Nisarga Adhikary, who exposed CBSE and US defence flaws, says India’s obsession with exam rank and reward for mugging PCM killing tech talent

Nisarga Adhikary's cybersecurity career has taken him from finding vulnerabilities in India's CBSE examination infrastructure to being recognised by the US Department of Justice. But the 19-year-old researcher believes that India's rank fetish and habit of rewarding mugging up PCM is hurting the tech ecosystem. "India keeps rewarding mugging up PCM and then wonders where the hackers went. JEE is not computer science. GATE is not cybersecurity. rank is not competence. Our examination fetish is killing technical talent," he said in his blog just before getting the recognition from US department of Justice.

In a recent blog post, Adhikary has criticised what he calls India's "examination fetish", arguing that an education system obsessed with ranks, scores and credentials can overlook the skills that matter in technology. His has argued that a rank can measure performance in an examination, but it cannot by itself measure whether someone can build, break or understand a computer system.

Adhikary's comments come at a time when his own career has become an example of the alternative route he advocates.


He first drew national attention in 2026 after publishing details of vulnerabilities he said he had found in the CBSE On-Screen Marking (OSM) portal. He had reported the issues to CERT-In in February before publishing his findings in May. IIT Kanpur subsequently appointed him as an OSINT and Threat Intelligence Engineer at C3iHub. Recently, Adhikary is also named on the US Department of Justice's cybersecurity acknowledgements after reporting what he described as a critical vulnerability in one of the department's law-enforcement systems. The DoJ reportedly validated and patched the issue before crediting him.

'Rank is the fetish object'

Adhikary's criticism is not that examinations have no value. He acknowledges that exams such as JEE can test mathematical ability, discipline and performance under pressure. India also needs a scalable mechanism to allocate a limited number of seats at institutions such as the IITs.


The problem, according to him, begins when the examination result stops being treated as one signal and starts becoming a definition of the person. In his view, India's obsession with AIR, CGPA, GATE scores, competitive-programming ratings and salary packages has created a culture in which measurable proxies can overshadow actual technical ability.

He uses computer science as his central example.

A student seeking the conventional route into computer science at an IIT may spend years preparing for physics, chemistry and mathematics examinations. Yet none of those examinations directly asks whether that student can reverse a binary, contribute to an operating-system project, find a security vulnerability or build a distributed system.

That creates a disconnect, Adhikary argues, between being good at the selection process and being good at the subject one eventually wants to study.

The computer does not care about your rank

One of Adhikary's arguments is that technology itself does not recognise academic hierarchy. A compiler does not know a programmer's JEE rank. Linux does not check a developer's CGPA before exposing its source code. A security system does not become less vulnerable because the person investigating it has a prestigious degree.

If a teenager understands a particular subsystem better than a senior engineer, the software will behave according to the teenager's understanding, not the engineer's designation. That, Adhikary argues, is what makes technology different from systems built around formal hierarchy.

'Competitive programming is not the problem'

Adhikary is also careful not to blame competitive programming, coding interviews or even the desire to earn a high salary.His criticism is directed at what happens when these activities become another checklist. Which DSA sheet should a student complete? What Codeforces rating is enough for an internship? Which project should be built in the first year? When should someone start learning distributed systems?

Adhikary argues that this approach can turn curiosity into another examination syllabus. The internet, he points out, has changed the economics of learning. Source code, research papers, lectures, documentation and development tools are available to anyone willing to work through them.

There is no rule saying a student must wait until the third year of college to understand distributed systems or Linux internals. In cybersecurity, that matters even more. A person can spend years learning independently, participating in CTFs, studying vulnerabilities and examining real software without following the traditional academic sequence.

Why IIT Kanpur's B.Cyber programme interests him

Adhikary sees IIT Kanpur's new Bachelor of Cybersecurity programme as an example of a different approach. The programme, launched for the 2026-27 academic session, combines initial screening based on JEE Main scores and evidence of previous cybersecurity work with an in-person assessment that includes a hackathon. The assessment covers areas such as cryptography, web and API security, network security, reverse engineering and OSINT.

The distinction is important. Instead of relying entirely on a conventional examination, the programme asks applicants to demonstrate some of the skills associated with cybersecurity itself. IIT Kanpur says the test is designed to assess analytical thinking, curiosity and aptitude for cybersecurity. Its official programme information also says JEE Main will not be used for future admissions, with a separate entrance test to be announced.

For Adhikary, that is closer to the kind of selection process he wants to see. His broader argument is if an institution wants hackers, it should give candidates something to hack.

'Make the hacker touch the computer'

He argues that a cybersecurity candidate should be judged, at least partly, on what they can actually do: solve a security problem, analyse a network, reverse-engineer a program, investigate an unusual request or identify a weakness in an application. That does not make academic knowledge irrelevant.

Cybersecurity requires mathematics, computer science, operating systems, networking and many other foundations. But Adhikary's point is that knowledge and demonstrated ability do not always arrive through the same route. A student who spends years independently studying security may develop capabilities that a conventional entrance examination was never designed to measure.

He sees the same problem in hiring

Adhikary extends the argument beyond universities. Companies routinely use college names, degrees, examination scores, competitive-programming ratings and resumes as shortcuts for assessing candidates. Such signals can be useful because employers cannot deeply test every applicant.

But proxies can become problematic when they are mistaken for capability. His preferred alternative is evidence. What has the person built? What have they investigated? What have they broken and fixed? Can they learn an unfamiliar system without waiting for someone to provide a syllabus?

Why the argument matters beyond cybersecurity

Adhikary believes the same issue could become more important as AI changes software development. Basic programming tasks are increasingly being automated or accelerated by AI tools. Writing a simple application or generating routine code is becoming less useful as a standalone indicator of engineering ability.

That shifts the value towards other skills, he argues: judgement, curiosity, problem selection, debugging, systems thinking and the ability to recognise when an apparently convincing answer is wrong. In that world, having completed a prescribed list of courses may tell an employer less than it once did. The ability to investigate something nobody has explained to you could matter more.