I Came for the Badge. I Stayed for the Builds.
I entered Hacktoberfest 2026 with one project in mind. Weeks later, I still hadn't built it. I'd built six other things instead.
Instead, I'd shipped a phishing checker, a kids' security-learning tool, a plain-English vulnerability-brief engine for small businesses, a Windows Event ID decoder, my first bot, and an AI-agent-built database I then had to fact-check. I compared the same prompt across three AI models. I talked to a Hacktoberfest program manager. I got reposted by the official account twice, and I chased down one final point to earn Completionist++ after the challenges had technically already ended.
This was not the October I planned. It was a better one.
The plan I abandoned (and why that was the point)
I've done Hacktoberfest before. I came into this one with the data-analyst instinct I always bring: pick one project, scope it, execute it cleanly. I had that project picked. I still haven't built it. 😂
What made this Hacktoberfest different is that the format had shifted to a series of weekly build challenges, each with its own theme — and every time a new theme dropped, it sparked something that fit my brand in a way I hadn't anticipated. So I kept building the thing in front of me instead of the thing on my list. I've never come out of a Hacktoberfest with this many builds, and it's because I stopped treating the plan as the point.
For most of my career I'd have called that a failure to execute the plan. This month I learned to call it following the signal. In a field I'm transitioning into, the plan was always going to be less valuable than the discovery — and you don't discover anything by refusing to deviate from a list you wrote before you knew what was possible.
What I actually built
Six things. Here's the honest tour — what each one is, and more importantly, what each one taught me.
Does This Belong Here? — the phishing checker
The one that started it. Paste in a suspicious email or text, and a local open-weight model (Gemma) walks you through the red flags in plain language — built for the people in my life who actually get these texts.
It was my "can I even do this in a weekend?" experiment. Shipping it answered the question — and it's a direct portfolio piece for the SOC roles I'm targeting: phishing triage, explained for a human.
The Security Dictionary: Trail Edition
My Touch Grass Challenge build — turns security terms into kid-friendly outdoor missions, running Gemma locally via Ollama with ElevenLabs narration.
The moment that made it real wasn't a metric: I tested it with a kid in my target age range, who got the Firewall mission, tapped Listen, smiled at the voice, and went and found a fence in the backyard. The lesson I didn't expect — the voice wasn't a nice-to-have; it was load-bearing. On the tier without real narration, engagement fell off a cliff. Not every kid learns best by reading.
→ See the demo · Code
AlertCadence
The most "grown-up" build of the month. A pipeline that pulls live CISA vulnerability advisories, filters to the ones that matter to small businesses, and uses local Gemma to translate each into a calm, plain-English brief an MSP could send a non-technical client.
The sharpest lesson of the month: the model is the last mile, not the brain. What made the output trustworthy wasn't a cleverer prompt — it was giving the model a smaller job.
→ See it live · Read the write-up · Code
Event ID Decoder
Built during Global Hack Week with Cursor — explains Windows Security Event IDs in plain English. The most directly SOC-shaped thing I made, and the one with the clearest road ahead.
A Grok bot
My first bot, ever. I built it and taught it a routine. Small, but a genuine first — and firsts count.
An AI-agent-built events database
I had an AI agent help build a database, and then I did the part that actually mattered: I checked its work, which brings me to the thread running under all of this.
The thread under everything: the AI drafts, the analyst verifies
I didn't set out to make this month about AI. Look at that list — Gemma in three of the builds, Cursor, Grok, an AI agent building a database. I was experimenting with these tools constantly, and the real lesson wasn't "AI makes you faster." It was learning when to trust it and when to check it.
When I built AlertCadence, early versions of the model occasionally leaked raw exploit syntax into what was supposed to be a calm client email, and drifted on formatting between runs. The fix that worked wasn't scolding the model with a stricter prompt — it was extracting a small, fixed set of facts in plain Python first and handing the model only those. The raw advisory never reaches the AI, so it can't leak what it never sees. The model stopped being the brain and became the last mile.
The agent-built database was the same lesson from the other side: an agent produced something plausible, and the job wasn't to admire it — it was to verify it. Generating something and validating it are two completely different tasks, and the second one is where my data-analyst background actually pays off. I even ran the same prompt about a Windows Event ID across three different models just to watch them disagree — because seeing where they diverge is how you learn not to take any single answer at face value.
That's not a side note to my career transition. It is the transition. A SOC analyst's whole job is telling signal from noise, trustworthy from plausible. AI didn't replace that instinct this month — it gave me a dozen new chances to practice it.
The part I didn't expect: the event itself
I came for the challenges. The community became part of the reward.
I ended up in a conversation with Jacklyn, one of the Hacktoberfest program managers, before I earned Completionist. Team members liked and engaged with my progress posts. The official Hacktoberfest account reposted me — twice. I tuned into the livestreams — just watched and learned, which was exactly what I needed. Sharing the work publicly, as I went, is what turned a solo build month into something that felt like belonging to something.
Then there was the last sticker. 😂
This was also, as far as I know, my first time actually doing the Global Hack Week challenges — the little 1-to-3-point side quests that nudge you into trying tools you'd otherwise skip. That's half of how I ended up with six builds instead of one: the challenges kept handing me reasons to experiment.
My Completionist++ run came down to the wire. I'd hit 15/15 on the main challenges, then got to 19 of 20 Global Hack Week points — one single point short of the final sticker. GHW had officially ended. And then the challenges reopened for one more day. So I submitted one more, hit 20, and earned Completionist++ 👑 after the buzzer. "The event was over, a door reopened for a day, and I walked through it" is exactly the kind of persistence this whole brand is built on.
What happens to all of this in November
Here's the honest part: not every one of these needs to become a product. A shelf of thoughtful v1s, each with a clear "what's next," says more about how I build than one over-polished thing would.
So November is about depth, not another pile of projects:
Event ID Decoder is the one I'm genuinely excited to grow — into a Tiger Cloud SOC home lab with real logs, SQL analysis, and MITRE ATT&CK-aligned detections. The most direct runway toward the roles I want.
AlertCadence gets refined only if it turns out to solve a real problem — the right time to deepen it is when an MSP actually asks to use it, not because a backlog says I should.
The phishing checker and Trail Edition stay live as learning tools, revisited when there's a real improvement to make.
The Grok bot and the agent experiments I'll document for what they taught me, and leave at that — no obligation to expand everything.
Also, on October 29 there's the Operation Cymbal CTF, which is another chance to put the practical SOC skills to work rather than just build more.
What Hacktoberfest actually gave me
Not the badge — though the badge is on the shelf and I earned every point of it.
What it gave me was proof of a few things I needed to believe. That a plan changing isn't the same as a plan failing. That building something teaches you things no tutorial can. That AI is a genuinely useful collaborator and that human verification is still the whole job. That showing your work in public creates opportunities you can't schedule. And sometimes you find your next direction by building the thing you didn't plan to build.
I came in with one project and a tidy list. I'm leaving with six builds, a Completionist++ sticker, a clearer sense of where I'm headed, and the discovery — genuinely the best surprise of the month — that I like this. Not just learning security. Building it.
The tool changes. The question doesn't. This month, I got to ask it in six new ways.
Storm to SOC — read the map, then move. 💜
Comments