According to the student, he had completed the application process, paid the application fee, uploaded all required documents and submitted evidence of his cybersecurity work. However, he was not shortlisted for the hackathon stage of admissions, which he claimed denied him the opportunity to showcase his technical abilities.

Responding to the incident, IIT Kanpur Director Manindra Agrawal said the student was not shortlisted because he did not have sufficient prior experience in cybersecurity. While admission for the current academic year is no longer possible since the admission process has concluded, the institute is considering inviting him to campus to evaluate his technical skills.

“If he proves his competence through a proper assessment, we will provide him an opportunity in the next admission cycle,” Agrawal said. He also confirmed that the student had gained access to certain sections of the websites of both IIT Kanpur and IIT Madras.

The institute has asked senior faculty members and engineers to interact with the student and counsel him that unauthorised access to computer systems is illegal and should not be repeated. An IIT Kanpur official said the institute had initially considered filing an FIR, but decided to first verify the student’s claims and assess his technical abilities before deciding on any further action.

The incident comes against the backdrop of the two IITs jointly launching India’s first undergraduate cybersecurity programme this year. Although admissions are being conducted through a common process, IIT Kanpur and IIT Madras have clarified that students admitted to each institute will study independently on their respective campuses and receive separate degrees.

For the inaugural batch, IIT Madras has relied on IIT Kanpur’s admission shortlist. Candidates shortlisted for the selection process participate in a hackathon and are then given the option to choose between IIT Kanpur and IIT Madras based on availability. From the next admission cycle, IIT Madras has said applicants will first take an aptitude test covering mathematics, logical reasoning and cybersecurity aptitude, followed by a longer hackathon designed to assess programming ability and cybersecurity knowledge before final shortlisting.

The programme has been introduced amid growing demand for trained cybersecurity professionals. IIT Madras has said India faces an estimated shortage of around 1.5 million cybersecurity professionals as digital services expand across sectors including governance, finance, healthcare, manufacturing, telecommunications and defence.

The four-year programme places significant emphasis on practical training. Students will spend the final two years working on live cybersecurity assignments through a Field Deployment Professional Project under the guidance of professionals from strategic organisations. The curriculum includes areas such as security operations, vulnerability assessment and penetration testing, malware analysis, hardware and cloud security, firmware reverse engineering, and critical infrastructure protection.

The latest incident also echoes IIT Kanpur’s earlier approach towards identifying cybersecurity talent. Earlier this year, the institute had offered an opportunity at its C3iHub to a young individual who reported vulnerabilities in the CBSE’s online screen-marking portal, highlighting its willingness to engage with skilled ethical hackers while emphasising responsible disclosure and legal conduct.

— With inputs from PTI