“Cyber security” covers very different jobs. A penetration tester breaks into systems with permission. An IT auditor checks whether controls work. A cloud security engineer locks down AWS or Google Cloud accounts. Each path needs a different course, and picking the wrong one costs months and money.
This guide compares the cyber security courses Sherdil IT Academy runs from Karachi, with fees, duration, and schedule taken from each course page, and lists free options worth trying first if you are still deciding.
Three main paths in cyber security
| Path | What you do | Typical first roles |
| Offensive security | Find and exploit weaknesses before attackers do | Junior penetration tester, VAPT analyst, red team trainee |
| Audit, risk and compliance | Check that IT controls meet standards and regulations | IT auditor, IS audit officer, risk and compliance analyst |
| Cloud and DevSecOps security | Secure cloud accounts, networks and deployment pipelines | Cloud security engineer, DevSecOps engineer |
Cyber security course fees in Karachi: Sherdil IT Academy (2026)
| Course | Best for | Duration | Format | Fee (lump sum) | Installments |
| Ethical Hacking Professional (EHP) | Offensive security | About 4 months | Online, Sat and Sun, 8 to 10 PM | PKR 100,000 | 4 x PKR 30,000 |
| CISA | IT audit and compliance | About 2 months | Online | PKR 75,000 | 2 x PKR 45,000 |
| AWS DevSecOps | Cloud security and DevSecOps | About 4 months | Online | PKR 120,000 listed | 4 x PKR 30,000 |
The next EHP batch starts on 14 November 2026. Fees are for training only; certification exam fees charged by bodies such as ISACA or AWS are paid separately.
1. Ethical Hacking Professional (EHP)
EHP is a hands-on penetration testing course. You build a lab with Kali Linux and deliberately vulnerable machines (Metasploitable and OWASP BWA), then work through a full test from reconnaissance to the final report.
What you learn, across 11 modules
- Linux basics on Red Hat, plus the frameworks pentesters work against: ISO 27001, NIST CSF, CIS, OWASP Top 10, PCI DSS, HIPAA, GDPR and MITRE
- Information gathering, footprinting, scanning, and enumeration
- Vulnerability assessment with Nessus and OpenVAS, and manual verification
- Host and network exploitation with Metasploit: password attacks, privilege escalation, hash dumping, ARP spoofing
- Post-exploitation: persistence, data exfiltration, and log clearing, so you know what to look for as a defender
- Web application testing: HTTP and sessions, subdomain and directory discovery, SQL injection, XSS, file upload and file inclusion flaws, IDOR
- Writing a penetration test report with mitigation advice
Tools covered include Nmap, Burp Suite, Nessus, OpenVAS, and Metasploit.
Batch details
- Starts 14 November 2026
- Saturday and Sunday, 8 PM to 10 PM PKT, online
- About 4 months
- PKR 100,000 lump sum, or 4 monthly installments of PKR 30,000
- Sherdil E-Learning portal access included
Before you join: EHP is for intermediate students. You need a laptop with a Core i7, 12 GB RAM, and 500 GB disk space to run the lab. If you have never used Linux or networking tools, build those basics first.
Ethical hacking is legal only on systems you own or have written permission to test. Unauthorized access is an offense under Pakistan’s Prevention of Electronic Crimes Act (PECA) 2016, and the course covers ethical practice for that reason.
2. CISA (Certified Information Systems Auditor)
CISA suits people who want to assess security rather than attack it. The course follows ISACA’s five exam domains: the IS audit process, IT governance, systems acquisition and development, IT operations and business resilience, and protection of information assets.
- About 2 months
- PKR 75,000 lump sum, or two monthly installments of PKR 45,000
- No prior audit experience needed to join; basic IT knowledge is enough
The ISACA exam is charged separately, and the CISA credential itself requires five years of relevant experience, which you can complete after passing. Our CISA certification in Pakistan guide explains the exam fee in PKR and the experience rule in full.
3. AWS DevSecOps
This course combines AWS security with DevOps practice for people who want to secure cloud systems as they are built.
Security side (aligned with AWS Security Specialty): IAM policies and MFA, CloudTrail and CloudWatch, VPC security and flow logs, KMS encryption, AWS Config, Security Hub, WAF and Shield, Network Firewall, GuardDuty, Inspector and Macie.
DevOps side: Linux, Git, Docker, Amazon ECS and EKS, CI/CD with AWS tools, GitHub Actions and Jenkins, Ansible, ArgoCD, CloudFormation and Terraform. It ends with a mock exam and an AWS project.
- About 4 months, online
- Listed fee: PKR 120,000, or four monthly installments of PKR 30,000
- Lifetime access to the Sherdil E-Learning portal
- AWS lab access on weekends
Free cybersecurity courses in Karachi
If you are not sure cyber security is for you, start with something free. These options were open in 2026:
- NAVTTC (National Vocational & Technical Training Commission). Lists a free, NVQF-certified Cybersecurity course under its IT sector. Batches run through partner institutes, including IBA’s CICT in Karachi, which has offered a Cyber Security (CEH) track under NAVTTC programmes. Selection usually involves an NTS test and education requirements. Register on the NAVTTC portal and select a Karachi district.
- Cisco Networking Academy. Free, self-paced Introduction to Cybersecurity and longer follow-on courses online, with a certificate of completion.
- Fortinet Training Institute. Self-paced security courses are free, with free entry-level certification exams at the end.
One change to note: ISC2’s free Certified in Cybersecurity (CC) training and exam programme closed to new sign-ups on 20 May 2026. Many older blog posts still list it as free. The CC certification is still available, but now at the normal price.
Free courses are good for testing your interest and learning the vocabulary. They rarely include a supervised lab, real projects or a trainer to answer questions, which is where paid courses earn their fee.
Which cybersecurity course should you choose?
- You enjoy finding how things break: start with Ethical Hacking Professional. Make sure your Linux and networking basics are in place first.
- You come from audit, accounting, banking or compliance: take CISA. It builds on business and controls knowledge rather than coding.
- You already work with AWS or in DevOps: AWS DevSecOps adds security to skills you have.
- You are an experienced cloud or network engineer aiming for specialty certifications: the self-paced Multicloud Networking & Security course is the cheapest route.
- You are a complete beginner: do one free introductory course, then choose a path. Sherdil’s Linux Administrator course is a sensible first step before ethical hacking.
Frequently asked questions
What is the fee for a cyber security course in Karachi?
At Sherdil IT Academy in 2026: Ethical Hacking Professional is PKR 100,000 (or 4 x PKR 30,000), CISA is PKR 75,000 (or 2 x PKR 45,000), AWS DevSecOps is listed at PKR 120,000 with a first-batch offer of PKR 75,000, and the self-paced Multicloud Networking & Security course is PKR 30,000.
How long does a cyber security course take?
From about 2 months for CISA to about 4 months for Ethical Hacking Professional and AWS DevSecOps. The Multicloud Networking & Security course is self-paced.
Are there free cybersecurity courses in Karachi?
Yes. NAVTTC lists a free certified Cybersecurity course delivered through partner institutes, and Cisco Networking Academy and Fortinet offer free online courses. ISC2’s free CC exam programme ended in May 2026.
Can I learn ethical hacking without a technical background?
Not easily. Sherdil’s EHP course is for intermediate students and requires a lab-capable laptop. Learn Linux and networking fundamentals first, then join.
Are the courses online or onsite?
Ethical Hacking Professional and AWS DevSecOps run online, so you can join from anywhere in Karachi or Pakistan. Multicloud Networking & Security is self-paced. For the CISA batch format, contact the academy.
Which course leads to a job fastest?
It depends on your background. Auditors and finance professionals usually move fastest with CISA. People with Linux and networking skills move fastest with ethical hacking. Cloud engineers get the most from DevSecOps.
Conclusion
The right cyber security course depends on the job you want, not on which course sounds most exciting. Decide between attacking, auditing or securing cloud systems, test your interest with a free course if needed, then commit to one path.
Next batch: Ethical Hacking Professional starts 14 November 2026. For seats, fees or help choosing, call +92 331 8367709, email training@sherdil.org, or apply online.