CYBER 440: Cybersecurity Analytics and Operations Capstone

About the course

CYBER 440 is the capstone for Penn State's Cybersecurity Analytics and Operations major — the course every student in the program takes last. It pulls together what they have learned across cyber technology, analytic methods and security management, and asks them to use all of it at once on a single hard problem.

Students are given a complex cybersecurity incident and several different sources of data about it, at realistic volumes and realistic signal-to-noise ratios. They work in teams to analyze the incident using an analytic framework drawn from industry practice, document what they found, decide how they would respond, and then brief two very different audiences: fellow technologists, and executives who need a decision rather than a packet capture.

Prerequisites are CYBER 342W, ENGL 202C or D, and seventh-semester standing.

What students should be able to do by the end

• Conduct a thorough analysis of cybersecurity data drawn from several different sources.
• Document specific technical findings once that analysis is complete.
• Work as a team on a multi-sourced analysis of a complex incident, at realistic data volumes.
• Present their team's findings in a form suited to a senior corporate audience — a CISO, CIO, or other decision-maker.

My role

I am one of the teaching assistants, working with Dr. Giacobe for the Fall 2026 semester. The responsibilities I agreed with him fall into a few groups.

• Coaching. Helping students with individual in-class work, explaining assignments when the task is not clear, and holding scheduled office hours.
• Supporting the teams. Assisting with team formation, and helping teams stay on task during in-class group work.
• Feedback and grading. Giving ungraded feedback on homework and projects while it can still change the outcome, grading assignments and exams against the instructor's rubrics, and helping refine those rubrics.
• Course materials. Reviewing readings, slides and examples with an eye to whether they land, and working through new assignments myself to find the parts that do not yet work.
• Reporting back. Summarizing for Dr. Giacobe what the class has understood well and what it has not, so he knows what to revisit.
• Instruction. Occasionally standing in to teach a session where the topic suits me and he has prepared me for it.

Why this course interests me

My research is on usable security and privacy — whether the people affected by a system can understand what it does and act on it. The last objective of this course is a version of the same problem: a team can do flawless forensic work and still fail if the executive in the room cannot act on what they were told. Watching students learn to translate between those two audiences is close to what I study.