Cyber Security Course in Pakistan

Security is mostly not an entry-level field. Most people arrive through IT support or networking first, and this course is aimed squarely at that route. Anyone selling a three-month path straight into a security job is not being straight with you.

Apply for this course

Replacing the film version with the commercial reality.

• What attackers want, and why you are a target
  Money, resellable accounts, your contact list, a route into your employer, ransom. None of it requires you to be important.
• Untargeted attacks and credential stuffing hands on
  Why being ordinary is not protection, and what password reuse actually costs.
• The human is the weakest point
  Why it is cheaper to convince someone to hand over a code than to defeat encryption.
• The Pakistani threat picture
  SIM swap, EasyPaisa and JazzCash fraud, WhatsApp account theft, fake job offers. Local and specific.

Enough network knowledge to reason about traffic.

• TCP/IP, ports and what is listening hands on
  Reading a connection and knowing what should not be there.
• DNS, HTTP and TLS hands on
  How a certificate actually proves anything, and what a browser warning means.
• Scanning and enumeration with nmap hands on
  In a lab you own. Scope and written authorisation covered before the first scan.
• Reading traffic with Wireshark hands on
  Seeing credentials cross a network in plain text — once seen, never forgotten.

Making a machine harder to take.

• Linux fundamentals for security work hands on
  Users, permissions, processes, logs and services.
• Patching, and why it is the highest-value control
  Unglamorous, unpopular, and the thing that would have stopped most real incidents.
• Least privilege in practice hands on
  Shared admin logins, and why every named person needs their own account.
• Backups you have actually restored hands on
  An untested backup is a hope. Restoring one is the exercise.

Where most real vulnerabilities are found.

• The OWASP Top Ten, demonstrated not recited hands on
  Each one shown working in a lab application.
• Injection and broken access control hands on
  The two that cause the most real damage — including changing an id in a URL to read another user's record.
• Using Burp Suite hands on
  Intercepting, modifying and replaying requests.
• Writing the finding, not just finding it hands on
  A vulnerability nobody can understand or reproduce does not get fixed. Severity, reproduction steps, and the remediation.

Assuming something will get through.

• Logs, and what to keep hands on
  The evidence you will wish you had.
• Recognising an incident in progress
  Indicators, and the cost of a false alarm versus a missed one.
• The first hour hands on
  Contain, preserve, communicate. In that order, and why improvising the third one damages an organisation most.
• Phishing analysis hands on
  Headers, links and attachments — taking a real reported message apart.

The part that keeps you employable and out of trouble.

• PECA and the legal boundary in Pakistan
  What unauthorised access means in law. Testing a system you were not asked to test is a crime, whatever your intent.
• Scope, authorisation and the engagement letter hands on
  Never touching anything without it in writing.
• Disclosure done responsibly
  What to do when you find something in a system that is not yours.
• How people really enter this field
  Usually through IT support or networking first. Anyone selling a three-month route straight into a security job is not being straight with you.

Full assessment of a lab environment · 4 weeks

A complete authorised assessment of a lab target: reconnaissance, findings, evidence, severities and remediation. Delivered as a professional report a client could act on.

Security improvement for a real organisation

With written permission, review a real small organisation's practices — accounts, backups, patching, phishing exposure — and deliver a prioritised, costed improvement plan. No testing without authorisation.

A final assessment marked out of 100; the pass mark is 60, with 120 minutes to complete it.

• Networking and systems (25 marks)
• Web application vulnerabilities, practical (30 marks)
• Detection and incident response (20 marks)
• Law, scope and professional conduct (25 marks)

A completion letter is issued to a student who has met the completion criteria AND has at least one project verified by their trainer. Meeting the 60/100 pass mark alone earns a record of completion, not a certificate: the certificate says a trainer examined finished work and stands behind it, which is the whole reason an employer can check it. Every letter carries a verification code and is checkable at /verify-letter, and it states attendance, assessment result and the project titles verified.

Pakistan's National Vocational & Technical Training Commission publishes a course-contents document for the trades it funds. This programme is mapped to Certified Ethical Hacker (CEH) — 12 weeks, 4 hours a day, 240 contact hours.

Published by NAVTTC and reproduced here so you can check our syllabus against it. We teach it to those hours: 240 contact hours over 12 weeks, the same as the standard. Read the NAVTTC document.

Roles this prepares you for

• IT Support with security responsibility
  The most common genuine first step, and this programme is aimed squarely at it.
• SOC Analyst (Tier 1)
  Monitoring and triage. Usually requires networking depth as well.
• Junior Security Analyst
  Typically reached after one to two years in IT or networking, not directly from a course.

What is the fee for the Cyber Security course?

The course fee is PKR 60,000. The fee and syllabus are published on this page before you apply.

How long is the Cyber Security course?

It runs for 3 Months, with 240 contact hours.

Can I join from another city?

On campus in Faisalabad, or live online from anywhere in Pakistan. You can apply online from any city.

Do I need any experience before joining?

The course is pitched at intermediate level. Recommended before you start: Comfortable with computers and networks; Free: Cybersecurity Fundamentals.

How am I assessed, and what certificate do I get?

There is a final assessment marked out of 100; the pass mark is 60. Students who pass and have project work verified by their trainer receive a completion letter with a verification code that any employer can check.

What jobs can this course lead to?

It is aimed at roles such as IT Support with security responsibility, SOC Analyst (Tier 1), Junior Security Analyst. BvLogic Academy does not guarantee a job, an income or a timeframe.

Interested in this programme?

Apply now, or try the subject free first: there is no reason to pay before you know you like it.