Hi everyone,

I’m a junior cybersecurity undergrad from South Korea planning to apply for Fall 2027. I’d like some honest feedback on where I realistically stand and how I should approach the application process.

Academic Background

• Major: Cybersecurity
• GPA: 3.0/4.5 (~2.7/4.0 US scale)

I’m aware this is a weak point.

Research Experience (all during undergrad)

• Research intern at Indiana University Bloomington (current)
• Research intern in a cybersecurity lab in Korea

Publications (first author unless noted):

• ACM international conference (accepted)
• Q1 journal (major revision)
• Invited domestic journal (accepted)
• Two domestic top-tier conference papers that received Best Paper Awards
• One additional domestic paper as co-author
• Several additional international submissions in progress
• Filed a patent in malware detection

Other Relevant Experience

• Multiple research and academic awards (scholarships, paper contests, thesis award)
• Several hands-on projects in cybersecurity, malware detection, CPS security, and post-quantum cryptography implementation on ARM TrustZone
• Completed military service (KATUSA) and received commendation medals from the U.S. Army

Goal

My long-term goal is research-oriented graduate study, eventually a PhD in cybersecurity or systems security.

Target Programs

• United States: CMU, UIUC, UCSD, UCSB, Georgia Tech, Purdue (roughly top 20–30 range)
• United Kingdom: Oxford, UCL
• Switzerland: ETH Zürich

Questions

1. To what extent can strong research output compensate for a low GPA in cybersecurity or systems-oriented graduate admissions? I’m not expecting the GPA to be ignored; I’m asking whether demonstrated research ability is considered a meaningful counterweight.
2. For research-heavy MS or PhD programs, is it useful to contact potential advisors about a year in advance, or should outreach only begin once my publications and materials are finalized?
3. Is it reasonable to include top-tier programs as reach schools, or is my GPA low enough that applying to places like ETH/Oxford/top US programs is effectively unrealistic regardless of research background?
4. When should I start forming a balanced school list — now, or after my final publication status and GPA trend are clearer?

I’d appreciate any direct or harsh feedback. I’d rather plan realistically than rely on assumptions.

Thanks in advance.