To choose a cybersecurity or ethical hacking course in Nepal, check four things. Does the syllabus teach networking and Linux before any hacking, then both attack and defence? How many live lab hours do you get? Who teaches, and how many students share one mentor? And can you see a real student report and sit in on a class before paying?
This guide gives you a fair checklist you can use on any institute in Kathmandu or online. At the end we show how our own course answers it, so you can judge us by the same rules.
What should a cybersecurity course in Nepal cover?
A good cybersecurity course starts with networking, Linux and the rules of legal testing. It then teaches web and API testing, the main attack tools, and the defender's side: logs, a SIEM and alert triage. It ends with a written report. Junior jobs in Nepal are mostly web and API testing (VAPT) and SOC analyst roles.
VAPT means vulnerability assessment and penetration testing: testing a system for security holes, with permission. A SOC is a security operations centre, where analysts watch alerts and spot real attacks.
| Area | What to look for | Why it matters |
|---|---|---|
| Legal scope and ethics | Written scope, permission and lab rules taught in week one | Testing without permission is a crime, and employers check you understand this |
| Networking | TCP/IP, DNS, TLS and reading traffic in Wireshark | Every attack and every alert happens on a network |
| Linux and hosts | Command line, permissions, services and logs | Most security tools run on Linux, and most servers do too |
| Recon | Nmap, enumeration and passive OSINT with clear limits | Good testing starts with finding what exists |
| Web and API testing | Burp Suite, OWASP Top 10, access control and API flaws | This is where most junior testing jobs are |
| Exploitation tools | Metasploit and similar tools, used inside a lab | Shows you can confirm a hole, not only guess at it |
| Defence | A SIEM, Windows and Active Directory logs, alert triage | SOC jobs need people who read logs, not only people who attack |
| Reporting | A CVSS-scored report a developer can act on | The report is what a client actually pays for |
Be careful with a course that promises "hacking" from day one, or lists dozens of tools with no lab time. Tools change. Networking, Linux and clear reporting do not. Ask which topics you will practise in a lab and which are only shown on slides.
How long should an ethical hacking course be?
Count total live lab hours, not months. Security is learned by doing labs, so a course with few hands-on hours will leave you with notes but no skill. Work out the real number before you compare fees.
How do I calculate total live hours?
Multiply classes per week by hours per class by number of weeks. Recorded videos do not count.
| Example format | Classes per week | Hours per class | Weeks | Total live hours |
|---|---|---|---|---|
| Example A | 5 | 2 | 12 | 120 |
| Example B | 3 | 1.5 | 12 | 54 |
| Example C | 6 | 1 | 8 | 48 |
Divide the fee by the live hours to get a cost per hour with a mentor. Also ask how much lab practice is expected at home, and on which platforms. Free practice rooms on sites such as TryHackMe are fine, as long as someone checks your write-ups.
Are certifications included?
Ask what the course prepares you for, and whether any exam fee is included. Security+, eJPT, CEH and OSCP are separate exams run by other bodies. A course can prepare you for them, but the certificate an institute gives you is not the same thing.
What 5 questions should I ask before joining?
Ask every institute the same five questions. A good answer is something you can check.
1. Who teaches the class?
A good answer names the mentor and says what security work they do now: testing, SOC work, or security engineering. Ask how many years they have done it. Ask whether that person will teach your batch.
2. Can I see a report from a past student?
A good answer is a real VAPT report or lab write-up, with client details removed. Look for clear findings, a severity score and a fix a developer could follow. If the institute is new, ask to see the capstone brief and a sample report format.
3. How much feedback will I get, and how big is the batch?
A good answer gives a batch size number and says who reviews your reports and when. Labs break often. In a large batch, a mentor cannot fix everyone's setup in two hours.
4. What happened to past students?
A good answer is specific, with names you could check on LinkedIn. Be careful with a job guarantee. Ask to see the exact wording in writing.
5. Can I attend a class before I pay?
A good answer is yes, a real lab class with the current batch. One class shows you the pace, the lab setup and how much help each student gets.
How does Saarathi's cybersecurity course answer these?
Our Cybersecurity and Ethical Hacking course (code TR-04) is a 12 week course in Old Baneshwor, Kathmandu, with about 120 live hours and at most 10 students in the classroom. The current fee is on the course page. It runs online and offline. These answers come from our published syllabus.
What does the syllabus cover?
The course covers both attack and defence. Weeks 1 to 4 are the security mindset, legal scope, networking, Wireshark, Nmap, recon and Linux. There is no attacking in these four weeks. Week 5 covers logging, auditing and an introduction to SIEM and SOC work. Weeks 6 to 8 are web and API testing with Burp Suite, covering injection, login and access control flaws, and the OWASP API Top 10. Week 9 covers network service attacks with Metasploit, SQLMap and hashcat, plus security for AI apps using the OWASP Top 10 for LLM Applications. Week 10 is the defender's side: a home SIEM lab, Windows and Active Directory logs, a Tier-1 SOC workflow and GRC basics (governance, risk and compliance). Week 11 is the capstone test and report. Week 12 covers your portfolio, certification plan and career.
Cloud security, mobile testing and incident response are introduced, not taught in full. You learn to recognise a cloud finding and hand it on, not to run a full cloud security test. Full network penetration testing comes later, after more lab hours.
The syllabus points you toward Security+, then eJPT, CEH and OSCP. Graded eJPT-style practice checks run in Weeks 3, 5, 9 and 12. You also write small Bash and Python scripts in Weeks 3, 5 and 8.
How many hours, and what is the weekly routine?
Classes run Monday to Friday, 2 live hours a day, for 12 weeks. That is 120 live hours. We expect about 2 more hours a day at home on practice rooms, repeating labs and writing up what you did. On the last day of each week, the last hour is for revision, doubts and help with your reports. Sunday is an open classroom you can use or skip.
Who teaches?
Our mentors still work in the field they teach, and each has at least four to five years of professional experience. Ask us who will teach your batch.
What will I build?
You finish with a scoped test and a CVSS-scored report. From Day 1 you keep every command, screenshot and finding in one notes vault in Obsidian or Notion, and your final report is written from it. Project briefs include a full VAPT report on practice targets such as OWASP Juice Shop, an OSINT attack surface report, a network enumeration report and a portfolio of solved CTF rooms. Ask to see past reports when you visit.
How much feedback will I get?
In Week 6 you get a 1:1 review with your mentor and a written action list, which you close out by Week 12. Batches have at most 10 students in the classroom. The course ends with a proctored certification exam of about 30 questions, with a 70 percent pass mark, plus a capstone review.
What about jobs and outcomes?
We do not promise a job or a salary. Pay depends on your skills, portfolio and clients. Career support means CV and LinkedIn reviews, a mock interview and referrals into our hiring partner network. Ask us to put you in touch with a current student.
Can I try a class first?
Yes. If you need it, you can sit in on one class for free before you pay. Message or call us to pick a day.
See the full week by week plan on our Cybersecurity and Ethical Hacking course page, or download the full syllabus.
