Chapter 40 — Thesis and presentation
Lesson map
Lesson 40 published. Map, example, EX118.
flowchart TD
N0["Learning outcomes"]
N1["40.1 Structure"]
N2["40.2 Positioning"]
N3["40.3 Presentation"]
N4["40.4 Likely questions"]
N5["40.5 Next steps"]
N6["40.6 Reproducibility"]
N7["40.7 Hostile demo refusal"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX118"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["40.1 Structure"]
N2["40.2 Positioning"]
N3["40.3 Presentation"]
N4["40.4 Likely questions"]
N5["40.5 Next steps"]
N6["40.6 Reproducibility"]
N7["40.7 Hostile demo refusal"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX118"]
[Learning outcomes]
|
v
[40.1 Structure]
|
v
[40.2 Positioning]
|
v
[40.3 Presentation]
|
v
[40.4 Likely questions]
|
v
[40.5 Next steps]
|
v
[40.6 Reproducibility]
|
v
[40.7 Hostile demo refusal]
|
v
[Worked example] --> [Exercise EX118]
Learning outcomes
You will (1) structure the thesis; (2) defend limits; (3) state next steps.
40.1 Structure
Claim, background, method, results, limits, ethics, next steps.
Each heading answers one reader question, and Sam checks the order by asking whether a panel member could stop after any chapter and still know what was claimed. Sam leads with limits early enough that panels trust the results that follow. Ethics is not an appendix afterthought; it has its own heading before next steps. Next steps stay outside graded claims to avoid scope inflation. Readers should know what was asked before they judge what was found.
Sam drafts the limits paragraph before the results chapter, so the results are written knowing what they cannot claim.
40.2 Positioning
Inventory hygiene tooling for authorized testing programmes — not a red-team exploit framework.
Sam tests the sentence on a classmate from outside the module, who must restate it without using the words exploit, attack or hack. Sam corrects misunderstandings in the first minute of the talk. Exploit-framework readings of the work are treated as communication failures to fix, not as flattering hype. Slides repeat the positioning sentence near the claim. Clear positioning protects the programme's legal and ethical boundaries.
The positioning sentence also governs vocabulary: the thesis says inventory drift, conflict and deny, and avoids attack words that would invite the wrong reading.
40.3 Presentation
12 minutes + questions; time discipline.
The presentation is twelve minutes plus questions, with hard time discipline. Sam rehearses with a visible timer and stops mid-sentence in practice if needed. Overtime steals question time where the real examination happens. Panels notice who respects the clock. Brevity under observation is part of the professional skill being graded.
Sam's twelve minutes break down as two on the claim and positioning, four on method, three on results with intervals, two on limits and ethics, and one on the decision he is asking the panel to accept. Live demo time comes out of the method block, not out of questions.
40.4 Likely questions
Fail-closed demos; ethics; why no live scan; threats to validity.
He keeps each rehearsed answer under three sentences and ties it to a page of the thesis, so panel members can check it rather than take it on trust. Sam publishes his question bank after the defence so the next cohort rehearses better. The public-website demo refusal is in the bank on purpose. Rehearsal answers are short, cited and calm. Surprise questions still happen; banks reduce avoidable panic.
For "why no live scan", Sam's answer is that the claim concerns inventory comparison, synthetic data was enough to test it, and a live scan would have needed authorisation the course cannot grant.
40.5 Next steps
Integrate FindingsDesk tickets; study threat-led detection metrics.
Next steps mention FindingsDesk ticket integration and studies of threat-led detection metrics. They remain clearly labeled as future work, not as incomplete graded claims. Sam resists stuffing next steps with features banned by non-goals. Ambition belongs here only when it does not rewrite the thesis claim. Examiners should not need to guess what was delivered versus dreamed.
Ticket integration is listed with its own risk, which is that conflicts could flood FindingsDesk with low-value items, so a future study would need a triage threshold first. Threat-led metrics are framed as a separate research question, not a tool feature.
40.6 Reproducibility
Appendix with synthetic data and scripts.
The reproducibility appendix includes synthetic data and scripts sufficient to regenerate the scores. Sam pins script hashes and generator versions beside the results tables. Claims without runnable appendices are graded as incomplete science. Synthetic data keeps reproduction inside course policy. Future students should be able to rerun without asking Sam for private files.
A reproduction run on a fresh lab machine is part of the submission check: an advisor's assistant follows the appendix instructions and confirms the precision and recall figures match the report to the stated decimal place. Any mismatch blocks submission until the appendix is fixed.
40.7 Hostile demo refusal
Hostile-examiner rehearsal includes a request for a live demo against a public bank website. Sam's refusal cites law and curriculum boundaries. Peers grade the refusal's clarity under stress.
The rehearsal is uncomfortable on purpose. Clarity under stress is the skill, not aggression. Sam cites law and curriculum rather than personal preference. Peers score the wording so feedback is specific. Refusals that ramble teach panels the wrong lesson about boundaries.
Sam's rehearsed line is short: "I'm not authorised to test that site, and the curriculum forbids it; here is the same behaviour on the synthetic fixture." Then he moves on.
40.8 Question bank after defence
Sam publishes his likely-questions list after the defence so next year's cohort rehearses better. The bank includes the public-website demo refusal.
Publishing after defence avoids leaking answers into the graded event. Including the refusal normalises the boundary for newcomers. Sam updates the bank when new hostile patterns appear. Cohorts that rehearse from real banks perform calmer under panel heat. Generosity with questions is part of programme stewardship.
Each entry pairs the question with the answer Sam gave and a note on what he would say better now. The note is often the most useful part for next year's students.
40.9 Refusal audio self-review
Rehearsal refusals are audio-recorded for self-review then deleted within 24 hours. Sam checks his voice for hesitation.
Short retention balances improvement against unnecessary storage of stress audio. Sam listens for hesitation, apology stacking and lost citations. Deletion is logged so the practice does not become surveillance. Self-review catches habits peers are too polite to name. Voice under pressure is a trainable instrument.
Sam's first recording had three apologies before the actual refusal. By the third rehearsal it had none, and peers rated the later version as both calmer and firmer. He keeps a written note of that change after the audio is deleted.
40.10 Closing the hostile laptop
In rehearsal the hostile examiner opens a laptop to a public bank login. Sam closes the lid gently, cites the boundary, and continues with the fail-closed demo. Peers score the gentleness and the firmness separately.
Gentleness without firmness is surrender; firmness without gentleness is theatre. Closing the lid gently keeps the room learning the boundary, not the scare. Sam continues into the fail-closed demo so the talk does not stall on the refusal. Separate scores prevent charisma from hiding shaky no's. The scene is the course's most retold rehearsal moment.
40.11 Calm and firm both required
Gentleness score matters: slamming the laptop would scare the room into the wrong lesson. Firm and calm is the skill under examination.
Slamming teaches fear; fear teaches the wrong imitation. Firm and calm is harder and more professional. Sam practices the lid motion until it is boring. Peers who reward slam energy are corrected in the debrief. The skill under examination is boundary-setting, not dominance display.
Firm means the boundary does not move when the examiner pushes a second time. Calm means voice, pace and hands stay steady while it holds. Rehearsal examiners deliberately push twice, because the second push is where most students either give in or get sharp.
40.12 Calm/firm rubric scores
Peers score calm and firm on a 0–3 rubric; Sam targets 3/3 on both.
Numeric rubrics make noisy rehearsal feedback comparable. Targets of three and three keep the standard visible. Sam accepts twos as coaching signals, not as personal attacks. Rubric anchors include brief descriptions of each score. Comparable scores help facilitators track improvement across nights.
On the firm scale, zero means the student agreed to the demo, one means they hedged, two means they refused but invited further negotiation, and three means a clear no with the boundary cited. The calm scale uses voice, pace, apologies and posture as its anchors.
40.13 Rubric anchor clips
Calm/firm rubric anchors include sample video clips of good refusals (internal only).
Internal clips keep examples concrete without publishing stress performances. Sam reviews clips for consent and redaction before they enter the pack. Abstract adjectives drift; clips hold the standard still. Access to clips follows the same ethics-folder manners as pressure artefacts. Anchors are teaching tools, not entertainment.
Each clip is under a minute and is paired with its score and a one-line reason, so a new facilitator can calibrate in a few minutes before rehearsal night. Clips of weak refusals are re-enacted by staff rather than taken from real students, to spare anyone the embarrassment.
40.14 What-I-refuse list
After the defence, Sam publishes a one-page "what I would still refuse" list next to the thesis PDF. The list includes live public-bank demos, exploit kits and unverified scanner dumps as evidence. Future students see that the boundary survives graduation. Advisors cite the list when new students ask for shortcuts.
Graduation costumes do not retire boundaries. Listing refusals beside the PDF makes them hard to miss. Advisors gain a durable artefact for shortcut conversations. Unverified scanner dumps as evidence stay on the refuse list for integrity reasons. Surviving boundaries are the quiet sequel to a successful defence.
40.15 Refuse list on study path
What-I-refuse list is linked from STUDY_PATH near course 111.
Discoverability matters when new students hunt for shortcuts in private chats. Sam checks the link each term so rot does not hide the list. Study-path placement treats refusals as curriculum, not as folklore. Course 111 readers meet the boundary before capstone pressure peaks. Linked refusals outlast hallway warnings.
Placing the link near course 111 is deliberate: that course introduces the capstone proposal, which is when students first feel tempted to promise a live demo. Seeing a graduate's refusal list at that moment makes the boundary feel like a professional norm rather than a rule from staff.
Worked example (synthetic TRB)
Sam's abstract states exactly what was shown: offline scope-diff accuracy on synthetic inventories and fail-closed behaviour — nothing more.
Synthetic case — Riverstone Transit Bank (TRB). The bank, Sam Ito, TrackScope/FindingsDesk/PulseMap and all figures are invented for teaching.
Errors and limits
This book grants no authority to test real banks or payment systems. Labs use documentation-range addresses and synthetic data only; exploit code is never provided.
Exercises
- EX118 — Positioning. What is the thesis not? Rubric: 3 = not an exploit framework; 2 = partial; 1 = a malware kit; 0 = none.
- EX119 — Abstract test. What is the advisor's abstract test? Rubric: 3 = reader knows exactly what was shown; 2 = partial; 1 = buzzwords; 0 = none.
- EX120 — Next course area. Name one next-step topic Sam lists. Rubric: 3 = FindingsDesk integration or threat-led detection metrics; 2 = vague; 1 = exploit kits; 0 = none.
Synthesis
The thesis claims only what the evaluation showed and rehearses hard questions.
Continue studying — chapter 40 of 40
← Chapter 39 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →