How to Build a CTI Portfolio Project That Demonstrates Real Skill
Create a lawful, reproducible project that begins with a decision, shows evidence and uncertainty, and ends with a useful intelligence product.
A portfolio should let a reviewer inspect how you think. Choose a narrow question with a named consumer and decision, use lawful sources, preserve provenance, explain uncertainty, and deliver an answer in the format that consumer would use. A decorative dashboard without an intelligence requirement reveals less than a careful two-page assessment.
Choose a Safe
Examples include comparing vulnerability priorities for a fictional environment, reconstructing a public campaign timeline, evaluating a claim, or converting published behavior into detection ideas. Set a cut-off date and avoid interacting with targets, criminals, or systems you do not own.
Write your collection plan before gathering evidence.
Publish the Reasoning Trail
Include requirement, source table, key judgments, confidence, alternatives, gaps, visuals, recommendations, and what would change the view. Provide code or data transformations only when safe and reproducible. Credit sources and explain corrections.
Redact personal data and remove active harmful material.
Add Reflection and Independent Review
Ask another person to challenge the evidence and usability. Record what you changed, what you would collect with more access, and where the method could fail. Make navigation and a short summary easy.
Use the first CTI job roadmap to match projects to target roles. A portfolio is evidence of judgment, not a claim of perfection.
Frequently asked questions
Must a portfolio use live malicious data?
No. Public advisories, historical cases, synthetic data, and safe datasets can demonstrate the full method.
Is an actor profile a good project?
Yes if it answers a defined decision and shows evidence, alias uncertainty, relevance, and update limits rather than copying summaries.
Must a CTI portfolio include code?
Only for roles where automation or data work matters; clear reasoning and writing remain essential.
Can work products from an employer be included?
Not without explicit permission. Recreate a safe independent example instead of exposing confidential material.
How many projects are enough?
Two or three strong, distinct projects are usually more persuasive than many shallow items.
