Bandana Kaur on AI agent security, research and getting into cybersecurity. https://hackwither.co.in/notes/ 2026-06-12T00:00:00.000Z Bandana Kaurhttps://hackwither.co.in/about/ https://hackwither.co.in/notes/acknowledgement-is-not-remediation/ 2026-06-12T00:00:00.000Z

At 16 I reported a vulnerability exposing PII and financial data of ~399k Indian government officers to NCIIPC. Finding and acknowledging bugs doesn't secure systems. Remediation does.

<p>when i was 16, i found a vulnerability that gave access to PII and financial data of ~399k government officers. i reported it to NCIIPC the way you're supposed to. i got the acknowledgment. the reference number. the polite email.<br> then i waited: one month, two months, nothing moved.</p> <p>recently, a very similar story has been making headlines: different system, different researcher, same age range, same pattern. a vulnerability gets reported responsibly, acknowledgment arrives, and then little seems to happen until public attention forces action.</p> <p>i'm not bringing this up again to say &quot;i called it.&quot; i'm noticing a theme.</p> <p>i don't think the lesson here is &quot;researchers should go public faster.&quot; done the wrong way, it is unethical and most of us don't want to. going public is a last resort, not a strategy, and it should NOT be the only mechanism that makes remediation happen. that is not a sustainable model for securing critical infrastructure, imho.</p> <p>sure, finding vulnerabilities is important, acknowledging reports is important. but neither of those things actually secures systems, remediation does.</p> <p>and if the people repeatedly identifying weaknesses in critical systems are teenagers doing unpaid work in their spare time, then the question isn't whether young researchers are stepping up.<br> they CLEARLY are.</p> <p>india has no shortage of talented researchers. the real challenge is ensuring that the systems, processes, and institutional remediation workflows around them can keep pace. im optimistic we can get there.</p> <p>as always, happy hacking!!<br> –HackWitHer</p> https://hackwither.co.in/introductory-roadmap/ 2025-12-31T00:00:00.000Z

How to start in cybersecurity without a one-size-fits-all roadmap: start with the big picture, pick a niche, pivot if it doesn't click, then go deep. No sponsored certs.

<p>I’m HackWitHer, an 18-year-old cybersecurity researcher.</p> <p>have you ever tried to follow a roadmap in cybersecurity, but it looked something like “learn hacking in [insert clickbait number] dates!!” or but it just didnt help you learn or accomplish anything?<br> the thing is, everybody learns differently. most of you aren’t lacking motivation, you’re just lost in the noise.</p> <p>i get this question a lot:</p> <p>“how do i start in cybersecurity?”</p> <p>I’ve talked to ~2,000 students about getting started in cybersecurity, and i’ve been one of them myself. truth is, there’s no single right path. one shoe doesn’t fit all, my dear cinderella.</p> <h2 id="about-this-roadmap" tabindex="-1">About this roadmap</h2> <p>so, i made a rough structure that might help you find yours. creative liberty matters most in a field like cybersecurity.</p> <p>the goal here is NOT to spoon-feed you sponsored certs and courses, it’s to help you think for yourself and explore with purpose. this roadmap is just to give you direction. how you decide to learn and explore the colorful field that is cybersecurity, is entirely upto you :)</p> <p>this is the shoe that fits most:</p> <p><strong>1. Start with the Big Picture — What is Cybersecurity?</strong></p> <ul> <li>hacking? what's that? Don’t jump into coding just yet.</li> <li>Begin with a foundational course (like ISC2 Certified in Cybersecurity (CC) or something if you’d like to gain a low cost “industry” cert on the side. otherwise, there’s plenty of introductory labs like some on TryHackMe that you can take)</li> <li>Understand what roles exist: Red team, blue team, GRC, threat intel, SOC analyst, DFIR, OSINT, etc.</li> <li>Build foundations and understand the HOWs and WHYs. Learn how the internet, systems, and data protection work, to the best of your curiosity!</li> </ul> <p><strong>2. Pick a Starting Point — A Niche to Explore</strong></p> <ul> <li>Choose one path that piques your interest.</li> <li>Maybe it’s OSINT, maybe it’s appsec, maybe policy &amp; privacy or something non-technical.</li> <li>Don’t worry about picking “the perfect one.”</li> <li>Just start reading blogs, following researchers and replicating small things others have done.</li> </ul> <p>Tip: spend at least 10 days exploring a niche before you move on to the next.</p> <p><strong>3. If It Doesn’t Click, Pivot.</strong></p> <ul> <li>You don’t owe any niche your loyalty.</li> <li>Test out another subfield. Rinse and repeat until something sparks.</li> <li>The “click” comes when curiosity beats burnout.</li> </ul> <p><strong>4. Go Deeper, Go Niche-Specific</strong></p> <ul> <li>Once you find your thing, this is when you lock in, niche specific roadmaps==your besties</li> <li>Specialized courses (TryHackMe, TCM, SANS, etc)</li> <li>Certifications (specific to your niche)</li> <li>Labs, writeups, research, content, projects in that niche</li> </ul> <p>There’s plenty of roadmaps and resources specific to “niches” like red teaming, blue teaming, AI/ML security etc. that you can find online!</p> <p>⸻</p> <p>You don’t need to be a coder to start.</p> <p>You don’t need to spend money to learn.</p> <p>You just need to be curious enough to keep exploring.</p> <p>The rest? We’ll build it along the way.<br> Stay tuned for more. happy hacking</p> <p>–HackWitHer ❤</p>