🇳🇱 This minor is taught in Dutch only. This English version explains the programme for international readers and partners — the course itself runs entirely in Dutch.
Avans HogeschoolSecure by DesignMinor · Avans
Secure by Design · Phase 2 · plate

The Professional Profile

Phase 1 brought everyone to one shared foundation. In phase 2 you step off at a station and go deep: you pick one or more cybersecurity topics, carry out practical research on them for a fictional client, and deliver a prototype or report. The real company project also starts in week 5. Week 10 is an interim review; your profile and portfolio continue developing towards the workshops in week 19.

phase 2 · weeks 5–10free choice of topic1 or more topicspractical researchprototype or reportfictional clientinterim review week 10 · workshops week 19tech & non-tech

01 The assignment

You are free in your choice, but these boundaries apply to everyone — tech and non-tech alike.

K1Free choice

Pick one topic or combine a few. Inventing your own topic is allowed, as long as it fits within cybersecurity and the Secure-by-Design mindset.

K2Practical research

It's about doing: not just reading, but researching, testing, building or validating. A demonstrable practical core is required.

K3Prototype or report

Your deliverable is a working prototype, or a well-founded report/advice. What fits your topic and your angle is up to you.

K4Fictional client

Aim your work at a fictional client with a real problem. That forces scope, relevance and professional communication.

K5Interim review & knowledge transfer

Week 10 reviews your initial result and portfolio. Continue developing towards an active workshop with related profiles in week 19. Strong work may also receive a keynote slot.

K6Tech and non-tech

Every topic can be approached technically (building) or organisationally/research-wise. Choose the angle that suits you.

02 Choose your deep dive

Inspiration, not a menu to pick-and-be-done with: feel free to combine, or come up with your own topic. The topics hang under the same stations as in phase 1. Click a topic for a build angle and a research angle plus a possible client.

Show
S1

Product & baseline security

About
Securing devices with limited computing power (ESP32/RP2040): communication, updates, storage.
build
Prototype with encrypted communication, a secure boot concept and signed OTA updates.
research
Research into the biggest IoT risks + design guideline for a product line.
Client
Hardware startup launching a smart device.
About
Not the maths, but correct application: key management, secrets, certificates, common mistakes.
build
Set up secrets management in an application + demonstrate wrong vs. right.
research
Policy and guideline for key and certificate management in an organisation.
Client
Scale-up that grew fast and has no secrets policy.
About
How to design defaults, configuration and user flows so that secure is the easy path.
build
Redesign an insecure flow into a working prototype.
research
Design guidelines + review checklist for a product team.
Client
SaaS company with complaints about insecure default settings.
S2

Mindset, culture & awareness

About
Designing a campaign that really sticks: audiences, message, channels, measuring impact.
build
Build an interactive training module or microlearning.
research
Campaign plan with audience analysis, materials and a measurement setup.
Client
Organisation after a data breach caused by human action.
About
The setup and ethics of phishing simulations and the follow-up training.
build
Your own (ethical) simulation setup + landing page and measurement dashboard.
research
Playbook + ethical framework + training approach for HR/IT.
Client
Educational institution that wants to make staff more resilient.
About
Mapping culture and improving it on purpose: measurement instruments, interventions, resistance.
build
Dashboard/survey tool to track culture indicators.
research
Baseline measurement + intervention plan based on a culture model.
Client
SME that mostly sees 'security' as an IT party trick.
S3

Hacker mindset & offensive

About
Finding vulnerabilities in a (own or test) application in a structured way, within clear boundaries.
build
Pentest on a test environment + reproducible exploits and fixes.
research
Methodical test report with findings, risks and recommendations.
Client
Web agency that wants assurance about a new application.
About
Using open sources to map the exposure of an organisation or product.
build
Tooling/script that gathers and summarises public information.
research
OSINT report on the digital footprint + reduction advice.
Client
Company that wants to know what attackers already know about them.
About
How manipulation works and how to defend against it — strictly ethical and with consent.
build
Controlled test setup (e.g. a vishing script) with a measurable outcome.
research
Analysis of techniques + resilience advice and behavioural rules.
Client
Reception/service-desk organisation that gets called a lot.
S4

Governance, compliance & supply chain

About
What an organisation must arrange to comply with NIS2 and actually become more secure.
build
Self-assessment tool that scores NIS2 readiness.
research
Gap analysis + prioritised roadmap towards compliance.
Client
Healthcare or utility organisation newly in scope of NIS2.
About
Data protection from the design onward: data minimisation, legal bases, DPIA thinking.
build
Prototype that implements data minimisation and consent properly.
research
DPIA-light + privacy-by-design guideline for a product.
Client
App builder processing minors' personal data.
About
The core of a management system: policy, risks, controls, improvement cycle.
build
Simple register/tool for risks and controls.
research
Concise ISMS starter kit: policy, risk analysis, control set.
Client
Growing company that needs to offer clients ISO assurance.
About
Controlling dependencies on software, suppliers and services; SBOM in practice.
build
Pipeline that automatically generates an SBOM and reports vulnerabilities.
research
Supplier risk policy + process for dependency management.
Client
Company that uses a lot of third-party open source and SaaS.
About
What the Cyber Resilience Act requires of digital products and how you demonstrate it.
build
Conformity checklist tool linked to product characteristics.
research
Conformity analysis + step-by-step plan towards CRA compliance.
Client
Manufacturer of a product with digital components.
S5

Threat modelling, detection & blue team

About
Modelling a system for threats and determining how you would detect attacks.
build
Work out a threat model and build matching detection rules.
research
Threat model report + monitoring/detection advice.
Client
Fintech startup with a new payment integration.
About
Setting up central logging and detection with open-source tooling (e.g. Wazuh/ELK).
build
Working SIEM setup with dashboards and a few use cases.
research
Logging strategy + use-case catalogue for a SOC.
Client
Hosting company that wants to spot attacks sooner.
About
Luring attackers into a decoy environment and analysing their behaviour.
build
Set up a honeypot, collect attack data and visualise it.
research
Analysis of observed attack patterns + defence advice.
Client
Research lab that wants to monitor current threats.
About
How a Security Operations team works: roles, triage, escalation, playbooks.
build
Tooling/template for alert triage and playbook execution.
research
SOC setup plan with processes, roles and playbooks.
Client
Organisation that wants to professionalise detection.
S6

Architecture & requirements

About
Basing access on continuous verification instead of a secure inside.
build
Reference setup with identity-based access.
research
Zero-trust migration plan + principles for a network.
Client
Company that no longer has a 'safe office network' after remote working.
About
Designing and managing identities, roles and permissions across systems.
build
Prototype with role-based access and SSO/MFA.
research
IAM design + roles/permissions model and governance.
Client
Organisation where former employees turn out to still have access.
About
Securing APIs: authentication, authorisation, rate limiting, abuse resistance.
build
Build a secured API + show how an insecure variant breaks.
research
API security guideline + review checklist for developers.
Client
Platform that opens up its API to partners.
S7

SDLC, DevSecOps & CI/CD

About
Automating security controls along the path from code to production.
build
Pipeline with security gates that stop insecure builds.
research
Adoption plan + measurable gates for a DevOps team.
Client
Scale-up that wants to keep releasing fast and securely.
About
Setting up static, dynamic and dependency scanning and taming the noise.
build
Integrated scanning with triaged, actionable output.
research
Tooling choice + process to follow up on findings.
Client
Team drowning in security alerts.
About
Preventing misconfigurations in cloud/infra code and testing them automatically.
build
IaC with policy-as-code that blocks insecure configurations.
research
Hardening baseline + review process for infra code.
Client
Company that rolls out its cloud entirely via code.
S8

Testing, pentest & incident response

About
Testing an application or environment in a structured way and reporting professionally.
build
Carry out a pentest on a test target + reproducible findings.
research
Full pentest report with risks, evidence and advice.
Client
Company having a security test done for the first time.
About
Drawing up a response plan and testing it via a tabletop exercise.
build
Tooling/checklist that guides the team through an incident.
research
IR plan + worked-out tabletop with evaluation.
Client
SME without any playbook for a ransomware attack.
About
Securing and analysing traces after a (simulated) incident.
build
Investigation on a prepared image + a well-founded timeline.
research
Forensic report + chain-of-custody procedure.
Client
Organisation that wants to know how an attacker got in.
About
How to properly handle vulnerability reports from third parties.
build
Working report page + internal handling-workflow prototype.
research
Disclosure policy + internal procedure and SLAs.
Client
Company that increasingly gets 'we found a vulnerability' emails.
SO

Current & other themes

About
Risks of AI systems (prompt injection, data leaks, model abuse) and AI as a defence.
build
Prototype that demonstrably abuses an AI application and mitigates it.
research
Risk analysis + guideline for safe use of AI tools.
Client
Company hastily putting an AI chatbot on customer data.
About
Configuring cloud environments securely and testing them continuously.
build
Posture scan + hardening of a test environment.
research
Cloud baseline + control plan for a team.
Client
Company with a fast-grown, messy cloud.
About
Securing industrial systems, where safety and availability come first.
build
Test setup/simulation of an industrial protocol.
research
Risk analysis + segmentation advice for a production environment.
Client
Manufacturer with old, connected machines.
About
What the arrival of quantum computers means for current cryptography.
build
Comparative test of post-quantum algorithms in a demo.
research
Migration impact analysis + advice for the coming years.
Client
Organisation with data that must stay confidential 10 years from now.
About
Synthetic media as a threat and how organisations arm themselves.
build
Detection demo or awareness tool around fake media.
research
Resilience analysis + protocol against CEO fraud/deepfakes.
Client
Organisation with public spokespeople and payment authority.

03 Two example routes

Two worked-out approaches to give direction — one build-focused, one research-focused.

Same backbone — both routes follow the same steps: topic → client → research question → practical research → deliverable → portfolio → presentation. Use that order as a template for your own route.
Example route A · building

Secure smart doorbell

Topic(s)
Secure IoT/embedded devices + Cryptography in practice (S1)
Fictional client
Hardware startup 'BelVeilig' wanting to launch a smart video doorbell.
Research question
How do you design the doorbell's firmware and communication secure-by-design, within the limits of cheap hardware?
Practical research
Threat model on the device and the data flows; comparison of crypto libraries on an ESP32; measuring the performance impact of encryption.
Deliverable
Working prototype: encrypted communication, signed OTA updates and a secure-boot concept, with technical justification.
Portfolio
Threat model, design decisions with trade-offs, test results, source code and reflection.
Final presentation
Live demo for the 'client' explaining the key trade-offs and residual risks.
Example route B · research

Making a healthcare organisation NIS2-ready

Topic(s)
NIS2 readiness assessment + Security awareness campaign (S4 + S2)
Fictional client
Mid-sized home-care organisation 'ThuisZorg Brabant' newly in scope of NIS2.
Research question
What must the organisation arrange to comply with NIS2 and genuinely become more secure, and how do you get the staff on board?
Practical research
Gap analysis against the NIS2 obligations; risk assessment of core processes; (fictional) personas and interviews; benchmark of awareness approaches.
Deliverable
Advisory report with a prioritised roadmap, plus a worked-out awareness campaign concept with sample material.
Portfolio
Gap analysis, risk matrix, roadmap, campaign plan, substantiation with sources and reflection.
Final presentation
Executive advice to the 'board' with clear choices and a cost/benefit consideration.

04 Learning programme · weeks 5–10

Your profile and real company project start together in week 5. Nine 1.5-hour timetable blocks per week shift from shared teaching towards application, with regular depth and feedback. Workshops are supported working time, not nine classroom lessons.

Timetable allocation · 1.5-hour blocks
ActivityWeek 5Week 6Week 7Week 8Week 9Week 10
Lessons & clinics332211
Profile workshop323222
Company project233455
Feedback & knowledge sharing111111
Total999999
  • From week 6, clinics follow profile choices. Working sessions have specific tasks and agreed tutor availability.
  • Protect the weekly feedback block: show visible work and discuss profile and project. From week 7, practise short explanations or a mini-workshop.
  • Week 10 is an interim review, not profile completion. Continue development and your portfolio through the project, focused study and the week 19 workshop.
  • The company assignment and individual profile question remain identifiable but can inform each other. Block allocations can shift if an intake is delayed.
Continue the project · weeks 11–19 →Profile workshops at the final event →
Week 5

Explore

Profile + company project
Block 1–3
Specialisation & intake preparation
Lessons & clinics
Core
Explore topics, scope an initial question and practise an intake.
Activity
Compare research angles and practise probing a client request.
Output
Two possible profile topics and intake questions.
Block 4–6
First experiment
Profile workshop
Core
Compare topics through a small practical investigation.
Activity
Run a small experiment and record what you want to learn.
Output
Initial findings and personal learning goals.
Block 7–8
Team & assignment
Company project
Core
Start the real company project alongside your profile.
Activity
Form a team, read the brief and prepare first client contact.
Output
Team agreements, initial brief and intake schedule.
Block 9
Visible progress
Feedback & knowledge sharing
Core
Make your initial choices discussable.
Activity
Show your experiment and questions to peers and your tutor.
Output
Feedback and specific next actions.
Week 6

Choose

Profile + company project
Block 1–3
Topic clinic & research design
Lessons & clinics
Core
Choose a specialisation and a suitable method.
Activity
Justify your choice, scope and success criteria; attend a relevant clinic.
Output
Research question, method and success criteria.
Block 4–5
Set up profile research
Profile workshop
Core
Make your individual investigation feasible.
Activity
Design an experiment or research plan with sources and resources.
Output
Profile research plan.
Block 6–8
Intake & problem understanding
Company project
Core
Understand the business and the underlying problem.
Activity
Conduct the intake; record stakeholders, scope, authorisation and data agreements before execution.
Output
Problem understanding, mandate and client agreements.
Block 9
Review choices
Feedback & knowledge sharing
Core
Discuss your profile choice and the client problem.
Activity
Show your plan and intake findings; separate facts, assumptions and open questions.
Output
Updated plans and follow-up client questions.
Week 7

Investigate

Profile + company project
Block 1–2
Topic clinic & evidence
Lessons & clinics
Core
Deepen your topic and assess evidence quality.
Activity
Attend a relevant clinic and compare sources or methods.
Output
Justified research choices.
Block 3–5
First research iteration
Profile workshop
Core
Conduct your profile research.
Activity
Collect and analyse initial data or build an experiment; record a reproducible method.
Output
Initial findings with evidence.
Block 6–8
Approach & initial project research
Company project
Core
Develop the project approach and begin within agreed scope.
Activity
Specify questions, methods, roles and schedule; conduct an initial investigation.
Output
Draft project plan and initial evidence.
Block 9
Share an insight
Feedback & knowledge sharing
Core
Practise knowledge transfer towards week 19.
Activity
Explain an insight or lead a mini-exercise in five minutes; discuss project progress.
Output
Peer feedback on content and explanation, plus actions.
Week 8

Try & test

Profile + company project
Block 1–2
Depth & validation
Lessons & clinics
Core
Design a check for your own result.
Activity
Use workshop questions to shape a clinic and create a validation plan.
Output
Validation plan with testable criteria.
Block 3–4
Test profile results
Profile workshop
Core
Check whether your initial result holds up.
Activity
Run a test, discuss limitations and adjust your research.
Output
Test findings and revised research plan.
Block 5–8
Try a direction with the client
Company project
Core
Check the value of your approach.
Activity
Discuss findings and try a direction; update scope and plan using feedback.
Output
Client feedback and a supported next direction.
Block 9
Review & mini-exercise
Feedback & knowledge sharing
Core
Learn from each other’s tests and explanations.
Activity
Show a result and have a peer complete a short exercise.
Output
Improvements for research, project and knowledge transfer.
Week 9

Connect

Profile + company project
Block 1
Clinic on a shared obstacle
Lessons & clinics
Core
Deepen an issue affecting multiple students.
Activity
Bring questions and work with related profiles on a common obstacle.
Output
A useful insight or method for the next step.
Block 2–3
Expertise for your team
Profile workshop
Core
Investigate an open question and make insights useful.
Activity
Develop a tool, guideline or demonstration from relevant profile insights.
Output
Profile evidence and an applicable knowledge contribution.
Block 4–8
Research & develop
Company project
Core
Continue the company assignment with justified choices.
Activity
Investigate, develop or test; connect profile knowledge to project decisions where relevant.
Output
Project results with justified choices.
Block 9
Share & adjust
Feedback & knowledge sharing
Core
Check whether others can use your expertise.
Activity
Have peers try your contribution and discuss project decisions with your tutor.
Output
Usability feedback and revised actions.
Week 10

Take stock

Profile + company project
Block 1
Conclusions & limitations
Lessons & clinics
Core
Draw conclusions supported by evidence.
Activity
Practise explaining results, uncertainty and limitations.
Output
Supported conclusions without overclaiming.
Block 2–3
Profile interim review
Profile workshop
Core
Record your first research result; the profile continues.
Activity
Show your research, reflect on learning goals and plan further development towards week 19.
Output
Interim portfolio and profile/workshop development plan.
Block 4–8
Project progress review
Company project
Core
Prepare the transition to four project days.
Activity
Review early results and client feedback; plan the next period and prepare Business Understanding.
Output
Project progress record, updated plan and presentation material.
Block 9
Feedback & next steps
Feedback & knowledge sharing
Core
Make the next step specific for profile and project.
Activity
Discuss visible work, research questions and planning with peers and your tutor.
Output
Follow-up agreements and potential workshop groupings.

05 From choice to interim review and knowledge transfer

Your portfolio develops with your work: initial results in week 10, further specialisation and knowledge transfer towards week 19.

Choose & explore

Pick one or more topics that genuinely draw you in.

Scope & client

Choose a fictional client and demarcate the problem.

Research question

Formulate a sharp, practical question you can answer.

Practical research

Build a prototype or do focused research — deliver evidence.

Portfolio

Record context, choices, process and results.

Interim review → knowledge transfer

Week 10: show your initial result and next steps. Continue developing and share your expertise in a profile workshop at the final event in week 19.

In your portfolio

  • Problem & context — who the client is and why this topic
  • Research question & scope — what exactly you investigate, and what not
  • Approach & method — how you went about it
  • The work — the prototype or report itself
  • Substantiation & sources — choices justified with reliable sources
  • Testing & validation — how you know it works / is correct
  • Reflection & next steps — what you learned, what you would do differently

What is assessed

  • Depth — how far you went into the topic
  • Practical research — quality and relevance of what you did or built
  • Secure-by-design thinking — do you visibly apply the phase 1 foundation
  • Substantiation — are choices argued and source-backed
  • Professional communication — does your story land with the client
  • Reflection — do you look critically at your own work and process
Phase 2 plate — Professional Profile · a sequel to the Secure-by-Design foundation.Click a topic for angles · filter by building / research.
Minor Secure by Design · Avans University of Applied Sciences — security as a design quality.Contact · Partners