I get the same message constantly, from comment sections, DMs, and every “how do I break into cybersecurity” conversation I’ve had this year: people are consuming a ton of content and building almost nothing.
Watching tutorials helps. Taking notes helps. Even stacking up certifications helps, a little. But none of that forces you to touch packets, break something on purpose, read your own logs, secure an app, deploy infrastructure, and then explain what you actually built.
So this issue is my answer to that gap: five cybersecurity projects that map directly to real skills, network analysis, cloud and container security, secrets management, Kubernetes, SOC operations, and detection engineering. I’ve either built these myself on the channel or worked through similar examples already, so I’m linking the receipts as I go.
Why I Think Watching Isn’t Enough Anymore
A lot of people say they want security operations, threat hunting, incident response, or blue team work, and then skip the fundamentals entirely.
The goal is not to become a packet wizard overnight. The goal is to build the muscle to look at traffic and say, “Okay, I understand what is happening here.”
That line applies to basically every project below. None of these are “beginner project” ideas that sound good on a resume and teach you nothing. Pick one, build it, and document it like you’d document work you actually got paid for.
Project 1: Build a Network Traffic Analysis Lab
So much of security still comes back to understanding what’s actually happening on the wire. Set up a couple of virtual machines, generate normal traffic (browse the web, SSH into a box, transfer a few files), and capture it with Wireshark.
Then start interrogating it:
What does normal DNS traffic look like?
What does an SSH connection look like?
What changes once traffic is encrypted?
Can you identify the source, destination, protocol, port, and purpose?
Once you’ve got a feel for “normal,” introduce something suspicious: run a basic port scan, simulate a file download from a shady host, or replay a PCAP from a malware analysis challenge. That skill translates directly into SOC work, incident response, and detection engineering.
I’ve already worked through this kind of analysis on the channel:
A Quick Word on Python and SQL
Many of these projects are hands-on, but two foundational skills make them easier: Python and SQL.
Python shows up everywhere in this field: parsing logs, hitting APIs, automating repetitive tasks. SQL matters just as much once you’re touching logs, SIEMs, and dashboards, because most security work is really just asking better questions of data.
Every modern SIEM you’ll touch- Splunk, Sentinel, Chronicle, Elastic- is essentially SQL under the hood. Pivoting through auth logs for lateral movement, correlating DNS queries against a threat feed, building a dashboard of failed logins by user: that’s SQL.
I partnered with DataCamp for this one, for exactly that reason. I’d point you to their Python Programming Fundamentals and SQL Fundamentals tracks, both around 12 hours and hands-on the whole way through, with a certification at the end for your resume or LinkedIn.
You only retain about 20% of what you passively consume. When you’re actively writing code, that jumps to 75 or 90%.
That’s the actual reason I’ve been using it myself to keep those skills sharp: DataCamp Python Fundamentals and DataCamp SQL Fundamentals.
Project 2: Securely Containerize a Basic App
This one is underrated. A lot of people want to jump straight to cloud security or DevSecOps without ever containerizing an application themselves, and I don’t mean copying a Dockerfile off the internet and running it docker build.
Take a basic Flask app, a Node app, or something intentionally vulnerable, containerize it, and then secure it. Ask yourself:
Am I running this container as root?
Do I need every package inside this image?
Are there secrets hardcoded in the app?
Did I expose unnecessary ports?
Can I scan this image for vulnerabilities?
This bridges the gap between “I know cybersecurity theory” and “I can actually secure something engineers use,” because in the real world, security teams spend as much time on how software is built and shipped as they do triaging alerts.
Reference points from past videos on the channel:
Then take it further by documenting your own hardened version: write a README, show the before-and-after Dockerfiles, and include the scan results.
Project 3: Self-Host a Password Manager
Everyone understands passwords and why password managers matter. What most people skip is the security model underneath it.
You can run this locally in your homelab or host it in the cloud with something like Vaultwarden or Passbolt. The value isn’t in getting it running; it’s in thinking through the threat model: Is it exposed to the internet? Is it behind a VPN? Are backups handled safely? Are you monitoring authentication attempts? Are you actually applying updates?
That’s the difference between “I installed a password manager” and “I deployed a security-critical service, locked down access, configured backups, and monitored it.” One of those is a resume line. The other is a project.
The same reference video applies here:
And it stacks well with the other projects on this list: put it behind Tailscale, monitor it with Wazuh, write detection rules for failed logins.
Project 4: Learn Kubernetes the Hard Way (or Break It With Kubernetes Goat)
Kubernetes is intimidating the first time you look at it: containers, networking, certificates, YAML, RBAC, service accounts, ingress, all stacked together. That’s exactly why it’s worth learning properly.
Two paths here. Kubernetes the Hard Way has you manually build a cluster and actually understand the certificates, control plane components, and networking that a managed service normally hides from you:
Kubernetes Goat is the security-focused path: it covers vulnerable scenarios such as misconfigurations, privilege escalation, secret exposure, and container escapes.
If your goal is to understand infrastructure, do the Hard Way. If your goal is Kubernetes security specifically, do Goat. If you’re serious, do both: understand how it works first, then attack and defend an insecure version of it.
Project 5: Build a Cybersecurity Homelab or Mini SOC
This is probably the project most aligned with this channel, because if you’ve been around a while, you already know I love homelabs. And a homelab does not need to be expensive. You don’t need a rack, you don’t need enterprise gear, you don’t need ten servers humming in a closet. An old laptop, a mini PC, a Raspberry Pi, or even VirtualBox on your current machine is enough.
A simple version looks like: a hypervisor like Proxmox, a Windows endpoint, a Linux endpoint, a Wazuh manager and a few agents, a vulnerable machine, and some log sources. Then you start generating real questions: Can I see failed logins? Can I detect suspicious PowerShell? Can I collect logs from Linux and Windows and write a custom detection rule?
Installing Wazuh, Security Onion, or Splunk is not the project. The project is what you do after it’s installed: generating telemetry, tuning false positives, building dashboards, and documenting the incidents you investigate.
I’ve documented my own homelab journey across my Homelab and Detection playlist and Home SOC projects, including the Proxmox build itself:
How I’d Actually Approach These Five
If you’re new to the field, start with the Network Traffic Analysis Lab and either the Homelab or the SOC project. Those give you the strongest fundamentals.
If cloud security, DevSecOps, or AppSec is the goal, start with containerizing an app and self-hosting a password manager.
If you want to push into more advanced infrastructure, do Kubernetes the Hard Way or Kubernetes Goat.
But honestly, the real magic is connecting them. Build a homelab. Run a password manager inside it. Containerize a basic app. Monitor everything with Wazuh. Capture the traffic. Deploy Kubernetes Goat. Generate attacks. Write detections. Document the whole thing.
That’s the difference between someone who says “I’m interested in cybersecurity” and someone who can say “here is what I built, here is what I broke, here is what I secured, and here is what I learned.”
What I’m Taking Away From This
Consumption isn’t the bottleneck anymore; application is. Between YouTube, certifications, and endless write-ups, information has never been easier to find. The people who stand out are the ones who actually built something with it.
Documentation is the project. Building the lab and never writing it down is basically the same as not building it. A README, a set of screenshots, and an honest account of what broke turns a weekend project into a portfolio piece.
Connected projects beat isolated ones. A password manager behind Tailscale, monitored by Wazuh, inside a homelab you built yourself, tells a far stronger story than five disconnected weekend experiments.
Your Challenge
Pick one of these five projects and actually build it. Not save it, not bookmark it, not add it to a Notion board. Build it, then document it: take the screenshots, write down the commands, explain what went wrong and what you fixed.
That documentation is what turns into a GitHub project, a blog post, a LinkedIn post, or your next interview talking point.
I genuinely want to know: which one of these five are you building this summer? Network Traffic Analysis Lab, Securely Containerizing an App, Self-Hosting a Password Manager, Kubernetes the Hard Way or Goat, or your own Homelab/SOC? Reply and let me know; I want to see what y’all are building.
Interested in sponsoring Cyberwox?
Sponsoring Cyberwox helps me continue creating practical cybersecurity education, labs, and industry analysis while connecting your brand with a trusted multi-platform audience of 120,000+ cybersecurity practitioners, engineers, students, founders, and technology leaders across the global cyber community on our YouTube, LinkedIn, X, & Substack 🌎
Until Next Time
That’s it for this one.
As always, keep learning, keep building, and keep thinking deeply about the systems we’re trusted to defend.
See you in the next one.
~ Day 💙
This newsletter includes affiliate links from the original video sponsor. I may earn a commission if you purchase through them, at no additional cost to you.