What a Cyber Security Internship Actually Involves

"Internship" covers an enormous range in this field. At one end is supervised work on real tasks with feedback. At the other is a form, a playlist and a PDF certificate. Both are advertised identically.

What a real internship asks of you

Expect structured tasks with deadlines, submitted work that is actually reviewed, and feedback you have to act on. The work is usually some combination of:

• Building and documenting a lab environment.
• Performing a defined technique and recording what telemetry it produced.
• Investigating a provided alert or log set and writing a conclusion.
• Assessing a deliberately vulnerable application and reporting findings properly.
• Writing. Consistently more writing than people expect.

The writing is not administrative padding. In professional security work, an unreported finding does not exist and an uncommunicated investigation has no value. Interns who treat the write-up as the boring part are practising the wrong half of the job.

What is expected of you

Less technical skill than you fear, more consistency than you expect.

Supervisors are assessing whether you submit on time, whether you ask questions before you are badly stuck rather than after, whether feedback changes your next submission, and whether your work is your own. These are the things that predict whether somebody will be useful in a team.

Plagiarism is the fastest way out. It is also easier to detect than people assume, because a write-up in a different voice from the rest of your work is obvious to anyone reading several of them.

Telling a real programme from a certificate mill

Ask these before committing:

• Is work reviewed by a person, with feedback? If grading is automatic or absent, you are buying a certificate.
• What are the tasks? A real programme can describe them. A vague answer means there is no curriculum.
• Is there a deadline structure? Self-paced with no deadlines usually means nobody is watching, and most people do not finish.
• Can the certificate be verified? A certificate with a verification link or code can be checked by an employer. One that cannot is a decorated image.
• What proportion complete it? An honest programme knows this number and it is not ninety per cent.

Paying is not itself a warning sign, and free is not itself a guarantee. Reviewed work is the signal.

Remote internships

Most are remote now, which works if the structure is there. The difference between a remote internship that produces something and one that quietly stops is almost entirely deadlines and a response to submitted work.

From your side, treat it as a job. Fixed hours in your week, submissions early rather than on the deadline, questions asked in whatever channel exists. Interns who go quiet for two weeks and reappear near the end get the certificate and nothing else.

Leaving with something worth having

The certificate is the least valuable output. What you should leave with:

• Work you can show. Keep every submission. Clean the best few up into public write-ups, with anything confidential removed.
• A reference. Ask at the end, while your work is fresh in a supervisor's memory. A named person who will confirm what you did is worth more than any document.
• A specific answer to "what did you do?" Not "I completed a security internship" but "I built a detection lab, ran credential dumping against it and wrote the rules that caught it".

That third one is the entire point. An internship that cannot be described in a specific sentence did not teach you anything an employer can use.

Frequently asked questions