44 Cybersecurity Dissertation Topics You Can Actually Test and Defend

You have the modules behind you and a rough area in mind. What you need now is one of the cybersecurity dissertation topics that you can actually finish, defend in a viva or presentation, and evidence properly. Before committing, settle these questions:

• Can I get realistic data for this, or will I need to build an isolated lab and generate my own traffic, logs or malware runs?
• If my project involves any attack testing, am I sure it stays within the Computer Misuse Act 1990 and my university’s ethics approval?
• Will examiners still accept a well-known dataset such as CICIDS2017, given its documented labelling problems?
• Does my programme expect a technical build, a user study or a policy analysis?
• If my topic depends on a Bill still in Parliament, how do I stop it going out of date before I submit?
• Do I have the maths for a cryptography project, or the Python and statistics for a machine learning one?

The ideas below cover technical and socio-technical cybersecurity: network and cloud security, malware, cryptography, AI security, digital forensics, cyber-physical systems, human factors, cybercrime and UK cyber risk governance. Legal doctrine is covered separately in our cyber law dissertation topics, and offence-focused research sits with the cybercrime law dissertation topics resource. Each topic below names a specific dataset, standard, tool or event, so the headline already works as a draft title.

Position correct as of September 2026. Several topics rely on live UK and EU developments, so check the UK Parliament Bills site and NCSC guidance for current status before you write your proposal.

Network Security and Intrusion Detection Topics

Network intrusion detection is the most popular area for cybersecurity research topics, and also the most crowded. The strongest projects here question the evidence itself rather than chasing another accuracy score.

1. How far do intrusion detection results on CICIDS2017 change when models are retrained on the corrected labels published by Engelen and colleagues?
CICIDS2017 is widely used, yet researchers have documented labelling and flow-construction errors in it and released a corrected version. Replicating a random forest or gradient boosting baseline on both versions, then comparing per-class F1 scores, tells you how much published results depend on flawed labels. Level: MSc. Pitfall: random train and test splits leak near-duplicate flows and inflate scores, so split by capture day instead.

2. Whether a detector trained on UNSW-NB15 transfers to CSE-CIC-IDS2018 traffic, and which flow features survive the move
Models that score 99% on one dataset often collapse on another. Researchers have published NetFlow-based versions of both datasets with a shared feature set, which makes cross-dataset testing practical. A Master’s project could test three classifiers in both directions; a PhD could propose a method for feature alignment. Research question: which attack classes generalise, and which only look detectable because of dataset artefacts?

3. Can DNS-over-HTTPS tunnelling be separated from ordinary encrypted DNS using the CIRA-CIC-DoHBrw-2020 dataset?
Encrypted DNS protects privacy, but attackers can also hide data exfiltration inside it. The dataset labels benign and malicious DoH traffic, so an undergraduate can train a simple classifier on timing and packet-size features and explain which features matter. This is a manageable topic for a first research project because the data is public and the question is narrow.

Malware Analysis and Endpoint Detection

4. How quickly does a DREBIN-feature Android malware classifier decay under a time-aware split of AndroZoo samples?
The TESSERACT study (USENIX Security 2019) showed that random splits hide how fast malware classifiers age. Training on apps from one year and testing on later years gives a realistic decay curve. AndroZoo access requires an academic request, so apply early. Level: MSc or PhD. At PhD level, the question can extend to retraining strategies under concept drift.

5. Are SHAP explanations for a LightGBM model on the EMBER dataset stable enough across retrains to guide malware analysts?
EMBER provides static features from Windows executables without distributing live malware, which keeps the project safe. The question is whether the “top features” an explanation tool reports stay consistent when the model is retrained with different seeds. If they do not, analysts may be trusting noise. Suits a Master’s student with solid Python.

6. Can file-entropy monitoring in an isolated Windows sandbox flag ransomware encryption before a set share of test files is lost, and what false alarms do backup and compression tools cause?
Encryption raises file entropy sharply, but so does legitimate compression. A controlled experiment comparing detection time against false-positive rate is a genuine trade-off study. Feasibility: this needs an air-gapped virtual lab, samples from a research repository such as MalwareBazaar, and explicit written approval from your department before any live sample is run.

7. How effectively do public Sigma rules detect abuse of certutil, mshta and rundll32 in the OTRF Security Datasets?
These are “living off the land” binaries: legitimate Windows tools that attackers misuse, mapped in MITRE ATT&CK under System Binary Proxy Execution (T1218). The OTRF Security Datasets contain recorded attack telemetry, so an undergraduate can measure how many known techniques the community rules catch without touching live malware. A clear, feasible choice for students who prefer log analysis to coding.

Cloud Security and Identity Dissertation Ideas

8. To what extent does enforcing AWS IMDSv2 block the SSRF-based credential theft seen in the 2019 Capital One breach, and how many public Terraform modules still permit IMDSv1?
Two strands combine well here: a lab demonstration against your own AWS account, and a static scan of public Terraform code with a tool such as Checkov. The result shows whether a known fix is being adopted in practice. Pitfall: only ever test infrastructure you own.

9. Which permissions in public Helm charts on Artifact Hub grant cluster-wide Kubernetes privileges that the workloads do not need?
Over-privileged service accounts are a common route for lateral movement in Kubernetes. Sampling charts, extracting RBAC rules and comparing them with what each application requires gives measurable least-privilege gaps. Suits Master’s students with some container experience.

10. What stops UK small businesses moving from SMS one-time codes to FIDO2 passkeys?
Passkeys resist phishing and SIM-swap attacks, yet adoption among smaller firms is uneven. Semi-structured interviews with owners or IT contractors, analysed thematically and framed with the Unified Theory of Acceptance and Use of Technology (UTAUT), would suit an undergraduate or Master’s student without a heavy technical background.

11. How should IT service desks verify callers before resetting multi-factor authentication, in light of the help-desk impersonation widely reported in the 2025 UK retail attacks?
The attacks on Marks and Spencer and Co-op put help-desk social engineering at the centre of public debate. A Master’s project could compare published identity-verification practices with interview data from service desk staff. Pitfall: press reports are not evidence of what happened inside an organisation, so treat them as context and triangulate.

For students who want structured support once a direction is chosen, our subject-specific cybersecurity dissertation support covers planning, methodology feedback and editing.

Cryptography and Post-Quantum Migration

Post-quantum migration is one of the clearest current cybersecurity research topics with a fixed UK timetable. The NCSC’s migration guidance sets three milestones: by 2028 organisations should define migration goals, carry out a full discovery exercise and build an initial plan; by 2031 they should complete early, highest-priority migration; and by 2035 migration of all systems, services and products should be complete.

12. Building a cryptographic inventory for the NCSC’s 2028 discovery milestone: what do automated scanners miss in a mid-sized estate?
Discovery sounds simple until you find cryptography buried in firmware, libraries and third-party services. Comparing network-level TLS scanners (such as sslyze or testssl.sh) with code and configuration review in a lab estate or a cooperating organisation reveals the blind spots. Level: MSc. Feasibility: organisational access is the risk, so design a lab fallback.

13. What does hybrid X25519MLKEM768 key exchange add to TLS 1.3 handshake time and message size on a Raspberry Pi class device?
Hybrid key exchange pairs a classical algorithm with ML-KEM (FIPS 203). The Open Quantum Safe project’s liboqs and its OpenSSL provider, or recent OpenSSL releases with native ML-KEM, make benchmarking realistic. Measure latency, handshake bytes and CPU load under packet loss. A focused Master’s project with a clean experimental design.

14. ML-DSA (FIPS 204) versus SLH-DSA (FIPS 205) for signing firmware updates on constrained IoT devices: which trade-off fits?
SLH-DSA relies on conservative hash-based assumptions but produces large signatures; ML-DSA is faster and smaller but rests on lattice problems. Benchmarking verification time, signature size and flash use on a microcontroller turns an abstract debate into engineering evidence. Suits MSc, or PhD with a new optimisation.

15. Whether constant-time testing tools such as dudect detect KyberSlash-style timing leaks in ML-KEM implementations
KyberSlash showed that secret-dependent division in reference Kyber code could leak key material through timing. The research question is whether automated leakage testers catch this class of flaw, or whether manual review is still needed. Level: PhD or a strong MSc with C and statistics skills.

16. How common are ECB mode, static IVs and hard-coded keys in open-source Android apps on F-Droid, measured with a static misuse detector?
Cryptographic misuse is a practical, well-studied problem, and using open-source apps avoids licence and reverse-engineering concerns. An undergraduate can run a tool such as CryptoGuard across a sample, then manually verify a subset to estimate false positives.

Artificial Intelligence in Cybersecurity

AI appears here in two roles: as a defensive tool and as a system that needs defending. Broader machine learning questions that are not about security belong with our artificial intelligence dissertation topics.

17. How effectively do spotlighting and instruction-hierarchy defences reduce indirect prompt injection in a retrieval-augmented assistant?
Prompt injection heads the OWASP Top 10 for Large Language Model Applications. Building a small retrieval-augmented system on an open-weight model, then testing it against a published injection benchmark such as BIPIA, lets you measure attack success before and after each defence. Level: MSc.

18. Can LLM-generated Sigma rules match analyst-written rules when tested against Atomic Red Team executions in your own lab?
Security teams are experimenting with language models to draft detection logic. Measuring syntax validity, true detections and false alarms for generated versus human rules gives a grounded answer instead of hype. Running Atomic Red Team tests on your own virtual machines keeps the work lawful.

19. A gap analysis of an open-source machine learning pipeline against the 13 principles of ETSI EN 304 223
ETSI’s baseline standard for AI security defines 13 principles and requirements across five phases: secure design, secure development, secure deployment, secure maintenance, and secure end of life. Assessing a real open-source project against each principle is a documentary method that suits undergraduates or Master’s students who prefer analysis to coding.

20. Do problem-space adversarial attacks that respect protocol rules still evade machine learning network intrusion detectors?
Many adversarial papers alter features in ways no real packet could produce. Pierazzi and colleagues (IEEE S&P 2020) formalised the difference between feature-space and problem-space attacks. A PhD could build constraint-aware attacks for network traffic and test whether robustness claims hold.

21. Is membership inference a realistic privacy risk for intrusion detection models trained on an organisation’s own logs?
If a model can reveal whether a specific host’s traffic was in its training data, sharing models between organisations becomes risky. Testing membership inference against detectors trained on public datasets offers a Master’s or early PhD project with clear privacy implications.

Software Supply Chain and Vulnerability Management

22. Which OpenSSF Scorecard checks would have flagged the risk behind the XZ Utils backdoor (CVE-2024-3094), and which could not?
The backdoor arrived through years of social engineering of a maintainer rather than a coding flaw. Scoring the repository at points in its history shows what automated project-health metrics can and cannot see. A strong Master’s case study mixing technical and human evidence.

23. Do Syft and Trivy produce the same SBOM for the same container image, in SPDX and CycloneDX formats?
Software bills of materials are becoming a compliance expectation, yet different tools often list different components. Generating SBOMs for twenty popular images and measuring agreement on packages, versions and licences is achievable in an undergraduate timeframe and produces a clear, useful result.

24. How well do CVSS base scores and EPSS probabilities each predict which CVEs enter CISA’s Known Exploited Vulnerabilities catalogue?
Every input is public: NVD for CVSS, FIRST for historical EPSS scores, CISA for the KEV list. Logistic regression and ROC analysis give a rigorous quantitative Master’s project; the statistical test selector helps confirm your analysis plan. Pitfall: use EPSS scores from the date each CVE was published, not today’s scores, or the result is biased by hindsight.

25. How many connectable consumer products sold in the UK publish the vulnerability reporting contact required under the PSTI regime since April 2024, and how many also publish a security.txt file?
The Product Security and Telecommunications Infrastructure regime requires manufacturers to publish how vulnerabilities can be reported. Auditing manufacturer websites is a document-based method with no testing, so it suits undergraduates who want a UK policy angle with low ethical risk.

Digital Forensics and Incident Response

26. What artefacts do WhatsApp and Signal leave on an Android test handset once disappearing messages are enabled?
Using your own test devices and synthetic conversations, extract images and analyse them with open tools such as ALEAPP and Autopsy. The research value lies in documenting what survives, for how long, and under which settings. Ethics: never use real personal data.

27. How are small digital forensic units meeting ISO/IEC 17025 accreditation under the Forensic Science Regulator’s statutory Code of Practice?
The Code became statutory in October 2023, and accreditation is costly for smaller providers. Interviews with practitioners could examine workload, validation of tools and quality management. Feasibility: access is the main risk, so secure contacts before committing.

28. Which Microsoft 365 audit events are available to investigators by licence tier, and did Microsoft’s 2023 logging expansion after the Storm-0558 intrusion close the gap for smaller tenants?
Incident responders can only investigate what was logged. Comparing documented log coverage across licence tiers, then testing it in a trial tenant, gives a practical Master’s project on cloud forensic readiness.

29. Can Volatility 3 recover evidence of fileless PowerShell execution from memory images taken minutes versus hours after an attack?
Memory evidence decays as the system keeps running. Repeating a benign simulated attack in a virtual machine and capturing memory at fixed intervals produces a measurable decay curve. Suitable for undergraduates with guidance or Master’s students working alone.

IoT, Operational Technology and Vehicle Security

30. How well do unsupervised detectors trained on the SWaT water-treatment dataset cope with process changes that are legitimate rather than malicious?
Industrial anomaly detectors often confuse planned operational changes with attacks. SWaT, released by iTrust at the Singapore University of Technology and Design, is available on request. A PhD or ambitious MSc could propose drift-aware detection for industrial control systems.

31. Can a lightweight CAN bus intrusion detector trained on the HCRL Car-Hacking dataset run within the timing limits of an in-vehicle ECU?
Detection accuracy means little if the model cannot run on automotive hardware. Measuring inference time on an embedded board links the project to UNECE Regulation 155, which requires manufacturers to manage vehicle cyber risk. Suits MSc engineering or computing students.

32. How do smart cameras and plugs placed on the UK market before and after April 2024 compare on default passwords, update periods and disclosure contacts?
This undergraduate topic compares a small sample of devices in a home lab against the baseline requirements introduced by the PSTI regime. Keep all testing to devices you own on an isolated network.

Human Factors and Security Behaviour

33. Does embedded training shown after a simulated phishing click reduce later click rates, given the large-scale field evidence published at IEEE S&P in 2022?
Lain and colleagues’ long-term organisational study reported that embedded training did not make employees more resilient. Replicating or extending this needs an organisation willing to run simulations and strong ethical safeguards, because deceiving staff raises consent issues. Level: MSc or PhD.

34. Which Protection Motivation Theory constructs best predict password-manager use among UK undergraduates?
A survey measuring perceived severity, vulnerability, self-efficacy and response cost, analysed with regression, is a classic undergraduate design. The dissertation sample size calculator helps you plan how many responses you need before launching.

35. How does alert volume shape triage decisions and burnout among analysts in UK security operations centres?
Alert fatigue is widely discussed but rarely studied from the analyst’s side. Interviews with SOC staff, perhaps combined with a short validated burnout measure, suit a Master’s student with qualitative skills and industry contacts.

36. How reliably, and how quickly, do the cross-platform unwanted-tracker alerts on Android and iOS detect a covertly placed Bluetooth tag?
Apple and Google introduced joint alerts against unwanted tracking in 2024. A lab test with your own phones and tags, varying movement and time, measures detection delay without involving participants. The findings matter for people at risk of covert tracking.

Cybercrime and Threat Intelligence

Cybercrime projects with a strong focus on offenders, victims or policing may fit better within criminology dissertation topics; the ideas here stay close to technical evidence.

37. What did Operation Cronos change? Measuring LockBit affiliate activity on ransomware leak sites before and after the February 2024 takedown
Aggregators such as ransomware.live record leak-site postings as metadata. Interrupted time-series analysis can test whether posting volume fell, shifted to other brands, or recovered. Ethics: record metadata only and never download stolen files.

38. How closely do ransomware leak-site postings reflect the UK sectors that report incidents in the ICO’s data security incident trends?
Comparing two imperfect sources, one criminal and one regulatory, reveals reporting gaps by sector. A Master’s student comfortable with secondary data can produce a genuine contribution here.

39. How do UK SMEs judge the usefulness of free threat intelligence such as the NCSC Early Warning service?
Free intelligence only helps if small firms act on it. Interviews or a short survey could explore trust, workload and response, making this a good undergraduate topic.

Cyber Risk, Governance and UK Regulation

These are the most time-sensitive topics on the list. Frame each around the enduring question, and update the status line in your literature review just before submission.

40. How far will bringing managed service providers into the NIS regime reduce supply-chain risk for UK operators of essential services?
The Cyber Security and Resilience Bill was introduced to Parliament on 12 November 2025, cleared all its House of Commons stages and is now before the House of Lords (HL Bill 32), with line-by-line scrutiny in Grand Committee across sittings on 1, 3, 7 and 9 September 2026. It has not received Royal Assent, and much of the detail will come through secondary legislation. A policy analysis using past MSP-borne incidents as cases suits MSc or PhD. Track progress on the UK Parliament Bill page.

41. Would a ban on ransom payments by public bodies and CNI operators push attackers from encryption towards pure data extortion?
The government has confirmed its direction, but as of mid-2026 these measures are formal legislative proposals and statements of government intent, not fully commenced statutory regimes. Economic deterrence theory and evidence from leak sites can support a strong Master’s argument. Present the ban as proposed policy, not settled law.

42. Why does the Cyber Security Breaches Survey 2025/2026 record ransomware among so few businesses while major incidents dominate the headlines?
The latest survey was published on 30 April 2026, and reports of ransomware attacks among businesses fell to 1%, from 3% in each of the two preceding years. The research question is methodological: what does a self-reported telephone survey capture well, and what does it miss? Suits MSc students interested in measurement validity.

43. Does the Gordon-Loeb model justify Cyber Essentials Plus spending for a UK SME with realistic breach-probability estimates?
The Gordon-Loeb model suggests a firm should rarely spend more than about 37% of expected loss on security. Applying it to one or two anonymised SMEs, with sensitivity analysis on the inputs, makes an accessible undergraduate project for students on business-facing cybersecurity courses. The broader organisational angle overlaps with risk management dissertation topics.

44. How ready are UK manufacturers selling connected products into the EU for the Cyber Resilience Act’s 24-hour early warning duty?
Under the EU Cyber Resilience Act, as of 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours of becoming aware and a full notification within 72 hours. UK firms selling into the EU are caught by this. Interviews with product security teams would suit a Master’s student.

Worked Examples: From Cybersecurity Thesis Topics to Aims and Objectives

A topic becomes a proposal once it has one aim and a few connected objectives. Three examples:

Topic 1 (CICIDS2017 labels)
Aim: to measure how corrected labels in CICIDS2017 change the reported performance of flow-based intrusion detection models.
Objectives: retrain random forest and gradient boosting models on the original and corrected versions using a day-based split; compare per-class precision, recall and F1; identify which attack classes show the largest performance shift and explain why.

Topic 24 (CVSS, EPSS and KEV)
Aim: to compare how well CVSS base scores and EPSS probabilities predict inclusion in CISA’s Known Exploited Vulnerabilities catalogue.
Objectives: build a dataset of CVEs with scores recorded at publication date; fit logistic regression models for each score and a combined model; compare predictive performance using ROC curves and precision at fixed alert budgets.

Topic 34 (Protection Motivation Theory)
Aim: to identify which Protection Motivation Theory constructs predict password-manager use among UK undergraduates.
Objectives: adapt validated scales for each construct into an online survey; collect responses from a planned sample; test the constructs as predictors of self-reported use with logistic regression.

The research aims and objectives generator can help you draft similar wording for your own choice, and the research question generator helps turn a headline into a testable question.

Choosing a Method for Your Cybersecurity Research Topic

Method	Suits topics like	Typical evidence	Watch out for
Experimental evaluation on public data	1 to 7, 20, 21, 24	Labelled datasets, benchmarks	Leakage in train/test splits, dataset age
Isolated lab testbed	6, 8, 13 to 15, 26, 29, 31, 32, 36	Your own VMs, devices, cloud account	Containment, written approval, reproducibility
Static or configuration analysis	9, 16, 23, 25	Public code, charts, SBOMs	Tool false positives; verify a sample manually
Interviews and thematic analysis	10, 11, 27, 35, 39, 44	Practitioner accounts	Access, small samples, confidentiality
Surveys	33, 34	Validated scales	Self-report bias, sample size
Documentary and policy analysis	19, 22, 40 to 43	Bills, standards, reports	Status changes before submission
Secondary data and time series	37, 38, 42	Leak-site metadata, official statistics	Reporting bias, handling of criminal data

Legal and Ethical Limits on Testing

Cybersecurity is one of the few subjects where a badly scoped dissertation can create legal risk. The Computer Misuse Act 1990 criminalises unauthorised access regardless of good intentions, and reform is not yet in place. Proposed reforms were outlined alongside the King’s Speech opening a new parliamentary session, but the nature of the rewrite has not been set out. Until legislation passes, assume no research defence exists.

In practice, that means four rules. Test only systems you own or have written permission to test. Keep malware inside isolated virtual machines with no route to the internet. Never download stolen data from leak sites, even for analysis. Finally, get ethics approval before recruiting participants or running phishing simulations, because deception needs particular justification.

Matching Scope to Level

Undergraduate projects succeed when they answer one narrow question with one clear method, such as the SBOM comparison, the DoH classifier or the PSTI website audit. Master’s projects are expected to compare approaches, justify design choices and discuss limitations in depth; our MSc dissertation guidance covers that step up. PhD work must add something new: a method, a formal model or a dataset. Topics 15, 20, 21 and 30 have the most room for original contribution.

Plan your schedule backwards from submission, allowing time for ethics approval and dataset access requests. The dissertation timeline planner helps with this.

Mistakes That Weaken Cybersecurity Dissertation Ideas

The most common mistake is reporting near-perfect accuracy without questioning the dataset. Examiners increasingly know about label errors and data leakage, so a 99% score now invites suspicion rather than praise.

Another is choosing a topic tied to a single product version or news event. A dissertation about one malware family ages fast; a dissertation about how classifiers decay as malware evolves does not.

Students also write questions that cannot be answered, such as “How can organisations improve cybersecurity?” Our guide on how to write a research question shows how to narrow this into something measurable. Finally, many leave access requests too late: AndroZoo, SWaT and organisational interviews can all take weeks.

Frequently Asked Questions

Can I do a cybersecurity dissertation without strong programming skills?

Yes. Topics 10, 11, 19, 25, 27, 35 and 39 to 44 rely on interviews, surveys, document analysis or policy argument. These are legitimate cybersecurity dissertation topics, provided the method is rigorous and the question is specific.

Are CICIDS2017 and UNSW-NB15 too old to use?

They are still acceptable if you acknowledge their limitations or make those limitations your research question, as topics 1 and 2 do. Using them uncritically as your only evidence is the weaker choice.

Is post-quantum cryptography too mathematical for a Master’s project?

Not necessarily. Benchmarking and migration topics (12 to 14) need systems and measurement skills rather than new mathematics. Designing new schemes is PhD territory.

If you are still weighing two or three directions, the dissertation topic finder can help you compare them, and once one stands out, research proposal writing support is available to help shape it into a proposal your supervisor can approve.