Cybersecurity is about creativity. Not in the way an artist paints or a graphic designer illustrates. Rather, it rewards resourceful designs and solutions to the complex problems that we face constantly.

Most projects I come across focus on much of the same thing: Wireshark packet analysis, Hack The Box challenges, and many projects that are some version of these two. It is important for newcomers and juniors in the field to inject creativity into their portfolio to stand out.

Try building a hybrid environment or maybe a 'malicious script', then inject it into a file that you can test in phishing emails. The goal here is not to learn how to be a malicious actor, but to understand how their actions try to manipulate your environment. Your lab is for experimenting, so be curious and do just that.

Never execute malicious scripts or send phishing emails outside your environment, even if it's only for testing.

There are loads of free and cheap resources that can help you build some impressive portfolio projects to woo recruiters, impress yourself, and support your growth. Here are some recommendations for you.

VirtualBox

VirtualBox is one of the best ways to build a home lab from scratch without spending any money. Once you install it, you can download free Linux distributions (Ubuntu, Kali, etc.) and free Windows evaluation ISOs from Microsoft's Evaluation Center. You can use these to create a full environment that mimics a small company. It’s a great way to learn Active Directory, Group Policy, patching, server roles, and firewalls.

You can build a virtual environment with multiple VMs, as long as your computer allows it. I usually run about three VMs and a pfSense firewall on 32 GB of RAM. Try your hand at creating a domain controller (DC), adding your client VMs to the domain, then creating group policies, and enforcing them to see whether the settings are being accepted by the client machines.

If you set up a Kali Linux machine, there is an OpenVAS (GVM) package you can install for vulnerability scanning against your VMs. Once installed, you can configure targets and scan configs for your different VMs before running your first scan. The tool generates full scan reports for you to analyze, so you can prioritize remediation.

pfSense

pfSense is a free, open source firewall that you can deploy right inside VirtualBox as one of your VMs. Configuring pfSense will give you a solid foundation in firewall management that transfers to many enterprise firewalls. You can build projects that segment your lab network, write and test firewall rules, and run IDS and IPS. Once you open the pfSense web interface, it will become evident how much you can do in there.

If you need a project to start with, here's one: segment your lab network so the domain controller sits on its own segment, separate from the client machines. You can write rules that allow only the traffic needed for the client to reach the DC: DNS, SMB, Kerberos, LDAP, and RPC. Test what happens if you block SMB traffic on the DC segment, then try accessing a shared resource that is hosted on the DC from a client machine. You should find that domain logon still works, but the file share will fail.

Microsoft 365

This is the one recommendation that is not permanently free, but a single license is enough to practice real identity work, and if it falls outside of your budget then the free trial option is still available.

A Microsoft 365 tenant is one of the cheapest ways to practice identity work. The Business Premium subscription tier includes Entra ID P1, which allows you to create Conditional Access policies, and with the free trial you get 25 licenses to start out with. Intune is also included in this tier. It gives you the opportunity to explore device management, which can also be used for access management projects. Keep in mind, once the trial ends, your subscription will be converted to a paid one. If you don't wish to maintain a paid subscription, cancel it before the renewal date.

With this setup you can create some test users and build Conditional Access policies that govern access to resources. One Conditional Access policy to start with is requiring MFA for a group. Sign in with one of the user accounts, register MFA, and complete the sign-in. Then sign in again, enter the password, but this time abandon the attempt when MFA comes up. Compare the two entries in the sign-in logs and report on the difference.

Build What You Can

You don’t need a large budget to start building your cybersecurity portfolio. You can simulate your own environment with VirtualBox, set up network segmentation in a pfSense firewall, and create Conditional Access policies in Microsoft 365.

Always start with what you have, build what you can, and remember to document your full setup journey, including successes and failures. Both can go a long way in your portfolio.