Prove Your Cybersecurity Chops

Implement a Cipher From Mathematical Specification and Analyse a Real Vulnerability

Elective foundation. Implement a symmetric cipher from its mathematical specification (no library calls for core operations) and analyse a published cryptographic vulnerability. Reviewed by a security practitioner or CS lecturer who will present a different cipher specification and ask you to identify its key schedule or flaw in real time.

3 milestones

1. 1Implement AES and RSA From First Principles
2. 2Analyse a Real TLS 1.3 Handshake and Implement HMAC
3. 3Demonstrate and Present a Cryptographic Attack

Conduct a Network Security Analysis in a Sanctioned Environment

Elective. Capture your own network traffic (Wireshark, your IP in the capture file), document 3 vulnerabilities in your controlled environment, and write remediation recommendations. ALL testing must be on systems you own or have explicit written authorisation to test. Reviewed by a security practitioner who will provide an unseen packet capture for you to diagnose.

3 milestones

1. 1Capture and Analyse Network Traffic for Security Indicators
2. 2Conduct a Network Security Assessment on a Controlled Target
3. 3Write a Security Assessment Report and Present Findings

Build a Threat Model for a Real System You Control

Elective. Build a STRIDE or PASTA threat model for a real system you built or have access to — not a hypothetical. Document mitigations or explicit residual risk acceptance for each threat. Reviewed by a security engineer who asks 'what changes if you add an API gateway here?'

3 milestones

1. 1Study Secure Design Principles and Threat Modelling
2. 2Implement Mitigations and Verify Against the Threat Model
3. 3Present the Secure Design in a Security Review

Complete a CTF Challenge and Publish a Methodology Write-Up

Elective — the most AI-proof outcome on this path. Complete a minimum medium-difficulty CTF on HackTheBox, PicoCTF, or a CTFtime-listed event with 100+ participating teams. Publish a writeup explaining every exploit: the vulnerability class, how you identified it, the exploitation technique, and what it reveals about the underlying system's security model. The flag proves completion; the writeup proves understanding. ALL testing within the sanctioned CTF platform only — never test systems you do not own or lack explicit written authorisation to test.

3 milestones

1. 1Complete Structured Penetration Testing Training
2. 2Conduct a Full Penetration Test on a Controlled Target
3. 3Write a Professional Penetration Test Report