Cyber Defence
CYBERDEFENCE
Run a scoped assessment end to end — rules of engagement, scanning, manual validation, CVSS scoring and a report a client can act on. · Live online across West Bengal

VAPT Course in West Bengal

VAPT is a service, not a hobby. You learn to scope an engagement, obtain authorisation in writing, enumerate a target, scan with Nessus and OpenVAS, manually validate every finding so false positives never reach the client, rate them with CVSS, and write a report with an executive summary, evidence and realistic remediation steps.

Last updated: 6 August 2026

Book a free counselling call +91 75175 72000

What this track will not do for you

This is training. Doing paid VAPT work legally requires written client authorisation for every single engagement — skill is not permission, and testing a system without it is an offence under the IT Act regardless of your intent. Nessus Essentials and Burp Community also have hard limits; professional licences are a real business cost.

Who this is for

For testers who can already find a vulnerability but cannot yet deliver a professional assessment, IT auditors, and anyone doing compliance-driven testing for banks, hospitals or government tenders. Not for absolute beginners — you need working knowledge of networking, Linux and web applications before any of this is useful.

Prerequisites: Linux command line, TCP/IP, HTTP request and response structure, and basic web application concepts. Prior ethical hacking exposure helps considerably. If you have never run Nmap or intercepted a request in a proxy, take our ethical hacking course first; this track assumes those basics are already in place.

The picture in West Bengal

Kolkata anchors a services and trading economy: finance, healthcare, higher education and wholesale distribution for the whole of eastern India. Salt Lake Sector V and New Town hold the IT and BPO campuses. Older industrial belts at Howrah, Durgapur and Asansol run engineering, steel and coal. Jute along the Hooghly and tea in Darjeeling and the Dooars remain large employers, both under strain.

Smartphones and UPI are effectively universal across Kolkata, Howrah, Siliguri and the district towns, down to neighbourhood sweet shops and chemists taking QR payments. Fibre is good inside the city, thinner in the Sundarbans and the northern hill blocks. A great many family-run firms still trade on a phone number and a WhatsApp catalogue and have never owned a website.

Sectors hiring for this in West Bengal

Information technology & BPOJute & textilesTea (Darjeeling & Dooars)Iron, steel & engineeringHealthcare & educationWholesale trade & logistics

Main centres: Kolkata · Howrah · Durgapur · Asansol · Siliguri · Bardhaman

VAPT Course syllabus

3.5 months · 65 hours (live online + recordings). Every module is hands-on — you work on your own machine from West Bengal, never against systems you do not own.

01. Engagement Setup and Legal Ground

  • Scoping, asset lists and rules of engagement
  • Written authorisation and why it is non-negotiable
  • IT Act 2000 sections 43 and 66 and your personal exposure
  • Testing windows, blast radius and production safety
  • NDA, data handling and secure deletion of client data

02. Network Vulnerability Assessment

  • Discovery and service enumeration with Nmap
  • Credentialed versus uncredentialed Nessus scans
  • OpenVAS scan policy tuning
  • Separating scanner noise from real risk
  • Patch level and end-of-life software analysis

03. Exploitation and Validation

  • Proving a finding without damaging production
  • Metasploit inside an agreed scope
  • Privilege escalation checks on Linux and Windows
  • Knowing exactly when to stop
  • Capturing clean, reproducible evidence

04. Web Application Testing

  • Working the OWASP Top 10 in a methodical order
  • Burp Suite proxy, repeater and intruder workflow
  • Authentication, session and access control flaws
  • Injection testing and safe proof of concept
  • Business logic issues no scanner will ever find

05. CVSS, Risk and Reporting

  • Constructing a CVSS v3.1 vector you can defend
  • Adjusting severity for business context
  • Executive summary a non-technical reader understands
  • Technical findings with reproduction steps and screenshots
  • Remediation advice the client can actually implement

06. Retest, Compliance and Client Handling

  • Retest cycle and closure evidence
  • CERT-In, RBI and PCI-DSS driven assessment expectations
  • Handling client pushback on findings
  • Building your own report template and portfolio

Tools used

NmapNessus EssentialsOpenVAS / GreenboneBurp Suite CommunityMetasploit FrameworkSQLmapNiktoHydraWiresharkCVSS v3.1 calculator

Where this leads

RoleTypical band
VAPT Analyst₹4–9 LPA
Penetration Tester₹6–15 LPA
Security Consultant (assessments)₹7–16 LPA
Application Security Analyst₹6–13 LPA

Salary bands are indicative ranges across India and vary widely with skill, city and employer. Public aggregators disagree considerably on specialist roles, so treat any single figure — including these — as a range, not a promise. We do not guarantee placement.

Fees

These are our published course fees. Specialist tracks like the vapt course are quoted on the counselling call, because the right scope depends on what you already know — we will not sell you six months of content to teach you something you can cover in six weeks.

Cyber Security Course3–4 months₹15,000
Ethical Hacking Course (CEH-aligned)6 months₹60,000
Digital Forensics2 months / 35 hours₹10,999
CCNA Networking2 months / 45 hours₹8,999

EMI available. No separate lab, material or certificate charges. Vendor exam vouchers (EC-Council, OffSec, CompTIA, AWS, Microsoft) are bought from the vendor — we do not resell them.

VAPT Course in West Bengal — FAQs

Is the VAPT Course worth doing from West Bengal?

▾
VAPT is a service, not a hobby. You learn to scope an engagement, obtain authorisation in writing, enumerate a target, scan with Nessus and OpenVAS, manually validate every finding so false positives never reach the client, rate them with CVSS, and write a report with an executive summary, evidence and realistic remediation steps. Locally, Smartphones and UPI are effectively universal across Kolkata, Howrah, Siliguri and the district towns, down to neighbourhood sweet shops and chemists taking QR payments. The employers who value this here sit in information technology & bpo, jute & textiles, tea (darjeeling & dooars). Classes are live online, so where in West Bengal you live changes nothing about the teaching, the labs or the certificate.

What do I need to know before starting?

▾
Linux command line, TCP/IP, HTTP request and response structure, and basic web application concepts. Prior ethical hacking exposure helps considerably. If you have never run Nmap or intercepted a request in a proxy, take our ethical hacking course first; this track assumes those basics are already in place.

What will this NOT do for me?

▾
This is training. Doing paid VAPT work legally requires written client authorisation for every single engagement — skill is not permission, and testing a system without it is an offence under the IT Act regardless of your intent. Nessus Essentials and Burp Community also have hard limits; professional licences are a real business cost.

How is VAPT different from an ethical hacking course?

▾
Ethical hacking teaches technique. VAPT teaches delivery: scoping, authorisation, structured testing, CVSS scoring and a report the client is paying for. Most people who struggle as consultants struggle at the report and the client conversation, not at the exploit.

Can I start freelancing after this course?

▾
You can, provided every client signs an authorisation and scope document before you touch anything. Realistically most people get their first paid work through an employer or a senior tester who signs off the engagement, then go independent once they have references.

VAPT course ke baad ek complete report bana paunga kya?

▾
Haan, wahi is course ka main output hai. Aap apne lab targets par assessment karke executive summary, findings, CVSS score, evidence aur remediation ke saath poori report banaoge. Interview mein dikhane ke liye yahi sabse strong cheez hoti hai, certificate se bhi zyada.

Do you provide licensed Nessus Professional or Burp Suite Professional?

▾
No. We teach on Nessus Essentials and Burp Suite Community, which are free and sufficient to learn the full workflow. Commercial licences are bought by you or your employer when real client work begins, and they are a genuine cost to plan for.

We have no office in West Bengal

Cyber Defence has one campus — Red Square Market, Hisar, Haryana 125001 — and teaches West Bengal live online. We do not list addresses we do not have, we publish no star ratings because we have no verified review corpus, and we do not guarantee placement.

We issue a Cyber Defence certificate with a public verification link. We are not an authorised training centre for EC-Council, OffSec, CompTIA, AWS or Microsoft, and we do not resell their exam vouchers.

Ask whether this track is right for you

Free call with Amit Kumar. If a shorter track or a different starting point suits you better, that is what you will hear.

Call +91 75175 72000