Finding the "practical" component for my thesis on Log4Shell

I plan to write my bachelor's thesis on the topic of Log4Shell.

Specifically, I thought of analysing what measures were taken to mitigate the risk after the vulnerability reached the public (aside from the official patches) und if those measures were neglected before (and maybe why). Also I could investigate if Apache Foundation's response was adequate.

While these questions seem okay to me (feedback appreciated) I think I still need some "practical" / "creative" component in my thesis. Either coding …

cybersecurity log4shell