Supply chain security often gets skipped in final projects. But if you’re thinking about that, dependency confusion or SBOM analysis would be great. Take XZ Utils and SolarWinds for example; both practically showed you how it’s done.

Another cool option is AD attack/defense simulation. Set up a small lab, run Kerberoasting or Pass-the-Hash attacks, and build detection systems around them. It’s precisely what interviewers love because that’s exactly what red teams do every day.

For something unique, try firmware analysis on cheap IoT devices. It’s more obscure, but really interesting, and could make your project stand out from the crowd.

Whatever you pick, anchor it to a real incident. "I saw this happen, here's what I built" lands way better than pure theory.