FINAL YEAR IMPACT PROJECTS 2026-2027

Work with an industry client on your final year project

Apply your skills to a real-world cyber and digital resilience brief set by CSE Connect, delivered through your honours project.

Applications close at 23:59 on 16 October 2026. The project runs from 26 October 2026 to 31 March 2027.

Apply now

You are seeing a simplified version of this page because part of it could not load, most often because a network or browser extension is blocking unpkg.com. Try another network or browser to see the full page. Questions to hello@cseconnect.org.

Work with an industry client on your final year project

Complete an industry-defined digital and cyber resilience project based on a brief set by CSE Connect (the industry client). Your project remains subject to your university’s normal supervision and assessment processes. You will have a traditional academic supervisor while also working closely with industry practitioners and project stakeholders.

2026 PROJECT THEME

Practical cyber and digital resilience for small businesses

Apply now Explore the projects

APPLICATIONS CLOSE IN {{ cdDays }}d {{ cdHours }}h {{ cdMins }}m {{ cdSecs }}s

Why we are focusing on SMEs

THE REALITY

Consider a games studio of six people with a live game in active development. Their business relies on a code repository, a bi-weekly build pipeline, cloud accounting, a community forum, and a shared drive of design documents.

One full-time developer manages all hardware and servers, holding an unofficial responsibility for cyber security on top of their main role.

THE REGULATION

A large corporation facing identical risks maintains dedicated security teams, budgets, and supplier contracts. Yet a small studio owes the same legal duty to protect its players’ data. Data protection laws attach obligations strictly to the data an organisation holds, rather than the number of people it employs.

THE SME CHALLENGE

5.5 million small businesses and micro-organisations operating across the UK, according to the National Cyber Security Centre.^[1]

Equal target small businesses are just as likely to be attacked or fall victim to online crime as larger, enterprise-level organisations.^[1]

The real gap free security guidance exists, but the true difficulty lies in the time, money, and specialist knowledge required to act on it.^[1]

The eight project themes will explore this challenge.

How grading works

Your university awards your grade against its own assessment criteria, and taking part does not guarantee a particular result.

These are deliberately challenging projects that provide opportunities to build technical and professional skills in a real-world context. The project gives you considerable freedom to identify specific areas of personal interest and showcase your abilities.

Previous cohorts have developed valuable skills in critical thinking, communication, teamwork and time management while expanding their professional networks. These experiences have helped students produce high-quality honours projects.

DEADLINE

16 October 2026

Friday, 23:59 BST

PROJECT STARTS

26 October 2026

Runs to 31 March 2027, across both terms of your final year.

LAST YEAR

First class

awarded to 8 out of 11 students with the lowest award being a 2:1.

How an Impact Project works

Your Impact Project is your honours project, completed as part of the degree you are already doing. It gives you the chance to work on a real world challenge for a client.

Start with a real-world brief

Explore the eight project themes below. Each one comes from a problem CSE Connect has faced in building and running software for its own clients. The National Cyber Security Centre is a stakeholder during the project. Choose the one that interests you most and apply.

Join the kickoff session

Meet the CSE Connect team, learn more about the project and get the opportunity to ask questions before you get started.

Get started

CSE Connect is your client. You’ll get the brief, tools and systems you need, with support from our team and people working in the field. Students from universities across the UK take part, so you’ll be part of a national community while delivering your own individual project.

Develop your solution

Apply your AI, cyber and software engineering skills to your real-world brief, and work on your project throughout the year. You’ll have support from CSE Connect and your university supervisor, with regular check-ins from us to help you stay on track.

Submit your work to your university

Your university has its own deadlines and will assess your project against its own criteria, as it normally would. Deadlines are usually in April or May 2027, depending on your university.

Present your work to CSE Connect

At the end of the project, present your work back to your client, following the same process you would on a professional project.

THE 2025 COHORT

Students from five universities across the UK took part in 2025.

2026 PROJECT THEME

Practical cyber and digital resilience for small and medium-sized enterprises

Cyber resilience is not just about preventing attacks. It is the full cycle of preparing for, detecting, responding to, recovering from and learning from disruption, so a business can keep operating when things go wrong.^[3]

Each of this year’s eight project themes tackles a real challenge facing UK SMEs, mapped to one of these five domains.

Resilience

Anticipating
what could go wrong

Detecting
when something has happened

Responding
to an incident

Restoring
the business to working order

Confirming
the remedy has been applied and continues to hold

Anticipating

what could go wrong

Detecting

when something has happened

Responding

to an incident

Restoring

the business to working order

Confirming

the remedy has been applied and continues to hold

The eight project themes

All eight sit under this year’s theme: practical cyber and digital resilience for small and medium-sized enterprises, or SMEs. Each theme forms the basis of a final year project carried out for a client.

Select one of eight project themes. Some are heavily technical, others put more weight on analysis, design and communication.

ANTICIPATE

Agentic AI penetration testing for resilience^[4]^[5]

ANTICIPATE

You build, monitor and analyse agents used to evaluate authorised sandboxed assets through multi-step security testing, while also examining the controls that govern and restrict their operation.^[7]^[8]

ANTICIPATE

Automated scanning and triage with OWASP ZAP

ANTICIPATE

You build a pipeline that runs the scanner on a schedule and uses a model to triage the results. The pipeline removes duplicates and false positives, and ranks what remains by the cost to the studio of leaving each one unfixed.^[6]

DETECT

Service monitoring, alerting and notification

DETECT

You build the monitoring that watches the services the studio depends on, the alert that reaches the person able to act on it, and the notification that goes to players.

RESPOND

Automated incident response workflows

RESPOND

You build an automated runbook that handles one class of incident, from the first alert through to the service being restored. You then measure recovery time with the runbook and without it.^[3]

ANTICIPATE

Surfacing and reducing risks in single-maintainer software projects^[6]

ANTICIPATE

You build the automation that carries the maintenance and support load of a one-person software project, from verifying and applying updates to triaging what the client sends in, and the controls that bound it.^[6]

RESTORE

Supply chain mapping and recovery priorities

RESTORE

You build an application that records which suppliers and services a small organisation depends on, and what stops working when any one of them becomes unavailable. It turns that map into an ordered recovery list.^[3]

CONFIRM

SME resilience self-assessment and investment case

CONFIRM

You build a self-assessment that an owner completes without professional help, producing a prioritised risk register and an investment case that sets the cost of each recommended control against the loss it is meant to avoid.^[1]

RESPOND

Incident communication and rehearsal

RESPOND

You build a self-running exercise that a small organisation can complete without a facilitator, together with the communication pack it tests, covering who decides, who is told, in what order, and what is said.^[2]

Found a project? Apply here.

Tell us what interests you and why you want to take part. Applications close at 23:59 on 16 October 2026.

Apply now

BENEFITS

How this experience will benefit you

Your final year project happens either way. This is about what you have at the end of it.

Build something you can show employers.

Deliver an artefact or deploy a solution that addresses a real-world use case, with your work held in a repository you can use to demonstrate what you’ve done.

Work to an industry brief.

Work on a challenge set by CSE Connect, and develop and explain your decisions directly to stakeholders, including the National Cyber Security Centre.

Share your work with a wider audience.

Present your completed project to an audience that includes people from government, industry and academia.

Network and learn with students across the UK.

Join a networked community of students at universities across the UK, developing your teamworking and communication skills along the way.

Build experiences you can talk about.

Develop authentic STARR stories, covering situation, task, action, result and reflection, that you can use to talk confidently about work-aligned experience beyond your degree.

SUPPORT

KICKOFF AND CHECK-INS

The year opens with a kickoff session and you'll have regular touch points throughout, so there is always someone to ask.

How you will be supported

You are not expected to arrive knowing how to do any of this.

You’ll be supported throughout the project

The project opens with a kickoff session to introduce the work, explain what’s involved and give you the opportunity to see what previous students produced for last year’s projects. There will also be regular check-ins throughout the year to help you stay on track and give you opportunities to raise questions as your project develops.

You’ll have access to practitioners throughout the year

Practitioners working in the field join at intervals during the project, giving you opportunities to ask questions, test your thinking and learn from people working in the area.

The systems you work with are provided for you

The systems you test against are authorised, built and provided for you, so you can focus on working through the project rather than having to source or set up the systems yourself.

You don’t need to be an expert to get started

You’re not expected to have prior knowledge or expertise in the resilience domain. You’ll learn about the area as you work through your project.

NEXT STEP

Apply Now

If you are a final year university student who:

• wants to work on a real world challenge

• is reliable and willing to take ownership

• is curious and keen to learn new subjects and skills

You do not need to be an expert in the subject of the project you choose.

APPLY

Applications close at 23:59 on 16 October 2026.

The project starts on 26 October 2026.

Apply now

Questions? Email innovate@cseconnect.org

REFERENCES

[1] National Cyber Security Centre, "Cyber Action Toolkit: breaking down the barriers to resilience," 11 Nov. 2025.
https://www.ncsc.gov.uk/blog-post/cat-breaking-down-resilience-barriers

[2] National Cyber Security Centre, "Exercise in a Box."
https://www.ncsc.gov.uk/section/exercise-in-a-box/overview

[3] National Cyber Security Centre, "When cyber attacks happen: helping organisations recover," 28 Jul. 2026.
https://www.ncsc.gov.uk/blogs/when-cyber-attacks-happen-helping-organisations-recover

[4] P. Haigh and Harry G, National Cyber Security Centre, "Cyber Shield: The path to an agentic AI future for cyber defence," 7 Jul. 2026.
https://www.ncsc.gov.uk/blogs/cyber-shield-the-path-to-an-agentic-ai-future-for-cyber-defence

[5] National Cyber Security Centre, "Thinking carefully before adopting agentic AI," 15 May 2026.
https://www.ncsc.gov.uk/blogs/thinking-carefully-before-adopting-agentic-ai

[6] O. Whitehouse, National Cyber Security Centre, "Preparing for a 'vulnerability patch wave'," 1 May 2026.
https://www.ncsc.gov.uk/blogs/prepare-for-vulnerability-patch-wave

[7] National Cyber Security Centre, "Retaining defensive advantage in the age of frontier AI cyber capabilities," 15 Apr. 2026.
https://www.ncsc.gov.uk/blogs/retaining-defensive-advantage-in-the-age-of-frontier-ai-cyber-capabilities

[8] Toby W, National Cyber Security Centre, "Managing the cyber risk of agentic AI," 20 Aug. 2026.
https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai

CSE Connect Final Year Impact Projects for 2026-2027. Questions to innovate@cseconnect.org.