Cyber Security Course Syllabus (2026): What 12 Courses Actually Teach
By Deepak Sharma.
Published . 12 min read
Topics: Cyber Security, Syllabus, Ethical Hacking, India, Original Research
By Deepak Sharma, BootcampGuide. Every module list below was read off the provider's, exam body's or university's own page or official PDF on 28 October 2026. Module names are quoted as published; counts and sums are our own. See sources.
A cyber security course syllabus in India is built on four subjects that almost every course teaches: networking, cryptography, attacks and vulnerabilities, and operating systems, Linux especially. Most add ethical hacking, incident response and web application security. Where courses really differ is everything after that: digital forensics, malware analysis, cloud security, SIEM tools for SOC work, and now AI security.
We read 12 syllabi side by side: Cisco's free career path, NPTEL, Google, the CompTIA Security+, CEH and ISC2 CC exams, both C-DAC programmes, IIT Kanpur's online PG Diploma, a five-year degree from National Forensic Sciences University, and two private programmes. Below is what each one teaches, how many hours it gives each subject, and how to tell which syllabus fits the job you want.
The common cyber security syllabus
| Subject | What it covers | In how many of the 12 syllabi |
|---|---|---|
| Networking | OSI model, IP addressing and subnetting, TCP/UDP, routing, firewalls | 11 |
| Cryptography | Encryption, hashing, digital signatures, PKI | 10 |
| Ethical hacking and penetration testing | Reconnaissance, scanning, exploitation, reporting | 9 |
| Incident response | Detecting, containing and recovering from an attack | 8 |
| Operating systems | Linux and Windows administration and hardening | 8 |
| Cloud security | Securing AWS-style infrastructure and cloud services | 7 |
| Risk, governance and compliance | Policies, standards (ISO 27001, NIST), risk assessment, law | 7 |
| Web application security | OWASP Top 10, SQL injection, XSS, Burp Suite | 7 |
| Security monitoring and SIEM | Log analysis, alerts, Splunk or Chronicle | 6 |
| AI security | Risks in AI systems, AI-assisted attacks and defence | 6 |
| Python and scripting | Automating security tasks | 5 |
| Malware analysis | How malicious software works and how to analyse it | 5 |
| Digital forensics | Disk, memory, mobile and network evidence | 5 |
Counted from the module, course and domain names each syllabus publishes, not from what a teacher might cover in passing. "AI security" counts Security+ V8, which launches on 17 November 2026.
Key takeaway: The first half of any good syllabus looks the same everywhere: networking, operating systems, cryptography, attacks. Judge a course by the second half and by the hours. A course that names forensics, SIEM or cloud security but gives no hours for them is listing topics, not teaching them.
Three kinds of cyber security syllabus
The 12 syllabi fall into three groups, and knowing which one you are looking at matters more than any single module.
- Foundation and certification syllabi (Cisco, Google, Security+, ISC2 CC) lean on networking, risk and incident response. They prepare you for an entry-level or SOC role.
- Offensive, hands-on syllabi (CEH, C-DAC PGCP-CSF, ICSS, Simplilearn) lean on hacking, web application security, tools and forensics. They prepare you for penetration testing and security operations.
- Academic or management syllabi (NPTEL, IIT Kanpur, a university degree) teach theory: policy and privacy at NPTEL, cryptography at IIT Kanpur, computer science foundations at NFSU.
Free and low-cost course syllabi
Cisco Junior Cybersecurity Analyst path (free, 120 hours)
| Course | Hours | Labs | Main topics |
|---|---|---|---|
| Introduction to Cybersecurity | 6 | 7 | Attacks, protecting your data, protecting an organisation |
| Networking Basics | 22 | 13 | IPv4 and IPv6, DHCP, ARP, routing, TCP and UDP |
| Networking Devices and Initial Configuration | 22 | 19 | Switching, the Cisco IOS command line, building a small network |
| Endpoint Security | 27 | 31 | Threats and attacks, Windows, Linux, endpoint protection |
| Network Defense | 27 | 29 | Access control, firewalls, cloud security, cryptography, evaluating alerts |
| Cyber Threat Management | 16 | 16 | Governance, penetration testing, threat intelligence, CVSS, incident response |
Cisco's path is the most complete free syllabus we found: 120 hours and 115 labs (our sum), ending in a free path exam and preparing you for Cisco's entry-level CCST Cybersecurity certification. Almost half of it is networking and endpoints, which is the right foundation for a SOC role. It does not cover web application hacking or Python.
Google Cybersecurity Certificate (Coursera)
- Foundations of Cybersecurity (10 hours)
- Play It Safe: Manage Security Risks (9 hours)
- Connect and Protect: Networks and Network Security (12 hours)
- Tools of the Trade: Linux and SQL (23 hours)
- Assets, Threats, and Vulnerabilities (19 hours)
- Sound the Alarm: Detection and Response (17 hours)
- Automate Cybersecurity Tasks with Python (25 hours)
- Put It to Work: Prepare for Cybersecurity Jobs (11 hours)
- Accelerate Your Job Search with AI (6 hours)
Google names its tools: "Python, Linux, SQL, Security Information and Event Management (SIEM) tools including Chronicle and Splunk, and Intrusion Detection Systems (IDS) including Suricata." It is the only beginner syllabus with real Python and SIEM content, which makes it a good fit for SOC work. Its page is inconsistent about size: it says "8 courses" and lists nine, and claims "170 hours of instruction" while the listed course hours add up to 132.
NPTEL Cyber Security and Privacy (IIT Madras, 12 weeks)
Taught by Prof. Saji K Mathew for management students, at postgraduate level. Weeks 1 to 8 cover the CIA triad, governance, risk and compliance, contingency planning, security policy, risk management, defence technologies and access control. Weeks 9 to 12 are on privacy, including GDPR, India's DPDP Act and Aadhaar. There are no labs and no tools. It is the right syllabus for someone heading into security governance or compliance, and the wrong one for someone who wants a hands-on job.
Certification exam syllabi
CompTIA Security+
| Domain | SY0-701 (current) | SY0-801 (from 17 Nov 2026) |
|---|---|---|
| General security concepts | 12% | 16% |
| Threats, vulnerabilities and mitigations (attacks in V8) | 22% | 24% |
| Security architecture | 18% | 19% |
| Security operations | 28% | 27% |
| Security program management and oversight | 20% | 14% |
Both versions have up to 90 questions in 90 minutes, with a pass mark of 750 on a scale of 100 to 900. V8 adds AI security: "Identify risks related to AI systems, models, prompts, privacy, and data exposure." The English SY0-701 exam retires on 11 June 2027, so if you are starting a course now, ask which version it teaches.
CEH v13 (now "CEH AI")
EC-Council's CEH is structured as 20 modules with 221 hands-on labs:
- Introduction to Ethical Hacking
- Footprinting and Reconnaissance
- Scanning Networks
- Enumeration
- Vulnerability Analysis
- System Hacking
- Malware Threats
- Sniffing
- Social Engineering
- Denial-of-Service
- Session Hijacking
- Evading IDS, Firewalls, and Honeypots
- Hacking Web Servers
- Hacking Web Applications
- SQL Injection
- Hacking Wireless Networks
- Hacking Mobile Platforms
- IoT and OT Hacking
- Cloud Computing
- Cryptography
The knowledge exam is 125 multiple-choice questions in four hours. An optional six-hour practical exam of 20 challenges earns "CEH Master". ICSS's 22 ethical hacking modules, below, follow it almost in order. If a course claims to prepare you for CEH, check its modules against these 20.
ISC2 Certified in Cybersecurity (CC)
| Domain | Weight |
|---|---|
| Security Principles | 24% |
| Networking and Cloud Security Concepts | 21.3% |
| Identity and Access Management (IAM) Concepts | 20% |
| Security Governance | 17.3% |
| Security Operations and Incident Response | 17.3% |
This is the exam outline effective 1 September 2026, which ISC2 says integrates "foundational AI concepts across all five domains". The exam runs two hours, 100 to 125 items, and needs no work experience. The introduction on the same page still lists the old five domains; go by the weights table.
C-DAC syllabi, with hours
C-DAC is the only provider in our sample that publishes hours for every module. Both programmes run 24 weeks full time, for 1,200 hours including 300 of self-study.
PGCP-ITISS (IT Infrastructure, Systems and Security)
| Module | Hours |
|---|---|
| Concepts of Operating System and Administration (Windows and Linux) | 210 |
| Project | 180 |
| Fundamentals of Computer Networks | 120 |
| IT Infrastructure Management and DevOps (ITIL, Docker, Kubernetes, AWS, Terraform, Ansible) | 120 |
| Security Concepts (web application security, OWASP Top 10, mobile security, ethical hacking) | 120 |
| Advanced Programming Concepts (MySQL, Python) | 90 |
| Network Defense and Countermeasures | 90 |
| Cyber Forensics | 60 |
| Public Key Infrastructure | 60 |
| Aptitude | 60 |
| Effective Communication | 60 |
| Compliance Audit (NIST, GDPR, ISO 2700x, SOC reports) | 30 |
PGCP-CSF (Cyber Security and Forensics)
| Module | Hours | Tools named |
|---|---|---|
| Project | 180 | – |
| Ethical Hacking | 150 | Nmap, Nessus, Metasploit, Wireshark, Burp Suite, SQLMap, Hashcat |
| Pentesting and Incident Response | 120 | Kali Linux, Acunetix, Zed Attack Proxy, BeEF |
| Advanced Digital Forensics | 120 | Autopsy, FTK Imager, Volatility, WinHex |
| Python Programming for Cyber Security | 120 | Python, Jupyter Notebook |
| Secure Programming | 120 | Juice Shop, SonarQube |
| Linux and Windows Server Administration | 90 | – |
| Network Essentials | 90 | GNS |
| Security Operations and Management | 90 | Splunk, SolarWinds Security Event Manager |
| Aptitude | 60 | – |
| Effective Communication | 60 | – |
The two look alike from their names, but they train for different jobs. ITISS spends 330 hours on operating systems, DevOps and cloud infrastructure, and 120 on security concepts, of which ethical hacking is one part; it suits a security-minded systems or infrastructure role. CSF spends 270 hours on ethical hacking and penetration testing, 120 on forensics and 90 on SOC tools such as Splunk; it suits penetration testing, SOC and forensics roles. Both need an engineering or science degree with 55%. Fees are in our cyber security course fees comparison.
IIT Kanpur PG Diploma (Online) syllabus
| Type | Courses (9 credits each) |
|---|---|
| Core | Foundations of Cyber Security; Introduction to Computer Network; Introduction to Computer Systems; Introduction to Cryptography and Secure Communication |
| Elective | Hardware Security; Cryptography for Cyber Security; Secure Machine Learning; Advanced Topics in Cryptography; Basics of Cryptanalysis; Introduction to Privacy-Enhancing Technologies |
IIT Kanpur's is the most academic syllabus here. Five of its ten courses are on cryptography or cryptanalysis, and it is the only one with hardware security and secure machine learning. Each course has about three to four hours of weekly engagement: 105 minutes of recorded lectures, 60 minutes live and optional labs. You need 72 credits, in one to two years. The detailed syllabus of each course is behind a form, so we could not read topics below course level.
Cyber security degree syllabus (B.Tech)
AICTE has no model curriculum for a B.Tech in CSE (Cyber Security). It publishes one only for an 18-credit minor degree. So we read National Forensic Sciences University's five-year B.Tech–M.Tech in Computer Science and Engineering (Cyber Security), Gujarat campus:
| Semesters | Cyber security subjects |
|---|---|
| 1 to 3 | None; engineering mathematics, C, C++, Java, data structures, DBMS, plus Fundamentals of Forensic Science and Laws |
| 4 | Cryptography (with lab), Computer Networks, Operating System |
| 5 | Advance Computer Networks, Web Development Technology, Python, Wireless Communication and Mobile Computing |
| 6 | Essentials of Cyber Security |
| 7 | Vulnerability Analysis and Web Application Security; Cyber Law, Policies and Compliance; Information and Network Security; Artificial Intelligence |
| 8 | Mobile Phone Security; Malware Analysis; Incident Response Management and Threat Hunting |
| 9 | Blockchain Technology and Security, electives, major project |
| 10 | Industrial training or internship and major project |
A degree spends its first three semesters on general computer science, and the first dedicated security subject arrives in semester four. That is the main difference between a degree and a course: a short course assumes you will pick up the computer science along the way, while a degree teaches it first. Bootcamp versus degree in India sets out the trade-offs.
Private course syllabi
ICSS Diploma in Cyber Security (12 months)
ICSS publishes four module blocks: Ethical Hacking (22 modules, closely following CEH and ending with "AI in Ethical Hacking"), Networking (24 modules, CCNA-style routing and switching), Web Application Penetration Testing (18 modules, the OWASP Top 10 and Burp Suite) and Network Penetration Testing (11 modules, from Kali Linux to Active Directory attacks and report writing). It is a thorough offensive-security syllabus. It publishes no hours per module, and the Networking block lists "DHCP" twice.
Simplilearn Advanced Executive Program with IIIT Bangalore (8 months)
Twelve learning-path modules, two of them taught under the IIIT Bangalore name. They run from Operating System and Scripting, Network Security and Cryptography, and Enterprise Infrastructure Security, through Application Security, Blue Team detection and response, Ransomware and Malware Analysis, Ethical Hacking and VAPT, and Red Team tactics, to Advanced AI in Cybersecurity and a portfolio project. It is the most AI-heavy syllabus in our sample and includes CEH v13 training and the exam voucher. The page says "30+ hands-on tools" in one place and "28+ Tools Covered" in another, showing 28 logos.
Tools a cyber security syllabus should teach
| Job | Tools named in these syllabi |
|---|---|
| Network analysis | Wireshark, Nmap |
| Penetration testing | Kali Linux, Metasploit, Burp Suite, OWASP ZAP, SQLMap, Nessus, Nikto, Hydra |
| Security monitoring (SIEM) | Splunk, Google Chronicle, Suricata (IDS), SolarWinds Security Event Manager |
| Digital forensics | Autopsy, FTK Imager, Volatility, WinHex |
| Scripting | Python, SQL, Linux shell |
Note what is missing. Microsoft Sentinel, the SIEM named in both SOC job postings we read for our salary research, is not named in any of the 12 syllabi. If you are aiming for a SOC role, pair a course with Microsoft's own SC-200 learning path.
Which syllabus fits which job
| Target job | Syllabus should weight | Closest fit in our sample |
|---|---|---|
| SOC analyst | Networking, Linux and Windows, SIEM, incident response | Cisco path, Google certificate, Security+, C-DAC PGCP-CSF |
| Penetration tester | Ethical hacking, web application security, Kali, Burp Suite | CEH, ICSS, C-DAC PGCP-CSF |
| Digital forensics | Disk, memory and mobile forensics, incident response | C-DAC PGCP-CSF (120 hours of forensics) |
| Security or cloud infrastructure | Operating systems, cloud, DevOps, network defence | C-DAC PGCP-ITISS |
| Governance, risk and compliance | Policy, risk, standards, privacy law | NPTEL, ISC2 CC, Security+ domain 5 |
| Research or cryptography | Cryptography, cryptanalysis, hardware security | IIT Kanpur PG Diploma |
Most people enter the field through the SOC, so the first row is the one most readers need. What a SOC analyst earns at each level, from fresher to L3, is in our SOC analyst salary breakdown.
Cyber security syllabus after 12th
The beginner syllabi assume no background. Cisco's courses are marked "Beginner", Google says "No prior experience required", and ISC2 CC needs no work experience. Start with networking: it is in 11 of the 12 syllabi, and every later subject assumes it. Then do Linux, then one of the certification syllabi above. C-DAC, IIT Kanpur and Simplilearn need a degree; the five-year NFSU programme takes students after 12th with physics and mathematics.
How to judge a course syllabus
- Look for hours per module. C-DAC publishes them; most private courses do not. A module named "Cloud Security" could be a two-hour talk or a 40-hour block.
- Look for labs. Cisco counts 115 labs and CEH 221. A syllabus without labs is a reading list.
- Check the exam version. Security+ moves to SY0-801 on 17 November 2026 and CEH is on v13. A course still teaching an older version is out of date.
- Match the syllabus to one job. A course that claims to train SOC analysts, penetration testers and forensic investigators in six months is spreading itself thin.
- Read the page for consistency. Tool counts, project counts and course counts that contradict each other on the same page, as several here do, suggest nobody has checked the page carefully. Ask for the syllabus as a document before paying.
You can compare cyber security courses by format, duration and fee in the full course listing, or see each provider's programmes together on our institutes page. For how to vet any programme beyond its syllabus, see our nine-step bootcamp guide.
Sources and how we checked
All pages were read on 28 October 2026. Many load their syllabus after the page opens, so we read them in a browser rather than from the raw page. Module names are as published; where a provider's course page and brochure name a module differently, we use the course page. Where a page contradicts itself, we say so.
- Cisco Networking Academy: Junior Cybersecurity Analyst career path and its six course pages, from Introduction to Cybersecurity to Cyber Threat Management (hours, labs, modules)
- Coursera: Google Cybersecurity Professional Certificate (nine courses, hours, tools)
- NPTEL: Cyber Security and Privacy, IIT Madras (12-week outline)
- CompTIA Security+ V7 (SY0-701) and Security+ V8 (SY0-801) (domains, weights, exam format, dates)
- EC-Council: Certified Ethical Hacker (CEH AI, v13) (20 modules, 221 labs, knowledge and practical exams)
- ISC2: CC exam outline, effective 1 September 2026 and CC certification page
- C-DAC: PGCP-ITISS course page, PGCP-CSF course page and admission booklet, August 2026 batch (module hours, tools, eligibility)
- IIT Kanpur: PG Diploma (Online) in Cyber Security (courses, credits, weekly engagement)
- National Forensic Sciences University: B.Tech–M.Tech CSE (Cyber Security) (semester-wise courses) and AICTE model syllabus page
- ICSS: Diploma in Cyber Security (four module blocks, tools)
- Simplilearn: Advanced Executive Program in Cybersecurity with IIIT Bangalore (learning path, skills, tools)