The IIT Kanpur has recruited the self-taught cybersecurity researcher as an Open-Source Intelligence (OSINT) and threat intelligence engineer at C3iHub, its dedicated cybersecurity innovation hub. The appointment comes directly in the wake of a national stir caused by Nisarga Adhikary’s public exposure of severe security loopholes in the Central Board of Secondary Education’s (CBSE) digital evaluation infrastructure.
The controversy began earlier this year when the CBSE rolled out its On-Screen Marking (OSM) system, a digital platform designed to let examiners grade scanned answer scripts online. Intrigued by the rollout, the teenager from Siliguri, West Bengal, began examining the publicly accessible components of the portal.
What he discovered was a series of alarming technical lapses that took him less than an hour to uncover that a master password was left entirely exposed in plain text within the portal’s front-end code, allowing anyone to bypass two-factor authentication.
The One-Time Password (OTP) verification mechanism executed entirely on the user’s browser, effectively rendering the security check useless through basic browser developer tools. A critical flaw allowed users to view and retrieve the records of other individuals. Misconfigured cloud buckets left scanned student answer sheets and question papers openly accessible to the public without requiring any authentication.
Adhikary reported these vulnerabilities to the Indian Computer Emergency Response Team (CERT-In) under the Ministry of Electronics and Information Technology in February 2026. However, with the flaws remaining largely unpatched, his subsequent May 22 blog post detailing the findings ignited a massive public discourse surrounding student data privacy and institutional digital security.
“You don’t even need to know programming,” Adhikary remarked regarding the simplicity of the flaws. “You just need to know Ctrl + F and understand the basic logic. That was the master vulnerability.”
Spotted by Academia
The revelatory blog post caught the attention of IIT Kanpur Director, Professor Manindra Agrawal, who subsequently reached out to the teenager. Confirming the recruitment, Prof. Agrawal clarified that Adhikary has been hired strictly for a professional, full-time role rather than an academic program.
“He is a talented young engineer who has demonstrated noteworthy technical capabilities at a young age,” Prof. Agrawal stated. “We believe he has significant potential, and working at IIT Kanpur will provide him with the opportunity to further develop his capabilities while contributing to cybersecurity and threat intelligence initiatives at C3iHub.
While the exact remuneration remains undisclosed, Agrawal noted it was structured according to institutional analysis. Adhikary, accustomed to earning in US dollars from freelance projects for American companies, noted that while the salary is respectable, it fell slightly below his initial expectations. Furthermore, when asked if the teenager would be assigned to patch or audit CBSE’s infrastructure—given IIT Kanpur’s ongoing technical collaborations with the board—Agrawal noted that such decisions would depend on future operational requirements.
Skills Over Degrees
Adhikary’s journey emphasizes a growing paradigm shift within the tech industry, where practical, self-taught expertise is increasingly prioritized over formal university degrees. He began coding at the age of six and was competing in cybersecurity tournaments by the sixth grade.
While this role marks his first official foray into a dedicated defence position, Adhikary views cybersecurity as a passion that has now crossed over into his professional life. Looking ahead, the young engineer has indicated that he has little interest in pursuing traditional higher education, aiming instead to eventually channel his skills into building tech start-ups.
