the network. You own it and control all of it.
2. **Write the scope**: A one-page document: what will be tested (the app and server), what will not (anything outside the machine), the tools, the period and your supervisor’s approval.
3. **Choose the reference**: Use the OWASP Top 10 for categories of application risk,[^1] and the OWASP Web Security Testing Guide for test steps.[^2]
4. **Run the tests**: Check login, permissions, input fields, error messages and sessions, and log every step with the time and what you observed.
5. **Classify the weaknesses**: For each: what it is, where, how to reproduce it, which category it falls under, the impact, and a severity rating using a scale you explain in the report.
6. **Fix and re-test**: Change the code or settings, repeat the same tests and put before and after results in a table.

![Diagram: The assessment loop: scope, test, classify, fix, re-test](https://tiswa.app/assets/blog/cybersecurity-graduation-project-example/cybersecurity-graduation-project-example-inline-1-en.webp)


This order follows the spirit of NIST’s guide to security testing and assessment, which sets out planning, execution, analysis of findings and reporting.[^3] You need not follow it to the letter, but cite it in the report to show your method rests on a reference.

## How do you write the report for a cybersecurity project?

| Section | What it contains | Question it answers |
|---|---|---|
| Summary | The problem and the outcome in one paragraph | What did you do and what did you find? |
| Scope and method | Test boundaries, tools and reference | What did you test, and how? |
| Findings | A table of weaknesses, categories and impact | What did you find? |
| Remediation | The fix and the re-test | Did the problem go away? |
| Limits | What the testing did not cover | Where does your proof stop? |
| References | Cited sources | What did you rely on? |

![Checklist: Before the defence: six checks](https://tiswa.app/assets/blog/cybersecurity-graduation-project-example/cybersecurity-graduation-project-example-inline-2-en.webp)


The limits section earns respect from the committee. Say honestly what you did not test. For wording, see [the limitations section](https://tiswa.app/en/blog/capstone-limitations-section/), and for the summary, [the graduation project abstract](https://tiswa.app/en/blog/graduation-project-abstract/).

## What are the legal and ethical limits of a cybersecurity project?

The general rule: test what you own or what its owner has authorised in writing, and nothing else. The National Cybersecurity Authority is the national body for the field in the Kingdom,[^4] and for official frameworks and controls you should go to its site and to your supervisor, not to what classmates say. Keep real people’s or organisations’ data out of your report, and never publish a weakness that affects a real system.

If you put the project on a platform such as GitHub, publish only the code you wrote and the report, not ready-made attack tools aimed at real systems. Working with repositories is covered in the [GitHub guide for beginners](https://tiswa.app/en/blog/github-for-beginners/).

## Should you use AI in a cybersecurity project?

It can explain a term or review the wording of your report, but do not rely on it to judge a weakness, and do not send it code or logs that belong to a real organisation. Safe use is covered in [AI for cybersecurity students](https://tiswa.app/en/blog/ai-for-cybersecurity-students/). If you are planning the road after graduation, read the [cybersecurity roadmap](https://tiswa.app/en/blog/cybersecurity-roadmap/).

## What should you check before the defence?

1. **The scope is written**: The scope document is approved by your supervisor and states what was not tested.
2. **The lab is isolated**: The virtual lab is not connected to real systems or to a residence network.
3. **Every weakness can be reproduced**: Each has steps to reach it again and a screenshot or log.
4. **Every weakness has a fix**: The change is written down and the test after it is recorded.
5. **Sources are named**: OWASP, NIST and anything else you used are in the references.
6. **The talk is ready**: Slides that open with the problem and end with the result; see [defence slides](https://tiswa.app/en/blog/graduation-project-defense-slides/).

For lab software and study tools, compare offers before you buy in the [student deals](https://tiswa.app/en/deals/). [Browse student deals](https://tiswa.app/en/join/)

## Questions

### What are good cybersecurity graduation project ideas?

Assessing a web app you build yourself, a log collection and alerting setup in a virtual lab, or a before-and-after comparison of hardening settings. Choose one you can finish in an isolated environment.

### Can I use a ready-made cyber security graduation project?

Do not rely on one: the committee will ask about every decision. Read examples to learn the structure, then run your own project on a system you own and write your own report.

### Can I test a real website in my graduation project?

Not without written permission from its owner and your supervisor’s knowledge. The safer route is to build the target yourself in an isolated lab.

### Which references should a cybersecurity project use?

The OWASP Top 10 and Web Security Testing Guide, NIST SP 800-115 for testing and assessment, and the National Cybersecurity Authority site for national frameworks.

### How do I write the report for a cybersecurity project?

A summary, then scope and method, findings in a table, remediation and re-test, limits and references.

### Which tools should I use for a cybersecurity project?

The ones your idea needs and your department accepts, with a line in the report on why you chose them. The method, documented by the tool’s own guide, matters more than the tool.


## Sources

[^1]: OWASP: Top Ten, https://owasp.org/www-project-top-ten/
[^2]: OWASP: Web Security Testing Guide, https://owasp.org/www-project-web-security-testing-guide/
[^3]: NIST: SP 800-115, Technical Guide to Information Security Testing and Assessment, https://csrc.nist.gov/pubs/sp/800/115/final
[^4]: National Cybersecurity Authority, Saudi Arabia, https://nca.gov.sa/en/