Beyond the Flag: Yearly Cybersecurity Project Ideas for Secondary Students

Abstract

Beyond the Flag is a free, adaptable guide for teachers supervising long student projects in cybersecurity, in any curriculum: MEB yearly projects, IB Extended Essays, Internal Assessments and MYP Personal Projects, AP courses and capstones, the Extended Project Qualification (EPQ), and clubs. Its central principle is that finding a flag is where a cybersecurity investigation starts, not where it ends. Students move from solving challenges to explaining why methods work, defending against the weaknesses they find, and creating something original. The package includes: Quick Guide (PDF, 15 pages): a two-minute visual overview of the principle, all 24 ideas, safe scope and assessment. Teacher Guide (PDF, 24 pages): the project ladder from weekly practice to a yearly project, investigation and design routes, 24 project ideas across 8 color-coded domains and 3 levels, each with a teacher tip and a "watch for" note, safe and authorized scope guidance, an assessment framework and rubric, a suggested timeline, teacher questions, and a directory of 35 free and free-tier platforms, tools and frameworks, checked in October 2026. Student Idea Bank (PDF, 8 pages): a student-facing handout with all 24 ideas, how to choose one, how to stay safe and legal, and a QR code for students using printed copies. Editable Templates (Word and PDF): project proposal, challenge log, progress journal, scope agreement, and assessment rubric with score sheet. The eight domains are CTFs and challenge design; Linux and system security; cryptography; web security; digital forensics; network security; human factors, policy and society; and emerging areas including smart devices, AI prompt injection and secure coding. Each idea shows the AP Cybersecurity unit it connects to, but the guide works in any curriculum. No cyber range is required, and all core resources are free. Author: Abdullah Rehman, international educator teaching AP Computer Science A and AP Cybersecurity. Updates and related resources: Teaching AP Cybersecurity newsletter (https://www.linkedin.com/newsletters/teaching-ap-cybersecurity-7496670449796550656/). LinkedIn: https://www.linkedin.com/in/theabdullahrehman Also in this series: AP Cybersecurity Student Brief (https://doi.org/10.5281/zenodo.22552676) and Incident Zero: A First-Day AP Cybersecurity Challenge (https://doi.org/10.5281/zenodo.22261630). AP® is a trademark registered by the College Board, which is not affiliated with, and does not endorse, this resource.