+91 63946 82828 WhatsApp
Mon–Sat, 9:00 AM – 7:00 PM IST India · Remote
AiCyber.Guru Request a callback

Security advisory & assurance · India

Secure, compliant, and board-ready.

Part-time CISO support, CERT-In empanelled audits, VAPT and security certification training — for Indian banks, NBFCs, regulated firms and growing companies building the function for the first time. Run by a practitioner, not a call centre.

Request a callback See what we do
Led by Somendra Nath Tiwari, CISSP Practitioner-led advisory — the person who scopes the work does the work
Credentials
CISSP · ISO/IEC 27001 · ISO/IEC 42001
Practice
vCISO advisory, audit readiness, VAPT
Engagement
Monthly retainer or fixed scope
Coverage
India & remote, on site where it matters

01

vCISO Advisory

A senior security head for your organisation, without a full-time salary. Risk assessment, control design, policy frameworks, compliance readiness and the board reporting that goes with it — scoped to what your organisation actually needs this year, not a template programme.

Banks & regulated entities — RBI Cyber Security Framework alignment, IT committee reporting, inspection preparation.
Enterprises — governance across business units, third-party risk, audit-ready evidence.
Smaller organisations — a security function built from nothing: baseline controls, DPDP readiness, incident playbooks, and the answers to customer security questionnaires.

Engagement
Monthly or quarterly retainer
Team
Named consultant, not a pool
Output
Board-ready pack: risk register, control status, roadmap
Billing
GST invoice, PO accepted
Discuss a retainer →

02

CERT-In Empanelled Audits

Security audits for organisations filing with RBI, SEBI or IRDAI, where the report has to carry a valid empanelment. We scope the engagement, manage delivery, and own the remediation plan through to closure — so you have one person accountable rather than a handover chain.

The audit itself is performed by CERT-In empanelled partner firms from our governed panel, so the report your regulator receives carries a valid empanelment. AiCyber.Guru scopes, governs and signs off that work on the strength of its own practitioner credentials — CISSP, ISO/IEC 27001 and ISO/IEC 42001 — and the empanelled partner is named to you before the engagement begins, so you may speak to them directly.

Ownership
Single point of accountability
Panel
Partner re-verified per engagement
Included
Remediation and re-test
Billing
GST invoice, PO accepted
Discuss an audit →

03

VAPT & Security Assessment

Vulnerability assessment and penetration testing across web applications, APIs, internal and external networks, cloud configuration and mobile builds. Scope agreed in writing before testing starts, findings rated by exploitability rather than scanner severity, and a re-test after you have fixed them.

Typically bought before a customer security review, ahead of a funding or compliance deadline, or on a fixed annual cycle alongside a vCISO retainer.

Scope
Web, API, network, cloud, mobile
Method
Manual testing, not scanner output
Report
Technical findings plus exec summary
Included
One re-test after remediation
Discuss a test →

04

Security Training & Certification

Official EC-Council certification delivered two ways: as a private cohort for your team on your schedule, or as a scheduled batch for individuals building a career. CEH, CND, CSA, CHFI and the rest of the catalogue, with official courseware, iLabs access and exam vouchers supplied through our accreditation.

For teams — most useful bought alongside an audit, when the findings tell you exactly which skills are missing.
For individuals — scheduled cohorts with published fees and batch dates. See the certifications.

Format
Private cohorts or scheduled batches
Materials
Official courseware and iLabs
Exams
Vouchers through our accreditation
Billing
GST invoice, PO accepted
Request a proposal →

Who actually does the work

A fair question, and one most consultancies answer vaguely. Advisory and assessment work is led personally — you deal with the person doing the thinking, not an account manager relaying messages to a delivery team you never meet.

Where an engagement requires CERT-In empanelment or more hands than one practice can provide, it is delivered through a named partner firm under our scoping and quality governance. You are told which firm, before you sign anything. That is the whole model — small, accountable, and honest about where the edges are.

Cyber Pulse

What we read each week, from primary sources — and what it changes in the advice.

Updated daily

Top incidents

Krebs · The Record · BleepingComputer · The Hacker News · Dark Reading

  • AssuranceAmerica breach · Jul 20266.9M driver’s license records exposed — the largest DL data spill of 2026 so far.
  • FBI ‘major cyber incident’ · Jul 2026A federal surveillance system was compromised, potentially exposing monitored phone numbers.
  • Ransomware surge · Jul 202698 organisations hit by ransomware and data-leak attacks in July 2026 alone.
  • Edge appliances lead the packVPN concentrators, firewalls and file-transfer tools remain the most exploited initial-access route.
  • Third-party breach exposureA growing share of incidents reach the victim through a supplier, not their own perimeter.
  • Loading today’s incidents…Ranked and de-duplicated across five desks, weighted for recency and cross-source corroboration.

Exploited vulnerabilities

CISA Known Exploited Vulnerabilities

  • CVE-2026-48282 · CVSS 10.0Adobe ColdFusion path traversal under mass exploitation — patch immediately.
  • CVE-2026-35278 · CVSS 9.8Oracle PeopleSoft pre-auth RCE actively exploited by ShinyHunters.
  • CVE-2026-48558 · CVSS 10.0SimpleHelp remote-support auth bypass — listed in CISA’s KEV catalogue.
  • Exploited beats severeA 7.5 under active exploitation outranks a 9.8 nobody is using. Work the KEV list first.
  • CERT-In reporting clockDirections set a six-hour reporting window once an incident is known — early awareness shortens it.
  • Loading the KEV catalogue…Newest additions to the Known Exploited Vulnerabilities catalogue, with CVE references.
  • Internet-facing firstRank by exposure, not by score: an exploited flaw on a public host outranks a critical one behind the firewall.
  • Re-test after you patchA fix that was rolled back, partially applied, or reverted by a restore is the commonest reason a closed finding reopens.

Cyber events · India

Curated · updated manually

Top cyber crime · world & India

The420.in · ET CISO

  • Report a cybercrime · cybercrime.gov.in ↗India’s National Cyber Crime Reporting Portal — 1930 helpline.
  • Global ransomware and extortion casesArrests, takedowns and breach prosecutions — refreshed daily.
  • India cybercrime and digital fraudDigital arrest scams, mule networks and enforcement action, from The420.in and ET CISO.
  • Mule account networksEnforcement action against current accounts opened to launder scam proceeds — a live KYC problem for banks.
  • Why we track consumer fraudPatterns here reach corporate finance teams a quarter later as invoice and payroll-diversion attempts.
  • Loading cybercrime desks…Fraud prosecutions and enforcement action from Indian and international desks.

Cyber & AI jobs · India

Jobicy · Remotive · last 24 hours

Nine feeds · de-duplicated · rebuilt every 24 hours

Hiring for these skills? See the certifications →

How we prove it

We are a young practice, and we will not pretend otherwise. Rather than publish testimonials we cannot stand behind, here is what you can actually verify before you commit:

Our credentials — CISSP is verifiable directly with ISC2; the ISO/IEC 27001 and ISO/IEC 42001 certificates are shown on request. The practice’s EC-Council accreditation can be checked against their Accredited Training Centre listing.

Our entity — we operate through a registered Indian private limited company, named in the footer. CIN, GSTIN and a signed NDA are available before any engagement begins.

Our thinking — the threat briefs above are compiled in-house, published daily and dated, and our own Insights are written and signed. Read a week of them and judge whether we know the subject.

Our partners — for CERT-In empanelled work, we name the partner firm before you sign, and you may speak to them directly.

Insights

All insights →

Published work

More on LinkedIn →
Your AI model is being cloned right nowAI security ↗ The MITRE ATT&CK framework, explainedDetection ↗ Insider threat detectionBlue team ↗ Virtualisation and container securityInfrastructure ↗ Telecom security, from 2G to 6GNetworks ↗ Engine shutdown at highway speed: myth vs realityAutomotive ↗
Somendra Nath Tiwari speaking at a training session CISSP · ISO 27001 · ISO 42001
Somendra Nath Tiwari — 2026.

The person you will actually be working with

AiCyber.Guru is led by Somendra Nath Tiwari — CISSP, with ISO/IEC 27001 and ISO/IEC 42001 credentials — who scopes the engagements, does the advisory work, and compiles the threat briefs published on this site. The practice is also an EC-Council Accredited Training Centre, which is how the certification side is delivered.

That last part matters more than it sounds. Most training providers teach from courseware they did not write about threats they did not study. The analysis in Cyber Pulse is the same research that informs an advisory engagement — which is why a client conversation tends to start from this week’s exploited CVE rather than a slide from last year.

Small enough that you get the practitioner. Accountable enough to name the partner when we bring one in.

Certifications for individuals

All certifications →

Scheduled cohorts for students, working IT staff and career changers — official EC-Council courseware, iLabs access and an exam voucher included. Fees, batch dates and payment options are published on each certification page.

CEH v13 AICertified Ethical Hacker — the credential most named in Indian job postingsFee & batch dates → CSASOC analyst skills — the shortest route to a first security roleFee & batch dates → CPENTPerformance-based penetration testing, entirely on a live cyber rangeFee & batch dates → CHFIDigital forensics with evidence handling that survives legal scrutinyFee & batch dates →

Not sure which one fits? Send us where you are now and where you want to be in a year — we will tell you which certification is worth your money and which is not.

Learners’ WhatsApp community. Batch announcements, the daily Cyber Pulse brief, India job postings and questions answered between sessions. Free, and you can leave any time.

Join the community

Common questions

Are you an official EC-Council partner?

Yes. AiCyber.Guru is an EC-Council Accredited Training Centre, held since February 2025 and verifiable against EC-Council’s own listing. Every certification programme comes with genuine EC-Council courseware, iLabs access and an exam voucher.

Which certification should a beginner start with?

For offensive security, CEH v13 AI. For blue-team and SOC roles, CSA or CND are the better entry points. Tell us where you are now and what job you want in a year, and we will tell you which one is worth your money — including when the answer is none of them yet.

Is the exam voucher included in the fee?

Most packages include the official exam voucher; lab-only options are also available. Each certification page lists what its packages contain.

Do you run corporate and online training?

Yes — live instructor-led online batches, self-paced options, and private corporate cohorts delivered on your schedule. Corporate engagements are quoted against scope, invoiced with GST, and we accept a purchase order.

Do you offer placement assistance?

We provide career mentorship, résumé review, mock interviews and job-referral support to certification students. We do not guarantee placement, and you should be careful of anyone in this market who does.

You are not CERT-In empanelled yourself. How does that work?

Correct, and we say so before you ask. The audit is performed by a CERT-In empanelled partner firm from our governed panel, so the report your regulator receives carries a valid empanelment. We scope the engagement, govern the quality and own the remediation plan through to closure. The partner is named to you before you sign, and you may speak to them directly.

Start with a conversation, not a proposal.

Thirty minutes on a call to work out whether there is a real engagement here. If there isn’t, we will say so — it costs us less than a client who should never have signed.

Somendra Nath Tiwari

You reach the people who do the work.Not a form queue, not an account manager.

Direct lines

Emailcontact@aicyber.guru Phone+91 63946 82828 WhatsAppMessage us Request a callback

Frameworks we work against

ISO/IEC 27001ISO/IEC 42001SOC 2PCI DSS RBI Cyber Security FrameworkDPDP Act 2023 CERT-In DirectionsNIST CSF plus custom frameworks, mapped on request
Join WhatsApp Community WhatsApp us