◇ OpenCyber Academy
Bachelor's · Chapter 40 · English

Chapter 40 — Thesis and presentation of incident findings

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 40 — Thesis and presentation of incident findings

Lesson map

Lesson 40 published. Map, example, EX118.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["40.1 Thesis structure"]
  N2["40.2 The evidence chain"]
  N3["40.3 Visual explanation"]
  N4["40.4 The defense"]
  N5["40.5 Revisions and future work"]
  N6["Chapter synthesis"]
  N7["Chapter 1: EX001–EX003"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX118"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["40.1 Thesis structure"]
  N2["40.2 The evidence chain"]
  N3["40.3 Visual explanation"]
  N4["40.4 The defense"]
  N5["40.5 Revisions and future work"]
  N6["Chapter synthesis"]
  N7["Chapter 1: EX001–EX003"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX118"]
[Learning outcomes and connection]
    |
    v
[40.1 Thesis structure]
    |
    v
[40.2 The evidence chain]
    |
    v
[40.3 Visual explanation]
    |
    v
[40.4 The defense]
    |
    v
[40.5 Revisions and future work]
    |
    v
[Chapter synthesis]
    |
    v
[Chapter 1: EX001–EX003]
    |
    v
[Worked example] --> [Exercise EX118]

Learning outcomes and connection

You will be able to (1) structure a bachelor's thesis around an evidence chain; (2) present findings visually without distortion; (3) defend your work against challenges; and (4) document revisions and future work. This final chapter turns the capstone dossier of Chapters 35–39 into a thesis and an oral defense. It draws on academic writing (Chapter 4), measurement (Chapter 15) and critique (Chapter 37).

40.1 Thesis structure

A compact structure: (1) introduction — problem, question, why it matters; (2) background — concepts and prior work with citations; (3) method — design, materials, data plan, ethics, criteria; (4) implementation — what was built, with configuration in an appendix; (5) results — against each criterion, with error analysis; (6) discussion — interpretation, comparison with expectations and literature, limitations with direction; (7) conclusion — what was shown, under which conditions; (8) future work. Appendices hold code, test cases and raw outputs.

For the intake thesis, the method chapter must state the actual design run, eight cases per method, alongside the twelve proposed, and explain the difference.

40.2 The evidence chain

Every claim in the conclusion should trace to results, which trace to data, which trace to method. A simple results-to-claims table — claim, supporting result, evidence location, strength, limitation — keeps the chain visible and is an excellent defense aid.

For the intake thesis, the claim that the form reduced time to triage in the simulation traces to the medians of 13 and 6 minutes in Lab 39, which trace to the raw outputs in Appendix C, which trace to the within-subjects method. The row grades the strength as moderate and names the limitation, classmates without time pressure. A claim without such a row is a claim the defense will probe first.

40.3 Visual explanation

Figures should make the comparison the reader needs easy: side-by-side bars for completeness by method with counts labelled; timelines with uncertainty marked; workflow diagrams with gates. Avoid truncated axes that exaggerate differences, 3D effects and colour as the only encoding (accessibility). Every figure has a caption that states what it shows and its source.

The revision table in the worked example shows the point: a y-axis starting at 40 per cent made the improvement from four to seven complete reports look larger than it was, so the axis was redrawn from zero with counts labelled. With only eight cases per method, labelling counts on every bar is essential.

40.4 The defense

Examiners ask about the question's relevance, the method's choices, the validity of the results and the honesty of limitations. Prepare a question bank: "Why synthetic data?", "Why these criteria?", "What if your reference answers were wrong?", "What would you do with another semester?" Answer directly, concede valid points, and distinguish what the evidence shows from what you believe.

The worked defense shows the right tone: the student concedes that the criteria were not met, separates the aim of testing the form from the result of the test, and points to the error analysis and the proposed held-out re-evaluation. Prepare the same for the question an examiner is likely to ask about the difference between the twelve planned scenarios and the eight run.

40.5 Revisions and future work

Record examiners' comments and your changes in a revision table. Future work should be specific and follow from limitations: "repeat with 16 held-out cases written by a second author", not "do more research".

For the intake thesis, future work follows directly from the limitations: fix the T03 routing rule and the T06 field, then re-evaluate on held-out cases written by a second author, with volunteers who work under time pressure if that can be arranged ethically. Each item names what would be learned and which limitation it addresses.

40.6 Worked example (synthetic): thesis summary and defense

Fictional thesis "A structured intake form for incident reports in a simulated clinic network".

Abstract (excerpt): "In a within-subjects simulation with 8 volunteer reporters and 8 synthetic incidents per method, a structured intake form increased complete reports from 4/8 to 7/8 and reduced median time to triage from 13 to 6 minutes compared with email reports. Pre-specified 90% thresholds for completeness and routing were not met. Two failure causes were identified and fixed; a re-evaluation on held-out cases is proposed."

Results-to-claims row: Claim "the form reduced time to triage in the simulation" — result: median 13 → 6 min (Lab 39) — location: Appendix C raw outputs — strength: moderate (small n, consistent across 8/8 cases) — limitation: classmates without time pressure.

Defense exchange (fictional): Examiner: "Your criteria were not met. Is the project a failure?" Student: "The project met its aim of testing the form against explicit criteria; the form did not meet the thresholds in this run. The error analysis shows two specific, fixable causes. I report the result as it is and propose a held-out re-evaluation rather than claiming success."

Revision table entry: comment "the figure's y-axis starts at 40%" → change: axis from 0% with counts labelled; reason: avoid exaggeration.

40.7 Common errors and limits

Exercises — chapter 40

Attempt each exercise before opening the worked results. Every case, organization, person, address and number in an exercise is synthetic unless a cited public source is named.

EX118 — Results-to-claims table. Steps: write three rows for the fictional thesis (time, completeness, routing). Rubric: 3 = each row with claim, result, location, strength, limitation, calibrated; 2 = missing strengths; 1 = claims only; 0 = none.

EX119 — Question bank. Steps: write six likely examiner questions and one-sentence answers. Rubric: 3 = covers relevance, method, validity, ethics, limitations, future work; answers direct and honest; 2 = four; 1 = generic; 0 = none.

EX120 — Figure critique. Inputs: a pie chart in 3D comparing "complete" vs "incomplete" for each method, red and green only, no counts. Steps: list problems and design a replacement. Rubric: 3 = 3D distortion, pie unsuited to comparison, colour-only encoding, no counts; replacement: grouped bars from zero with counts and patterns or labels; 2 = two problems; 1 = one; 0 = none.

Chapter synthesis

A thesis is an evidence chain made readable: structure it so each conclusion traces to method and data, show comparisons honestly, defend by distinguishing evidence from belief, and turn limitations into specific future work.

Continue studying — chapter 40 of 40

← Chapter 39 · Course chapter index · Next course via chapter index →

This is the final chapter of this course; the index links the next course in the full study path.