Cyber Security Training

Cyber security and ethical hacking training

Hands-on cyber security and ethical hacking training that ends with the deliverable client work is built around — a professional penetration-test report you wrote yourself, and a portfolio you can show an employer. Every technique is practised inside an isolated lab we provide, against targets we own. If you are here to get into an account, a phone or a person, read the charter below before you go any further: we do not teach that, and we will not help with it.

Book a free scoping call All services

What you will learn

Search for an ethical hacking course and you will find guaranteed-job banners and syllabi that stop at the tool list. We teach it in the order a professional engagement runs: scope and written authorisation first, methodology in the middle, and a risk-ranked report at the end that a client could act on. Every offensive technique on this syllabus is paired with the defence that stops it, because the roles most people are hired into first are defensive ones. Our published material describes what you will study and why it matters professionally — it contains no exploit code, no payloads and no instructions for attacking live systems. Authorisation is not a disclaimer at the bottom of this page; it is Module 1, and it is the condition on which lab credentials are issued at all.

Module 1 — Information security foundations, ethics and cyber law

The vocabulary of the field — CIA triad, threat, vulnerability, risk, attack surface, defence in depth — and the legal frame that separates a security professional from an offender. You study why written authorisation, a signed scope and rules of engagement are the precondition for any test, and you work through what an engagement contract and a responsible-disclosure timeline look like. The module ends with you signing the programme ethics charter, which is how lab credentials are issued.

Module 2 — Networking for security practitioners

TCP/IP and the OSI model rebuilt from a tester's and a defender's point of view: addressing and subnetting, ports and services, DNS, DHCP, ARP, HTTP and TLS, NAT and VPNs, and where firewalls, proxies and intrusion detection sit in the path. You capture and dissect traffic you generate inside your own lab rather than memorise diagrams, until you can read a packet trace and explain what a host was doing and why. Capturing traffic on a network you do not own or administer is interception, and it is out of bounds on every exercise here.

Module 3 — Operating systems and building your lab

You build the practice range you will use for the rest of the programme — a hypervisor, a Kali Linux working machine, Windows and Linux targets, all on an isolated virtual network with no route to the internet, with a snapshot before every exercise and a reset when something breaks. Alongside it you gain working fluency in the Linux command line and permission model, service and process management, Windows administration and basic shell scripting. From here on, the difficulty is the security, not the terminal.

Module 4 — Footprinting, reconnaissance and OSINT

Working only from what an organisation has already published — domains and subdomains, DNS and certificate transparency records, exposed documents and metadata, technology fingerprints and organisational footprint. Every reconnaissance exercise runs against a fictional company we maintain, never against a real organisation or a real person, and no personal data is collected; the output is a structured attack-surface report. The defensive half of the module is what an organisation should reduce, monitor or remove from public view.

Module 5 — Scanning, enumeration and vulnerability assessment

Moving from passive to active discovery inside the lab: host discovery, port scanning, service and version detection, then enumerating what services disclose — shares, users, directory entries, web stacks — and turning raw output into a prioritised inventory of the estate. You weigh scan speed against the load a scan places on a target and how visible the activity is to the people running that network, and you watch the same activity arrive in the defender's console, which is the point at which scanning stops looking invisible. Authenticated and unauthenticated scanning follows, with the part a scanner cannot do: validating findings, discarding false positives, correlating what is left with CVE and CWE data, scoring severity with CVSS v3.1 and v4.0, and layering on the signals teams now prioritise with — EPSS exploitation probability and the CISA Known Exploited Vulnerabilities catalogue — so the output is a defensible risk-ranked list rather than a tool dump.

Module 6 — Web and API security I: the OWASP Top 10 and proxy-based testing

HTTP seen through an intercepting proxy: requests and responses, session and cookie handling, authentication and authorisation flows, and why client-side controls are not security controls. You work the current OWASP Top 10 on intentionally vulnerable applications, concentrating on broken access control, security misconfiguration, cryptographic failures and authentication failures, and on the categories the 2025 revision added for software supply chain failures and the mishandling of exceptional conditions — which is where dependency, build-pipeline and error-handling risk now sits. Every finding is written up in terms a developer can act on, because that is the form a fix starts from.

Module 7 — Web and API security II: injection, content discovery and automation

The injection family — SQL injection, command injection and cross-site scripting — taught from root cause, which is untrusted input reaching an interpreter, through to the correct fix: parameterised queries, allow-listing, output encoding and least privilege, alongside the request-forgery and path-traversal classes the current list places under broken access control. The same root-cause treatment extends to APIs: REST and GraphQL endpoints, token and JWT handling, and broken object-level and function-level authorisation, which the OWASP API Security Top 10 puts ahead of injection because APIs expose object references a user interface never did. You also learn systematic content discovery against the lab applications — the endpoints, backups and admin paths an application never links to — and how to use automated tooling responsibly and read its output critically rather than pasting it into a report.

Module 8 — Passwords, authentication and applied cryptography

How credentials fail: weak and reused passwords, poor hashing, missing multi-factor authentication, default accounts and credential stuffing. In the lab you measure the strength of hashes you generate from your own test accounts — never a breached dump, which is not course material here — then convert the result into policy: password managers, passphrases, MFA, lockout, rate limiting and modern hashing. The cryptography half covers hashing versus encryption versus encoding, salting and key stretching, public-key infrastructure, certificates and TLS.

Module 9 — Controlled exploitation, privilege escalation and lateral movement

Taking a validated vulnerability through to a controlled proof of concept on purpose-built vulnerable machines — the step that turns a scanner finding into demonstrated business risk — worked through an exploitation framework in a structured way: target selection, configuration, verification, evidence capture and clean-up. What determines real impact is what happens next: local enumeration, privilege escalation paths on Linux and Windows, credential material at rest and in memory, how persistence is established and, more importantly, how it is detected, pivoting between lab segments, and Active Directory relationships. Every link in that chain is paired with the control that breaks it — patching, segmentation, service hardening, application allow-listing, least privilege, tiered administration and credential protection. All of it runs inside the range on machines built for it, logged and reverted from snapshot afterwards: no exploit development, no weaponisation, and no tooling for evading defensive products.

Module 10 — Wireless and network infrastructure security

Wi-Fi assessed against an access point you own and control, with nothing else attached and a supported adapter, or on our in-classroom radio setup for in-person cohorts: 802.11 fundamentals, the design failures in WEP and WPA2, what WPA3 changed, and rogue access point and evil-twin concepts at the level of how they are detected. Remote learners complete this module on our hosted radio range or by recorded demonstration; wireless exercises are never performed on a home, campus, workplace or shared-building network, and are not part of the take-home lab build. The module ends with you writing a hardened wireless standard — 802.1X and RADIUS, guest segregation, management-frame protection, segmentation and monitoring.

Module 11 — Social engineering and the human layer

This module is awareness and defence only: simulated phishing is taught as something run against your own consenting colleagues under a documented programme, never against third parties, and you do not write phishing content, build lure infrastructure or clone a login page on this course. You study why the human layer is the cheapest way in — phishing and spear-phishing, business email compromise, vishing and smishing, pretexting, MFA fatigue and deepfake-assisted fraud — and dissect defanged artefacts we supply: headers, SPF, DKIM and DMARC, neutralised URLs and inert attachments. You then design an awareness programme, a reporting culture and the gateway controls that support them.

Module 12 — Cloud, container and AI system security

Where the estate lives now: the shared-responsibility model, identity and access management as the perimeter, storage and network misconfiguration, secrets handling, and reading cloud audit logs into the SIEM — with container image hygiene, registry trust, and why a permissive orchestrator configuration undoes host hardening. The AI half covers the attack surface that arrived with LLM features: prompt injection and indirect prompt injection, model and data supply chain, over-permissive tool and plugin access, and AI-assisted phishing and deepfakes, framed by the OWASP Top 10 for LLM applications. Both halves are assessed as a configuration and design review written against a benchmark, with findings and remediation — not as an attack exercise.

Module 13 — Defensive security: hardening, SIEM monitoring and incident response

You change chairs and defend the estate you have spent the preceding modules testing. Hosts are hardened against the CIS Benchmarks, logs are shipped into a SIEM, detection rules are written and tuned, and alerts are triaged, escalated and mapped to MITRE ATT&CK. You then run a simulated intrusion through the full incident-response lifecycle — preparation, detection and analysis, containment, eradication and recovery, lessons learned — and produce an incident report with a timeline, which is the deliverable a SOC analyst is expected to produce.

Module 14 — Security governance, risk and compliance

The non-technical half of the profession, and often the most realistic entry route for career switchers: how ISO/IEC 27001 and the NIST Cybersecurity Framework structure a security programme, how a risk register is built and maintained, and what an auditor asks for as evidence. You work through the obligations that bite in this region — India's Digital Personal Data Protection Act, 2023, CERT-In incident-reporting timelines, PCI DSS where card data is handled, and the GDPR where EU personal data is involved. You write a policy, a risk entry and an audit evidence pack, because those are the artefacts a GRC role produces from day one.

Module 15 — Professional reporting, documentation and responsible disclosure

The deliverable clients pay for. You write a full penetration-test report — executive summary for non-technical readers, scope and methodology, risk-ranked findings with evidence and business impact, CVSS vectors, prioritised remediation and a retest plan — and then revise it after mentor review, because the revision is where report writing is learned. The module also covers evidence hygiene, the client debrief, and how coordinated disclosure to a vendor works on a fixed timeline, rehearsed against a simulated vendor contact.

Module 16 — Capstone: an end-to-end authorised engagement

A complete engagement against a purpose-built environment, from scoping to sign-off: you draft the scope and rules of engagement, obtain simulated written authorisation, execute the full methodology, then deliver the report and present it in a mock client debrief. A defensive counterpart has you detect and reconstruct another team's activity in the SIEM. What you leave with is a sanitised portfolio piece and a viva you have already rehearsed.

The toolkit you will learn

Industry-standard tooling, taught inside the lab. Knowing what each tool is for — and what it cannot tell you — matters more than memorising its switches.

Platform and lab

Kali Linux

The standard testing distribution, installed as your own virtual machine so nothing you practise ever touches a production network.

VirtualBox and VMware

Hypervisors for building the isolated range — attacker and target machines, host-only networking, and a snapshot before every exercise; Apple Silicon Macs use ARM-capable alternatives or our hosted range.

Python, Bash and PowerShell

Enough scripting to automate the repetitive half of the work — parsing scan output, building report tables, and writing the small tools that separate an operator from a tool user.

Reconnaissance and OSINT

theHarvester

Aggregating public data — subdomains, hosts, addresses — to show how much attack surface an organisation publishes without realising it. Run only against the fictional target we maintain.

Maltego

Link analysis that turns isolated facts into a graph, making third-party and supply-chain exposure visible, practised on the same fictional target. Taught on the free Community Edition, which needs an account and caps results per transform.

Shodan

Read-only exposure awareness for estates you own or are authorised to review: what is reachable from the internet, and why asset inventory is itself a security control. It is not used here to build target lists.

Scanning and vulnerability assessment

Nmap

Turning an in-scope range into an inventory of live hosts, open ports, service versions and probable operating systems.

Netcat and Ncat

The fundamentals: what a network connection actually is underneath every higher-level scanner and framework.

OpenVAS (Greenbone Community Edition) and Nessus Essentials

An open-source scanner as the workhorse for full-lab scanning, alongside a look at the commercial equivalent under its free tier — which is time-limited and capped by IP count — so what transfers is the methodology rather than the product.

Web and API testing

Burp Suite

The intercepting proxy at the centre of manual web testing. Community Edition in the labs, with no automated scanner and no saved projects — a working constraint you learn to design around.

OWASP ZAP (Zed Attack Proxy)

The free, fully featured proxy and scanner, listed under the name most people still search for: the project moved out of the OWASP Foundation in 2023 and is now maintained by its core team at Checkmarx. Includes its automation framework for testing inside a build pipeline.

SQLMap

Used strictly against lab databases to demonstrate the impact of injection flaws and to prove why parameterised queries are the fix.

Dirb, Gobuster and ffuf

Content discovery against the lab applications: the endpoints, backups and admin paths an application never links to. Dirb for the concept, Gobuster and ffuf as the maintained equivalents.

Exploitation, credentials and Active Directory

Metasploit Framework

Structured validation of vulnerabilities on purpose-built vulnerable machines, with target selection, configuration, verification, evidence capture and clean-up taught as distinct steps.

Hydra, John the Ripper and Hashcat

Credential testing in two halves: Hydra against lab services you own, to prove whether lockout and rate limiting hold and why MFA removes this class of attack rather than slowing it down; John the Ripper and Hashcat against hashes you generate from your own lab test accounts, which is what makes the economics of length over complexity tangible. Breached credential dumps are never used as course material.

BloodHound and Impacket

Graphing Active Directory relationships in the lab domain to find — and then design out — the paths by which an ordinary account reaches domain-wide control, and seeing at protocol level why tiered administration and credential protection are the controls that matter.

Traffic and wireless analysis

Wireshark

Packet-level analysis of traffic you capture inside your own lab: a handshake, a DNS lookup and a TLS negotiation seen as bytes. Equally a testing and an incident-response skill — and capturing on a network you do not own or administer is interception, which is out of bounds here.

Aircrack-ng

Wireless assessment against an access point you own or our hosted radio range — why the radio layer puts the entire load on cryptography and authentication design.

Defence, detection and forensics

Elastic Stack, Wazuh and Splunk

Detection rules, dashboards and alert tuning built in Elastic and Wazuh, whose free tiers support rule authoring and alerting; Splunk taught for search-language fluency, since its free licence does not include alerting. This is the daily work of a monitoring or SOC role.

Suricata and Snort 3

Intrusion detection on the free ET Open and Snort community rulesets: writing and tuning rules, and learning why alert fatigue is a real operational failure mode.

Autopsy and The Sleuth Kit

Disk forensics, evidence integrity and timeline reconstruction — the discipline that governs everything after an incident.

Volatility and Ghidra

On the DFIR specialisation track: memory forensics that reconstructs processes and connections a disk image cannot answer for, and static reverse engineering — both on curated samples we supply, inside an isolated, non-networked analysis VM, with learners never sourcing live malware themselves.

Who this is for

Students and final-year graduates who need a portfolio and a report, not another certificate
IT support, helpdesk and desktop staff moving into a SOC or analyst role
Network and system administrators who want depth rather than another networking primer
Developers and QA engineers moving toward application and API security
Complete beginners and non-engineering graduates starting from zero, with an honest foundation runway
Learners across India, Thailand and wider South-East Asia joining live online cohorts in English

How the programme runs

Assessment and fit
A counselling call and a short skill check place you on the right track and the right duration — and tell you honestly if this is not the programme you need. Learners must be 18 or over; applicants aged 16 and 17 are accepted only where a parent or guardian countersigns the ethics charter. You confirm your hardware, verify your identity and sign the charter before any lab credential is issued.
Foundations first
Law and ethics, networking, operating systems and lab construction come before any tool. Administrators and developers with the background can fast-track this block; beginners get the runway they need instead of being told to pick it up later.
Hands-on labs from week one
Concept session, then lab, every session. Labs start guided and become unguided as you progress — an objective and a network, not a walkthrough — and every offensive exercise has a defensive counterpart you watch in the SIEM.
Capstone and report
A full engagement against a purpose-built environment: scope document, simulated written authorisation, execution, and a professional report. Your report is reviewed by a mentor and revised at least once, because a first draft is not what a client would accept.
Certification preparation
Structured revision against the current objectives for CompTIA Security+ and CEH, with PenTest+ and practical exams on the longer tracks, plus mock tests and exam-day mechanics. Exam versions move — Security+ is mid-cycle, and OffSec now issues a renewable OSCP+ alongside the lifetime OSCP — so we tell you which version we are preparing you for, and we walk you through each body's eligibility rules before you count on any of them. We prepare you for those exams; we do not award them.
Career support
Portfolio packaging of sanitised writeups and a sample report, a skills transcript mapping your modules to recognised domains, CV and LinkedIn review, mock technical interviews and openings shared as we hear of them. Assistance and preparation — not a guaranteed job.

Three tracks, three depths

The same syllabus spine, with honestly different amounts of lab time, depth and assessed work.

3 months
A breadth-first pass across all sixteen modules. Labs are guided and walkthrough-style against single-host targets, the OWASP Top 10 is demonstrated on deliberately vulnerable applications at their easier settings, the network is a single subnet, and the SIEM appears as a demonstration and a guided search exercise rather than rule authoring. You finish with one capstone, one full penetration-test report and a set of short lab writeups. What this track is built to prepare you for: internship and SOC-support applications, a foundation certification, and an entry-level conversation about vulnerability assessment — where you land depends on you and the market. It is not OSCP-ready, and we will not pretend otherwise.
6 months
Substantially more lab time per module, and labs shift from guided to semi-guided. Active Directory becomes real content on a small multi-host domain — enumeration, attack-path mapping and tiered-admin defence — which is where internal-network testing and its defence actually live. Web and API testing goes deeper into business-logic flaws, token handling and multi-role access control; the blue-team half becomes hands-on, with you installing a SIEM, ingesting endpoint and Windows logs, authoring detection rules and running a full simulated incident. Adds scripting for security automation, and the cloud, container and AI security module in full. Deliverables: two capstones including an internal-network engagement, two professional reports with a mentor-reviewed revision cycle, an incident report and a client debrief.
1 year
The second half becomes specialisation rather than more breadth — offensive (advanced Active Directory, pivoting and tunnelling, red-team methodology), defensive and DFIR (memory and disk forensics; malware analysis and reverse engineering with Ghidra on curated samples inside an isolated, non-networked analysis VM, learners never sourcing live samples themselves; detection engineering; threat hunting), application security (API testing, mobile application security, secure code review, DevSecOps), or cloud and AI security. The range becomes multi-segment and multi-domain, engagements run with real scoping calls, time-boxing and a debrief to a mock stakeholder panel, and the terminal assessment is a time-boxed lab followed by a separate reporting window. Deliverables: four engagements across the year, four professional reports each through a mentor-reviewed revision cycle, an incident report with a reconstructed timeline, a specialisation project you scope yourself, and a portfolio pack. The difference between three months and a year is not more slides — it is far more time in the lab, several more written deliverables, and an Active Directory environment.

Lab environment

Isolated attacker and target VMs on host-only networking
DVWA
OWASP Juice Shop
WebGoat
Metasploitable and VulnHub images
A small Active Directory domain (six-month and one-year tracks)
Blue-team range: SIEM, Sysmon, Suricata, Wazuh — hands-on from six months, demonstrated on the three-month track
PortSwigger Web Security Academy (free third-party labs, used alongside ours)
Guided capture-the-flag practice on sanctioned platforms
Per-learner credentials, snapshots and resets

Two environments, deliberately separated. All exploitation, scanning and network-testing work is performed on an isolated attacker and target range Syncodian provides, on host-only networking with no route to the public internet, with per-learner credentials, a snapshot before every exercise and a one-click reset. Reconnaissance exercises are read-only and run against a fictional organisation whose domains we own; the only other outside targets are third-party training platforms such as PortSwigger's Web Security Academy, whose owners publish an explicit invitation to test them — which is itself the lesson in what authorisation looks like. Lab activity is logged and attributable to the individual, and what we collect to verify identity and log lab use, and how long we keep it, is set out in our privacy policy. Suspected misuse of lab access, and any security issue in Syncodian's own systems, can be reported to us through the contact details on this site.

The rules you agree to before you get lab access

This is a professional course in authorised, defensive security testing. We do not teach, and will not help with, getting into anyone's social media, email or cloud account; recovering or bypassing a password for an account you do not own; installing monitoring software on another person's device; altering exam results or academic records; taking a website offline; or anything involving stolen credentials, breach dumps or payment data. If that is what you came for, this is not the course for you, and we would rather you found that out here than after paying us. Every learner signs the charter below before their first lab session, lab credentials are issued against a verified identity, and lab activity is logged.

I will test only the lab Syncodian provides, systems I own outright, or systems I hold specific written permission from an authorised person to test — obtained in writing before I begin, and inside the agreed scope. Anything not explicitly in scope is out of scope, including when I believe the vulnerability there is obvious, and being employed by an organisation is not authorisation to test it.
I will treat reconnaissance as testing: I will not profile, enumerate or gather information on a real organisation or a real person outside an authorised engagement, and I will not collect personal data in the course of any exercise.
I will do no harm: no destruction or alteration of data, no denial-of-service techniques, only the minimum evidence needed to prove a finding, and I stop the moment I risk causing damage or disruption.
I will keep what I learn confidential — client data, personal data, credentials, findings and system detail — store it securely, share it only with those entitled to it, and destroy it when the engagement ends. I will not obtain, hold, use or trade in breached credential dumps, stolen data or payment data, in the lab or outside it, including as wordlists or cracking material.
I will disclose responsibly: report privately through the correct channel, allow reasonable time for a fix, never publish an unfixed vulnerability, and never demand payment or silence in exchange for details.
If I stumble on a genuine vulnerability while learning, I will stop testing, document what I saw and bring it to my instructor — rather than continuing to probe, taking data, telling anyone else or posting about it.
I will not share, sell or help anyone else misuse what I am taught, and I will not assist unauthorised access; abetment and attempt are separate offences under Sections 84B and 84C of the IT Act.
I will work within my competence, say so when something is beyond my current skill, and accept that breaching this charter means removal from the programme, withdrawal of any certificate, and cooperation with law enforcement.

Factual context, not legal advice. India's Information Technology Act, 2000 makes accessing a computer, computer system or network without the permission of its owner or the person in charge a civil wrong under Section 43, giving rise to liability to compensate the person affected; Section 66 makes the same act a criminal offence when it is done dishonestly or fraudulently, punishable by imprisonment of up to three years, a fine of up to five lakh rupees, or both. Section 75 applies the Act to acts committed outside India where the computer, computer system or network involved is located in India, which matters for learners joining from abroad. Comparable statutes apply elsewhere — Thailand's Computer Crime Act B.E. 2550 (2007, as amended), Singapore's Computer Misuse Act, Malaysia's Computer Crimes Act 1997, the United Kingdom's Computer Misuse Act 1990 and the United States Computer Fraud and Abuse Act among them. Understanding this is Module 1, not a footnote; for your own circumstances, consult a qualified lawyer. Victims of cybercrime in India can report at cybercrime.gov.in, or call 1930 for cyber financial fraud.

What it costs

We quote per learner after the assessment call, because the honest number depends on track length, delivery mode and how much lab and mentor time you need. These are the factors that move it most:

Duration and depth — a three-month foundation track versus a year with a specialisation and a multi-segment enterprise range
Delivery mode — live online cohort, in-person classroom, or a blend of the two
Lab infrastructure per learner — isolated range time, Active Directory and SIEM environments, and how long access continues after the course ends
Certification exam vouchers, which are bought from the certifying body at its price — we tell you in writing, before you pay, whether one is included
Mentor time — batch size, one-to-one report reviews, mock interviews and repeat-session entitlement

Fees are quoted in writing before you enrol, itemised so you can see what is included: track duration, lab access period, mentor review hours, and whether any certification voucher is bundled. Corporate and college batches are quoted per cohort.

Questions

Do you guarantee placement?

No. Nobody in this field can honestly guarantee a security job, and the institutes advertising one are selling a promise they do not control. We offer placement assistance — portfolio packaging, CV and LinkedIn review, mock technical interviews and sharing openings we hear about — plus skills aligned to what security job ads ask for.

Is this legal? Could I get into trouble?

Authorised testing is legal and standard, and in India's regulated sectors the regulators' own security frameworks require regulated entities to test their systems. Unauthorised testing is not, and there is no ethical-hacker exemption anywhere in the statute. Under the Information Technology Act, 2000, accessing a computer without the owner's permission is a civil wrong under Section 43, giving rise to liability to compensate the person affected, and Section 66 makes the same act a criminal offence when it is done dishonestly or fraudulently. The whole programme is built so you never have a reason to look for an unauthorised target: the lab is more interesting than the open internet, and every engagement module begins with scope and written permission.

Can I practise on a real website if I am careful?

No — and the first reason is not that you will be caught. An unauthorised scan lands in someone's alert queue at two in the morning, an unauthorised test can take a service down, and the person who wears that is an on-call engineer who never agreed to be your practice target. The second reason is published legal context rather than a threat from us: under the CERT-In directions of 28 April 2022, targeted scanning or probing of critical networks and unauthorised access to IT systems are incidents that service providers, intermediaries, data centres, body corporate and government organisations must report to CERT-In within six hours of noticing them or being made aware of them; ICT system logs are maintained for a rolling 180 days within Indian jurisdiction, system clocks are synchronised to national time servers, and data centre, VPS, cloud and VPN providers must retain validated customer records for five years. An FIR on record is exactly the kind of thing a security employer's background check is designed to surface.

Can I do bug bounty or test real systems after this?

Yes — through a published bug bounty or vulnerability disclosure programme, and only inside the scope and safe-harbour terms that programme publishes. That is the one legitimate route to a target you do not own, and it works because the owner has given permission in advance and in writing. A programme's scope page is a legal document: assets not listed are out of scope, prohibited techniques stay prohibited regardless of intent, and testing a company that runs no programme at all is unauthorised access no matter how politely you report it afterwards. The reporting module covers how to write a submission a triage team will accept.

Does this course give me CEH or another certification?

No. You receive a Syncodian course-completion certificate. The industry exams are separate and are awarded by their own bodies — CEH by EC-Council, Security+ and PenTest+ by CompTIA, eJPT by INE Security, OSCP by OffSec — and bought from them at their prices; Syncodian is not an accredited or authorised training partner of any of them, and all marks belong to their owners. Two gates are worth knowing before you enrol: without official EC-Council training, CEH is open to you only through an exam-eligibility application requiring documented information-security work experience, professional references and an application fee, and OffSec sells OSCP as a course-and-exam bundle rather than a standalone exam, now issuing a renewable OSCP+ alongside the lifetime certification. We prepare you for these exams, and we tell you in writing before you pay whether any voucher is included — an undisclosed voucher is a common hidden cost in this market.

Do I need to know how to code, or a technical degree?

Not to start, and not to be eligible — the foundation modules exist for exactly that, and Modules 2 and 3 build the networking and command-line base rather than assuming it. Be realistic about the ceiling and the first destination, though. Scripting in Python, Bash or PowerShell becomes steadily more important as you move toward testing and automation, which is why the longer tracks teach it rather than pretending it stays optional; and SOC analyst, GRC and compliance roles are the ones people most often target first from a standing start, while testing roles take longer to reach. We will say that on the assessment call rather than sell you the longest track by default.

Is it really hands-on, or slides with a tool demo at the end?

Labs from week one, and the ratio tilts further toward lab time as the programme goes on. The assessed artefacts are practical: an OSINT report, lab writeups, a SOC incident report with a detection timeline, and a full penetration-test report that gets revised after review. Employers in this field consistently ask to see work rather than certificates — which is exactly why we grade a report rather than a multiple-choice test.

What laptop do I need?

Enough machine to run virtual machines: a 64-bit processor with hardware virtualisation enabled, and stable broadband. For the three-month track, 8 GB of RAM is the floor, 16 GB is better, and 100 GB of free disk. For the six-month and one-year tracks you are running an Active Directory domain and a SIEM at the same time — plan on 16 GB minimum, 32 GB if you can, and 250 GB of free disk, or use our hosted range instead. Apple Silicon Macs need ARM-compatible images or the hosted range, and the wireless module needs an external USB adapter that supports monitor mode and packet injection plus an access point you own; we send the current supported list before that module. Tell us your specification on the assessment call — hardware is a common reason learners stall early, and it is far easier to fix before you enrol than after.

How many hours a week does this take?

Plan on roughly eight to ten hours a week on the three-month track, and six to eight sustained hours a week on the longer ones, with lab time as the larger half of that. Working professionals can attend the concept session live and do the labs at night or at weekends. If your honest availability is two hours a week, say so — a longer track you finish beats a compressed one you abandon.

Who is teaching, and what have they actually done?

Working engineers from our delivery team, and we will tell you the background of the trainer for your batch before you enrol — including where their experience is in teaching rather than field work. Ask us for it, and ask every institute you are considering. "Certified" and "has run live engagements" are different things.

What are the refund, missed-session and lab-access terms?

They are written down and given to you before you pay: the refund window, whether sessions are recorded and for how long, the policy on repeating a missed session or an entire module, how long lab access continues after the course ends, and what an extension costs. Post-course lab expiry and repeat-class fees are common hidden costs in this market, so ask us — and ask everyone else — to put both in writing.

Is the market saturated, and will AI take the entry-level jobs?

The credible signal is a skills problem more than a headcount one: employers describe gaps in what their teams can do rather than a shortage of applicants, and the industry workforce studies have shifted their emphasis from a headline global shortage figure toward skills gaps inside existing teams. Read that as a warning about generic certificate-holders rather than about the field — someone who can show work, a real report, a detection rule they wrote, a lab they built and defended, has more to talk about in an interview than a certificate number. On AI specifically: it is already absorbing first-pass alert triage and log summarisation, which raises the floor on what an entry-level analyst is expected to do rather than removing the role — the judgement calls, the business context and the written communication are what remain, and they are what we grade. It also creates work, which is why Module 12 exists: someone has to review the AI features now shipping in everyone's products.

Ready to start learning?

Tell us which course, for how long, and when you want to begin — we reply within one business day with batch options and fees.

Related services

Skill DevelopmentSkill development and IT training Project TrainingFinal-year project training Custom SoftwareCustom software development