Indian teen cybersecurity researcher who exposed CBSE flaws named in DoJ Hall of Fame

A 19-year-old Indian cybersecurity researcher has added another milestone to his career after being recognised by the US Department of Justice for responsibly reporting a critical security vulnerability.

According to media reports, Nisarga Adhikary said he discovered a critical vulnerability in one of the US Department of Justice’s law-enforcement systems while researching its website. He reportedly submitted a vulnerability report to the department, which he said validated the finding and patched the issue within a week.

Adhikary shared a screenshot of the department’s cybersecurity acknowledgements page on X. The page credits researchers who have responsibly disclosed valid vulnerabilities to the department.

He said he did not receive any payment for reporting the flaw.

Vulnerability also reported to US military

The DoJ discovery was not Adhikary’s first reported vulnerability involving US government systems.

He said he had also identified a vulnerability in a US Department of Defense or military system and reported it to the relevant authorities.

“I found a vulnerability in the US Department of Defense/US military system. I reported it and after validation, they found it was valid. Remediation is still under way though,” he said.

Adhikary has also received a “Thanks” acknowledgement from the US Department of Defense through HackerOne, a platform used by organisations to receive vulnerability reports from security researchers.

He has not disclosed technical details of the vulnerabilities or identified the affected systems.

From CBSE flaws to IIT Kanpur

Adhikary first attracted attention in India in 2026 after reporting security vulnerabilities in the Central Board of Secondary Education’s Online Submission of Marks (OSM) portal.

He said he reported the issues to CERT-In in February before publishing details of his findings in May. His findings raised concerns about the security of examination data on the platform.

Following the CBSE episode, Adhikary joined IIT Kanpur’s C3iHub as an OSINT and Threat Intelligence Engineer.

His career in cybersecurity began several years earlier. According to his LinkedIn profile, his first internship was with the New Delhi Space Society in 2023, where he worked as a web developer. He later founded and led a Hack Club before working with technology companies including Skann, Cypherock and Wavelength.

‘Rank is not competence’

Adhikary’s growing cybersecurity career has also shaped his criticism of India’s education system.

In a recent blog post, he criticised what he described as the country’s “examination fetish”, arguing that an excessive focus on ranks, marks and credentials can overlook practical technical skills.

“India keeps rewarding mugging up PCM and then wonders where the hackers went. JEE is not computer science. GATE is not cybersecurity. rank is not competence. Our examination fetish is killing technical talent,” he wrote.

Adhikary clarified that his criticism is not directed at examinations themselves. He acknowledged that exams such as the Joint Entrance Examination can test mathematical ability, discipline and performance under pressure, while also providing a way to allocate a limited number of seats at institutions such as the IITs.

His argument is that examination performance alone cannot establish whether someone can build, understand or secure a computer system.

A growing cybersecurity career

Adhikary’s recent recognition by the US Justice Department comes after a series of vulnerability disclosures involving Indian and US government systems.

At 19, his journey has taken him from identifying security issues in India’s examination infrastructure to working in OSINT and threat intelligence at IIT Kanpur and reporting vulnerabilities to US government agencies.

With inputs from Agencies