Short answer: A complete cyber security syllabus in 2026 covers networking and operating-system fundamentals, Linux, information security basics, cryptography, ethical hacking, web/API/network penetration testing, VAPT, cloud security, malware analysis and SOC/incident response — typically delivered over 3 to 6 months with hands-on labs.
What does a cyber security syllabus include in 2026?
A modern cyber security syllabus balances fundamentals, offensive skills, defensive skills and compliance. Employers in 2026 want practitioners who can not only understand threats but actually test systems, respond to incidents and speak the language of compliance. A syllabus that is all theory and no lab work produces certificates but not job-ready engineers. Below is the full module-by-module syllabus used in Cyber Defence's courses, mapped to real job roles and real tools.
Full cyber security syllabus: modules & topics
| Module | Key topics | Level |
|---|---|---|
| 1. Networking fundamentals | OSI/TCP-IP, IP, DNS, HTTP/S, ports, subnetting | Beginner |
| 2. Operating systems & Linux | Windows internals, Linux CLI, Kali Linux, Bash | Beginner |
| 3. Information security basics | CIA triad, risk, threats, controls, policies | Beginner |
| 4. Cryptography | Symmetric/asymmetric, hashing, TLS, PKI | Intermediate |
| 5. Ethical hacking | Recon, scanning, enumeration, exploitation | Intermediate |
| 6. Web application security | OWASP Top 10, Burp Suite, sqlmap | Intermediate |
| 7. API & mobile security | OWASP API Top 10, Android/iOS testing | Intermediate |
| 8. Network penetration testing | Nmap, Metasploit, privilege escalation | Advanced |
| 9. VAPT & reporting | CVSS scoring, methodology, report writing | Advanced |
| 10. Cloud security | AWS/Azure/GCP, IAM, misconfigurations | Advanced |
| 11. Malware & forensics | Analysis basics, digital forensics, IR | Advanced |
| 12. SOC & monitoring | SIEM, log analysis, threat detection | Advanced |
| 13. Compliance & law | DPDP Act 2023, ISO 27001, PCI-DSS | All |
Module 1–4: Foundations
Every strong syllabus starts with fundamentals. You learn how networks move data, how operating systems work, and the core security principles (confidentiality, integrity, availability). Skipping these foundations is the single biggest reason beginners struggle later — you cannot exploit a web app if you do not understand HTTP, and you cannot secure a server if you cannot navigate Linux. Cryptography teaches how data is protected in transit and at rest, which is essential before any offensive or defensive work.
- TCP/IP, DNS, HTTP/HTTPS and how packets flow across a network.
- Linux command line and Kali Linux, the standard penetration-testing distribution.
- Risk management, threat modelling and the purpose of security controls and policies.
- Encryption, hashing, digital signatures and public-key infrastructure (PKI).
Module 5–9: Offensive security & VAPT
This is the heart of a practical cyber security syllabus. You move from theory to hands-on hacking in a controlled lab, then into professional testing methodology that mirrors real client work.
- Ethical hacking: reconnaissance, scanning, enumeration and exploitation with Nmap and Metasploit.
- Web app security: the OWASP Top 10 — injection, broken access control, XSS — using Burp Suite and sqlmap.
- API & mobile: the OWASP API Security Top 10 and Android/iOS app testing.
- Network pentesting: pivoting, privilege escalation and lateral movement across an internal network.
- VAPT & reporting: CVSS scoring, structured methodology and writing client-ready reports that non-technical stakeholders can act on.
Report writing deserves special mention: many talented hackers fail interviews because they cannot communicate findings clearly. Our syllabus treats reporting as a core skill, not an afterthought. If you want to understand these concepts before enrolling, read our guides on what is penetration testing and vulnerability assessment vs penetration testing.
Module 10–13: Advanced & defensive skills
Modern security is not only about attacking — the highest-paid roles blend offensive and defensive knowledge. These modules round out a well-prepared professional:
- Cloud security: securing and testing AWS, Azure and GCP; IAM policy design and storage misconfigurations.
- Malware & forensics: basic malware analysis, digital forensics and incident response fundamentals.
- SOC & monitoring: SIEM tools, log analysis and threat detection for blue-team roles.
- Compliance & law: the DPDP Act 2023, ISO 27001 and PCI-DSS — critical for the Indian job market and for client-facing work.
Tools you will master
Hands-on tool fluency is what separates a certificate from employability. Across the syllabus you will use:
- Nmap — network discovery and scanning.
- Nessus / OpenVAS — vulnerability assessment.
- Burp Suite — web application testing.
- Metasploit — exploitation framework.
- nuclei & sqlmap — automated scanning and SQL injection.
- Wireshark — packet analysis.
Prerequisites and who should enrol
The foundational track needs no prior security experience — just basic computer literacy and curiosity. Students, fresh graduates, IT support staff and career-switchers all start here. The advanced ethical hacking track suits those who already understand networking basics or have completed the foundational course and want to work as professional penetration testers. No coding is required to begin, though basic scripting in Bash and Python is introduced and helps a great deal in the advanced modules.
Course duration, fees & format
Cyber Defence offers two clear tracks:
- Cyber Security Course — foundational, covers modules 1–7 and compliance. ₹15,000, 3–4 months.
- Ethical Hacking / CEH-aligned Course — the full syllabus including advanced VAPT, cloud and SOC. ₹60,000, 6 months.
Both are hands-on, lab-driven and taught by founder Amit Kumar (CEH, CRTA), who also runs Cyber Defence's VAPT services — so you learn from real client engagements, not just slides. Cyber Defence is ISO-certified and GeM-registered, and students receive a course completion certificate.
Career paths after this syllabus
Completing this syllabus opens doors to some of the fastest-growing roles in Indian tech:
- Penetration Tester / VAPT Analyst
- Security Analyst / SOC Analyst
- Ethical Hacker
- Cloud Security Engineer
- Cyber Security Consultant
Demand for these roles continues to outstrip supply across India, and practical, tool-based skills are what employers screen for most heavily.
How this syllabus is delivered
A syllabus is only as good as the way it is taught. Cyber Defence delivers every module through a blend of concept sessions and hands-on labs, so you practise each technique on realistic, vulnerable targets in a safe environment. You will build a home lab, capture flags, complete a full mock VAPT engagement, and write a professional report — the same deliverable you would produce for a paying client. Learning by doing is what turns knowledge into the muscle memory employers pay for. Doubt-clearing sessions, recorded lessons and a supportive peer community keep you moving even when a topic is tough.
Certifications this syllabus prepares you for
The topics map closely to several industry certifications, so your study doubles as exam preparation:
- CEH (Certified Ethical Hacker) — the ethical hacking, scanning and exploitation modules align directly.
- CompTIA Security+ — the fundamentals, cryptography and compliance modules cover its domains.
- OSCP — the network pentesting, privilege escalation and reporting work builds the right mindset for this hands-on exam.
- CRTA — red-team aligned skills reinforced throughout the advanced track.
Our founder Amit Kumar holds both CEH and CRTA, so the teaching reflects what these exams and real employers actually test.
A suggested month-by-month roadmap
For the six-month ethical hacking track, a typical progression looks like this:
- Month 1: networking, operating systems, Linux and security fundamentals.
- Month 2: cryptography and the ethical hacking lifecycle — recon, scanning, enumeration.
- Month 3: web application security and the OWASP Top 10 with Burp Suite.
- Month 4: API and mobile security, plus network penetration testing.
- Month 5: VAPT methodology, CVSS scoring, cloud security and report writing.
- Month 6: malware, forensics, SOC monitoring, compliance and a capstone project.
The foundational three-to-four-month course follows the same path at a gentler pace, focusing on modules one to seven plus compliance.
How this syllabus compares to a college degree
A university degree in computer science or IT gives broad theoretical grounding but rarely enough hands-on security practice to make you job-ready. A focused cyber security syllabus like this one is shorter, cheaper and far more practical — you spend your time exploiting real targets and writing real reports rather than sitting through general theory. Many of our students already hold a degree and take this course to become employable in security specifically. Others use it as a fast, affordable route into tech without a four-year commitment. Both paths work, because employers in security care most about demonstrable skills, a portfolio of practical work, and relevant certifications — all of which this syllabus is designed to produce.
Skills you will have by the end
By completing the full track you will be able to:
- Set up and operate a Kali Linux penetration-testing environment confidently.
- Perform reconnaissance, scanning and enumeration against a target.
- Identify and exploit OWASP Top 10 web and API vulnerabilities.
- Conduct a structured network penetration test with privilege escalation.
- Score findings with CVSS and write a clear, client-ready VAPT report.
- Understand cloud security, SOC monitoring and Indian compliance requirements.
These are exactly the capabilities hiring managers test for in interviews and technical assessments.
FAQ
What is the syllabus of a cyber security course?
It covers networking, Linux, security fundamentals, cryptography, ethical hacking, web/API/network penetration testing, VAPT, cloud security, forensics, SOC operations and compliance such as the DPDP Act 2023.
How long does it take to complete a cyber security course?
Cyber Defence's foundational course runs 3–4 months, while the full CEH-aligned ethical hacking programme runs about 6 months.
Do I need programming to learn cyber security?
No coding is required to start, but basic scripting (Bash, Python) helps a lot for advanced modules and is introduced during the course.
What are the fees for a cyber security course in India?
At Cyber Defence the foundational cyber security course is ₹15,000 and the CEH-aligned ethical hacking course is ₹60,000.
Is this syllabus aligned with CEH?
Yes, the advanced ethical hacking track is CEH-aligned and taught by a CEH- and CRTA-certified instructor, covering the same domains plus practical VAPT.
Will I get hands-on VAPT experience?
Yes. The syllabus includes lab-based exploitation, CVSS scoring and report writing, drawn from real VAPT engagements Cyber Defence delivers.
Ready to start a cyber security career in 2026? Call Cyber Defence at +91-75175-72000 to enrol or get a free syllabus walkthrough and career-path consultation.