CBSE ‘Hack’, IIT Gig and US Recognition: Nisarga Adhikary’s Incredible Year at 19

At just 19 years old, cybersecurity researcher Nisarga Adhikary has already built a profile that many professionals take years to develop. His journey has combined vulnerability research, ethical hacking, academic opportunities and international recognition, culminating in an acknowledgement from the US Department of Justice for identifying and reporting a security flaw in one of its systems.

Adhikary is currently working at IIT Kanpur, where his interest in cybersecurity and vulnerability research continues to shape his work. For him, however, hacking is not simply about breaking into systems. He describes it as a way of understanding how things work and discovering weaknesses that may otherwise remain unnoticed.

The latest recognition came late at night on September 22. Adhikary was sitting at a Starbucks café at IIT Kanpur when an email notification appeared on his screen. The message came from the US Department of Justice and acknowledged his work in finding and reporting a vulnerability in one of its systems.

The timing was unusual. It was almost an hour after midnight, and Adhikary was having his second cup of coffee when he saw the message.

Despite the significance of the email, the 19-year-old remained remarkably calm. Recognition from an important US government institution could have been an overwhelming moment for someone so young, but Adhikary did not react with the excitement one might expect.

His attitude reflects the way he approaches cybersecurity itself. Rather than treating hacking as something mysterious or simply chasing recognition, he appears to view vulnerability research as a process of understanding systems by testing their limits.

“I love to break stuff,” Adhikary says, explaining his approach to cybersecurity. For him, hacking is part of the process of understanding technology and discovering how systems behave when they are pushed beyond their expected use.

His journey has not been limited to the recent US Department of Justice recognition. Earlier work involving CBSE also brought attention to his cybersecurity research. The experience demonstrated his ability to identify weaknesses in systems and report them, highlighting the role that young independent researchers can play in improving digital security.

Adhikary’s story is particularly notable because of his age. At 19, he is already working in an environment associated with some of India’s leading academic and technological research. His association with IIT Kanpur has provided another important chapter in a journey that began with a strong personal interest in cybersecurity.

The progression from identifying vulnerabilities to receiving international recognition illustrates how cybersecurity research can open opportunities beyond traditional academic routes. Finding a vulnerability is only one part of the process. Researchers also need to understand how to document the problem, communicate it responsibly and ensure that the affected organisation has an opportunity to address it.

Adhikary’s recognition from the US Department of Justice is therefore significant not merely because of the institution involved, but also because it reflects the value of responsible vulnerability reporting.

Cybersecurity researchers frequently spend considerable time examining digital systems for weaknesses that may not be visible during ordinary use. Their work can involve understanding applications, testing assumptions made by developers and identifying situations in which a system behaves differently from what was intended.

For someone like Adhikary, curiosity appears to be a major driving force. His statement that he loves to “break stuff” captures an important distinction between malicious hacking and security research. The objective of responsible researchers is to understand weaknesses so that they can be reported and eventually fixed rather than exploited for personal gain.

His journey also highlights the growing opportunities available to young cybersecurity enthusiasts in India. The field is increasingly dependent on people who are willing to explore systems, understand vulnerabilities and think creatively about how technology can fail.

Adhikary’s experience demonstrates how skills developed outside conventional classroom learning can eventually lead to opportunities in major institutions. His work at IIT Kanpur and recognition from the US Department of Justice have given his relatively short career an international dimension.

The combination of his early security research, CBSE-related work, IIT opportunity and recognition from a US government department makes his 19th year particularly remarkable.

Yet, perhaps the most striking aspect of his story is his reaction to the recognition. Instead of treating the email as the culmination of his journey, Adhikary appears to see it as another part of an ongoing process.

For a young researcher who says hacking is a way of understanding technology, the recognition may be less important than the discovery itself. The real motivation lies in finding out why a system behaves the way it does, identifying where it can fail and understanding how those weaknesses can be addressed.

At 19, Adhikary has already moved from experimenting with technology to contributing to the wider cybersecurity ecosystem. His story is a reminder that age is not necessarily a barrier to meaningful work in technology, particularly in fields where curiosity, persistence and technical ability can matter as much as formal experience.

His journey from cybersecurity discoveries in India to international recognition shows how responsible security research can create opportunities across borders. With his work at IIT Kanpur continuing, Adhikary’s career is still at an early stage, but the events of this year have already established an impressive foundation.