Cybersecurity Projects (2026)

Cybersecurity projects for defenders: incident response, threat hunting, packet analysis, OWASP Top 10 secure coding, risk registers, ISO 27001 and cloud security.

57 projects: 14 beginner, 35 intermediate, 8 advanced. Every step is checked as you go, an AI mentor helps when you are stuck, and you finish with a verifiable certificate.

Cybersecurity projects

Container Security with Trivy — This intermediate course is designed for DevOps engineers, security analysts, and IT professionals eager to master container security practices using Trivy. (intermediate · Free)
OWASP Top 10 (2025): Secure Coding for Web Developers — Learn all ten OWASP Top 10:2025 risks and the secure coding patterns, review checklists and automated checks that prevent them. (beginner · Free)
API Security: Authentication, Authorization, and Common Vulnerabilities — Secure REST and GraphQL APIs from the inside: fix real authentication flaws, broken object-level authorization, and abuse at a fictional fitness API startup. (intermediate · $2)
Applied Cryptography: Encryption, Hashing, and Digital Signatures — Follow a fintech engineer securing stored data, passwords, and transactions with encryption, hashing, HMACs, and digital signatures using real libraries and a live TLS certificate chain. (intermediate · $2)
Kubernetes Production Capstone: Real-World Access, Security, and Incident Scenarios — Deploy the full three-service app as one production system on EKS, then run real IAM access, secret-rotation, rollback, autoscaling, and node-maintenance drills against it. (advanced · $3)
Cloud Security Fundamentals: Shared Responsibility and IAM Hardening Across AWS/Azure/GCP — Follow a cloud security engineer through a multi-cloud logistics company's IAM, storage, and network hardening across AWS, Azure, and GCP. (intermediate · $1)
DevSecOps Fundamentals — Learn how DevSecOps reshapes the SDLC and wire SAST, SCA, and container scanning into a real CI/CD pipeline through one payments startup's story. (intermediate · $2)
Active Directory Security: Detecting and Defending Against Credential Attacks — Follow analyst Priya Nair as she builds Kerberos detection rules, hardens AD against credential attacks, and runs an incident response playbook when a honeytoken account fires for real. (advanced · $2)
GRC Fundamentals: NIST CSF, ISO 27001, and Building a Security Program — Follow a GRC lead's race against a bank contract deadline to learn NIST CSF assessment, building an ISO 27001 ISMS with a real risk register, and preparing for an external audit. (intermediate · $1)
Networking Security Fundamentals: Firewalls, VPNs, and Network Segmentation — Learn firewall fundamentals, VPN architectures, and network segmentation through a logistics company's real story of securing a growing, flat network. (beginner · $1)
Ransomware Response and Recovery Playbook — Follow an IT operations manager through a real ransomware event to learn incident containment, the pay-or-not decision, backup recovery, stakeholder communication, and post-incident hardening. (intermediate · $1)
Cloud Compliance as Code: SOC 2, HIPAA, PCI — Learn to encode SOC 2, HIPAA, and PCI-DSS controls as automated, continuously enforced checks instead of scrambling before every audit. (advanced · $2)
Cybersecurity Fundamentals: CIA Triad, Threat Modeling, and Risk Assessment — Learn the CIA triad, attack-surface mapping, STRIDE threat modeling, and building a prioritized risk register through a real small-company security story. (beginner · $1)
Incident Response Fundamentals: From Detection to Recovery — Follow a security lead through a real incident at a fast-growing e-commerce company to learn the incident response lifecycle, from triaging an alert to a blameless post-incident review. (intermediate · $1)
Malware Analysis Fundamentals: Static and Dynamic Analysis — Follow a security analyst through a full malware analysis workflow: safe sandboxing, static and dynamic analysis, IOC extraction, and a SOC-ready report on a quarantined suspicious executable. (intermediate · $1)
Operating Kubernetes in Production: Cluster Maintenance and Secure Supply Chain Delivery — Operate a production Kubernetes cluster: safe node drains and PDBs, Velero backup and restore, and a secure image supply chain with scanning, SBOM, and cosign signing. (advanced · $2)
Red Team Fundamentals: Adversary Simulation and MITRE ATT&CK — Follow red team lead Renata Cruz as she plans and runs Anchorpoint Mutual's first true adversary simulation, mapping every phase to MITRE ATT&CK and reporting results back to the board. (intermediate · $2)
Security Awareness and Social Engineering Defense — Learn why people are the top attack target, spot phishing, spear phishing, and vishing red flags, and build an ethical, blameless security awareness program. (beginner · $1)
SOC Fundamentals: SIEM, Log Analysis, and Alert Triage — Learn what a SOC does, how a SIEM ingests and correlates logs, and how to triage failed logins, malware, and traffic alerts as true positives or false positives, through a real SOC story. (beginner · $1)
Threat Hunting Fundamentals — Learn proactive threat hunting: build a hypothesis from threat intel, hunt across EDR, DNS, and process-tree data, and turn findings into a permanent detection, through a real analyst's story. (intermediate · $1)
Detection Engineering: Writing and Tuning Detection Rules (Sigma/YARA) — Follow a detection engineer through a real incident to learn how to write, test, tune, and ship Sigma and YARA detection rules as part of a repeatable detection-as-code practice. (intermediate · $1)
Digital Forensics Fundamentals: Disk, Memory, and Network Evidence — Follow a digital forensics analyst through a real workplace investigation to learn evidence handling, disk and memory analysis, network forensics, and writing a report for legal and HR use. (intermediate · $1)
GenAI Security: Threat-Modeling LLM Apps with the OWASP Top 10 — Learn to threat-model GenAI applications using the OWASP LLM Top 10, design least-privilege agent tools, and produce security review records for RAG, MCP, and agent workflows. (advanced · $1)
Incident Management and On-Call — Build a sane on-call rotation, run a live production incident as commander, and write blameless postmortems that actually improve reliability. (intermediate · $2)
Multi-Stage Builds, Image Optimization, and Container Security Scanning — Shrink a bloated Docker image with multi-stage builds and smarter base images, then scan it with Trivy and gate CI on vulnerability severity. (intermediate · $2)
Penetration Testing Fundamentals: Recon, Scanning, and Exploitation — Follow Diego Ferreira's first solo pentest for a credit union: scoping rules of engagement, OSINT recon, Nmap scanning, exploiting a known CVE with Metasploit, and writing a professional report. (intermediate · $2)
Web Application Penetration Testing with Burp Suite — Follow Ndidi Okoro's first solo web app pentest: configure Burp Suite as a proxy, map the attack surface, find IDOR and SQLi, exploit XSS/CSRF, and use Intruder to write up findings. (intermediate · $2)
Cloud Security Posture Management — Learn how CSPM catches the cloud misconfigurations that cause most breaches, run real scans against a flawed AWS account, and build lasting remediation and governance. (advanced · $2)
Secure Code Review and Static Analysis (SAST) Fundamentals — Follow one engineer building a secure code review practice from scratch: manual PR review, a catalog of real vulnerable code patterns, and a Semgrep SAST pipeline with custom rules and triage. (intermediate · $2)
Securing EKS Workloads: IAM Roles, Pod Hardening, Secrets, and Policy as Code — Secure real EKS workloads for a healthcare claims platform: IRSA and Pod Identity, hardened Pods, External Secrets Operator, and Kyverno policy as code. (advanced · $2)
Web Application Security: The OWASP Top 10 in Depth — Exploit and fix real OWASP Top 10 flaws -- SQL/command injection, IDOR, SSRF, stored XSS, and insecure deserialization -- against a deliberately vulnerable gear-rental marketplace. (beginner · $1)
Zero Trust Architecture Fundamentals — Follow a security architect through a real VPN breach at a logistics company to learn zero trust principles, identity-centric access, micro-segmentation, and a phased migration roadmap. (intermediate · $1)
Asset Inventory and Exposure Review from Your Own Records — Reconcile a CMDB, DHCP leases and firewall rules in Excel to find unmanaged devices, unowned assets and internet exposure, then brief the IT lead. (beginner · $2)
Data Protection and Cyber Law: The DPDP Act, 2023 in Practice — A Hyderabad telehealth startup builds DPDP Act compliance: personal data basics, privacy notices and consent, breach notification, and a real gap-assessment audit. (intermediate · $1.25)
Risk Register and Board Pack: Quantify Cyber Risk — Build a quantified cyber risk register (SLE, ARO, ALE), decide treatments with ROSI, cost the controls in Excel and brief the board in one page. (intermediate · $3)
Banking Secure Coding L1: Fix SQL Injection in a Login Query — Reproduce a prepared login bypass, bind query values and prove that valid banking logins still work. (beginner · $1)
Banking Secure Coding L2: Stop Stored XSS in Customer Feedback — Trace stored feedback into a reviewer page, remove unsafe HTML trust and verify safe text rendering. (beginner · $1)
Banking Secure Coding L3: Remove Username Enumeration from Login — Make authentication failure responses uniform while preserving password verification and valid customer access. (beginner · $1)
Banking Secure Coding L4: Verify JWTs and Reject Tampered Tokens — Restore JWT verification and prove that valid, modified and expired token cases behave correctly. (intermediate · $1)
Banking Secure Coding L5: Review Disclosure, CVE Applicability and Safe Logs — Assess a disclosed framework version and design three banking events with useful fields and sensitive-data exclusions. (intermediate · $1)
Banking Secure Coding L6: Enforce Account Ownership at the API — Stop cross-user account disclosure with a server-side ownership check and prove both legitimate owners retain access. (beginner · $1)
Banking Secure Coding L7: Fund Transfer Security Review — Review a 60-line transfer specimen, support four findings and prioritise three corrections by banking impact. (intermediate · $1)
Build and Prove a DMZ: Firewall Policy Design — Design a DMZ firewall policy in a pfSense-style editor: aliases, port forwards, per-interface rules, proved with policy lookups, diagrammed and explained. (intermediate · $3)
Capstone: Secure Cloud Architecture Review — Review a cloud migration end to end: 6R strategies, BCDR patterns, a peer review, a target-architecture diagram, the cost case and a board-ready review. (advanced · $3)
Decode the Evidence: Encodings, Tokens and Hash Integrity — Read encoded exhibits from an internal investigation, decode a session token without trusting it, and prove which document changed using hashes. (beginner · $2)
Detection Engineer's First Week: SIEM Search and Detection Rules — Hunt through a day of SIEM events and write detection rules that catch real situations without drowning the team in false positives. (intermediate · $3)
Emerging Tech Review: Serverless, Containers, Edge and AI — Review four emerging cloud services for a fintech: a least-privilege Lambda, container scans, edge kiosks, AI risks, a Well-Architected review and a DevSecOps pipeline. (intermediate · $3)
Fix the Leaky Cloud: Cloud Security Posture Hardening — Scan a start-up's cloud account, close a public data bucket, lock down exposed ports, enforce IMDSv2, MFA and key rotation, and rescan clean. (intermediate · $3)
ISO 27001 + DPDP Act Readiness for a Health-Tech Start-up — Prepare a telehealth start-up for ISO 27001: Statement of Applicability, evidence and gap assessment, India's DPDP Act duties and a readiness memo. (intermediate · $3)
Password Policy Audit Against NIST SP 800-63B — Audit a company's password settings and account metadata against NIST guidance in Excel, then write the remediation memo. No passwords, no hashes, no cracking. (beginner · $2)
Patch Priority Board: CVSS, KEV, SLAs and ATT&CK in Excel — Turn a vulnerability-management export into a ranked remediation plan: environmental adjustment, KEV first, SLA days left and ATT&CK mapping. (intermediate · $2)
Plaintext on the Wire: Packet Analysis for Defenders — Read a real network capture in Bartman's in-browser Packet Lab and prove why an HTTP login portal must go: filters, streams, TLS and the fix. (beginner · $2)
Ransomware: Readiness, Response Decisions & Recovery — Assess a hospital group's ransomware readiness against NIST IR 8374 and CIS, plan backups and recovery, make the tabletop decisions (CERT-In, DPDP, payment) and write the communications. (intermediate · $3)
Secure-by-Default Storage Module with OpenTofu — Write an OpenTofu module any team can call with one input and get a hardened storage bucket, checked by policy-as-code on every plan. (intermediate · $3)
Stop the Spoof: SPF, DKIM and DMARC for a Real Business — Make a company's domain unspoofable without breaking its own mail: SPF, DKIM, DMARC alignment and reject, plus reading phishing headers. (intermediate · $2)
What Happened on Tuesday? Incident Triage from a Packet Capture — Triage an infected workstation from its network capture: the download, the DNS anomaly, the beaconing, the IOCs, containment and the incident report. (intermediate · $3)
Who Touched the Instance? Cloud Audit Logs and Chain of Custody — Investigate a cloud incident from read-only audit events: identify the key, source and changes, contain without destroying evidence, record custody. (intermediate · $2)

Practise cybersecurity more

Security+ practice test: Timed SY0-701 style papers with every answer explained.
Beginner CTF: A beginner-friendly cybersecurity capture-the-flag.
ISC2 CC practice test: Timed Certified in Cybersecurity style papers.

Frequently asked questions

Do I need to install anything for these cybersecurity projects?

Most projects run in labs inside your browser (SQL, Excel, Python, Power BI, Git and more). Cloud projects say up front when they use your own AWS account or a simulator instead.

How is a Bartman project different from a tutorial?

You do the work yourself, step by step. Each step is checked automatically, and an AI mentor helps when you are stuck, so you finish with work you can show rather than a video you watched.

Do I get a certificate?

Yes. Finishing a project earns a certificate with its own ID that anyone can verify on bartman.ai.

What is Bartman?

Bartman (bartman.ai) is a learning platform where you build real projects with an AI mentor, practise in free browser labs, take mock tests and practice exams, and run job simulations. It was founded in 2025 and is based in Hyderabad, India.

Cybersecurity Projects (2026)