To judge a cyber security course in Nepal, ask for its week-by-week syllabus before you pay. If a course cannot show you what happens in week 1, week 6 and week 12, you cannot judge it, so do not pay for it.

Most course pages list the same tools: Kali Linux, Burp Suite, Metasploit, Nmap. A list of tools tells you very little. The order of the weeks, the lab setup and the final piece of work tell you much more. Here are seven questions to ask, and what a good answer sounds like.

What does the course teach before any hacking?

Look at the first month. If week 1 opens with Metasploit, the course is selling excitement, not skill.

Every attack you learn later sits on networking and Linux. You cannot read a scan result if you do not know what a port is. You cannot follow a privilege escalation lab if the output of ls -l means nothing to you. A good syllabus spends the first weeks on how the internet works, TCP/IP, the terminal, and Linux users and permissions. Attack tools come after that.

Which job does the course train you for?

"Ethical hacking" describes what you do, not which job you apply for. Ask the course which junior job it prepares you for. Then check that the syllabus matches that job.

Two common first jobs are junior VAPT analyst and Tier-1 SOC analyst. VAPT means finding and proving security holes in a system, with written permission. A SOC is the team that watches a company's security alerts. The first job needs web and API testing. The second needs log reading and a SIEM, which is a tool that collects security logs in one place. A course that only teaches attacking closes the second door.

Then read the job ads yourself. In Nepal, security jobs are posted on company career pages, merojob, KumariJob, JobAxle and LinkedIn, and many remote roles are open too. Read five ads, write down the skills they ask for, and compare that list with the syllabus.

Will your laptop run the labs?

Few people ask this, and it saves the most trouble. Security labs run practice machines inside your laptop, with a tool like VirtualBox. Running several of them at once needs a lot of memory.

Ask for the exact laptop spec. Ask what happens if you have only 8GB of RAM. If you own a Mac, ask about it directly. Macs with Apple chips (M1 and later) cannot run the usual x86 practice machines, and it is better to learn that before you pay than in week 3.

Also ask whether the course gives you a device or expects you to bring your own.

Does the course teach the law, and where do you practise?

In Nepal, getting into a computer without the owner's permission is an offence under Section 45 of the Electronic Transactions Act 2063. Section 46 covers damaging or changing someone's data. Testing a real website without written permission is not practice. It is an offence.

So ask two things. Does the course teach scope and written permission in the first week, before any attack? And where do students practise? A good answer names legal training targets, like PortSwigger's labs, TryHackMe, HackTheBox or a lab the course builds itself. A worrying answer is "on real websites".

What do you hand in at the end?

A penetration tester's real product is the report. A client pays for a document that says what is broken, how bad it is, and how to fix it.

Ask if the course ends with a written VAPT report on a target with a clear scope. Ask who reads that report. A mentor should read it line by line and push back on weak findings. A multiple choice quiz cannot do that. The report is also the first thing you show an employer, so it matters more than any single tool.

Ask how the course teaches note taking too. Testers write down every command and screenshot with a time as they work. The report is built from those notes, and messy notes give a weak report.

What does the course say about certificates?

Nepal job ads name CEH most often, so many courses mention it. Ask three plain questions. Is an exam voucher included? Is there real exam preparation, or does the course only cover the topics? Which CEH topics are left out?

An honest course answers all three without trouble. A certificate is a separate exam with its own cost, so treat it as a separate decision. Do not let the word "CEH" on a poster make it for you.

Who teaches, and how many people are in the room?

Ask whether the mentor works in security now, or only teaches it. Then ask the batch size. In a lab course, things break all the time: a machine will not boot, a tool will not connect. The mentor has to look at your screen to fix it. In a room of 40, that hardly happens.

Two free things to try tonight

Before you pay anyone, find out if you enjoy this work.

  • Start the TryHackMe Pre Security path. It teaches networking, Linux and Windows basics from zero. The early rooms are free, and the free plan gives you about one hour a day of a ready-made attack machine in your browser.
  • Make a free account on the PortSwigger Web Security Academy and try the first SQL injection lab. The whole academy is free, and the free Burp Suite Community Edition works for most labs.

If you finish a few rooms and want more, you are ready to judge a course. If you are bored after one hour, you learned that for free.

How our course answers these seven questions

At Saarathi Academy in Old Baneshwor, Kathmandu, the Cybersecurity and Ethical Hacking course runs for 12 weeks. Weeks 1 to 4 cover the terminal, networks, recon and Linux before any web testing. It trains for two jobs, junior web and API VAPT analyst and Tier-1 SOC analyst, and Week 10 is hands-on with the Wazuh SIEM. Week 11 is a scoped assessment and a written report, with peer review and mentor feedback.

We recommend 16GB of RAM and an Intel or AMD laptop, and you bring your own. The course covers most CEH v13 topics, but it has no exam-prep track and no exam voucher. Each batch has up to 10 students in the classroom, and our mentors still do the job they teach. Every syllabus is public on our website before anyone pays.

Read the full week-by-week syllabus and the course page, and hold us to the same seven questions.