100+ vulnerabilities reported. A MITRE-assigned CVE. A 24 TB Aadhaar data exposure flagged to CERT-In. And a professor’s ₹24 lakh saved just in time. Meet the Vadodara-based cybersecurity expert who believes India’s biggest security gap isn’t technology. It’s awareness.
The professor did not know she was being robbed.
Her phone looked normal. Her apps opened as usual. But something felt off, small glitches, strange behaviour she couldn’t explain. She reached out to Shivam Sharma.
What he found was chilling. Hidden inside her device was a Remote Access Trojan, a piece of malware that quietly hands an attacker control of a phone: messages, banking apps, one-time passwords, everything. Somewhere, someone was already inside, watching and waiting.
Shivam hunted it down and removed it. In doing so, he protected ₹24 lakh of her savings from disappearing.
“People think a hacker needs to be a genius to empty their account,” he says. “In reality, one wrong app or one bad link is enough.”
For Shivam, it was one more case in a decade spent on the frontline of India’s scam economy. For most people, it is a reminder of how close the danger sits: in their pocket, on their screen, one tap away.
The Education of a Hunter
Shivam’s career did not begin with headlines. It began with packets.
His first role was monitoring firewall traffic, reading streams of network data for the faint signatures of an attack. It taught him patience and precision, and how attackers hide in plain sight.
He moved into penetration testing, the discipline of breaking into systems legally so they can be fixed before criminals break in for real. Over the years, he has reported more than 100 security vulnerabilities to organisations, closing doors that attackers would have walked straight through.
One of those findings earned global recognition. While researching an open-source Apartment Visitors Management System, Shivam uncovered a SQL injection flaw that could allow an attacker to manipulate and extract database records. MITRE, the organisation that maintains the world’s official list of software vulnerabilities, assigned the finding CVE-2025-60860 and credited Shivam as its discoverer.
Another finding reached all the way to a university’s leadership. On the login page of University of the People, a global online university, Shivam discovered an open redirect vulnerability that attackers could abuse to send students, professors and administrators to a fake login page and steal their credentials. He reported it with a proof-of-concept and followed up until it was fixed. The university’s Chief Operating Officer personally wrote back to confirm that the tech team had resolved the issue, thanking him for his diligent findings.
But the work that would define him came next.
Inside the Scam Economy
As a Threat Intelligence and Threat Hunting analyst, Shivam stopped studying systems and started studying criminals.
He tracked live fraud campaigns aimed squarely at ordinary Indians: fake police officers threatening arrest, fake electricity officials warning of disconnection, fake customer care agents asking for “just one OTP.” He helped track fake call centre operations running these scripts at scale. His intelligence reports were submitted to the Defence Cyber Agency (DCyA).
The deeper he went, the clearer the pattern became.
“The scams I was hunting were not technically brilliant,” he says. “They worked because people were rushed, scared and unaware. The weakest link was never the technology. It was the lack of awareness.”
It was an insight that would reshape his mission. But first came the discovery that showed just how much was at stake.
24 Terabytes of Exposure
During his research, Shivam identified a publicly exposed data repository containing more than 24 TB of records linked to Aadhaar details of Indian citizens.
To put that in perspective: a single terabyte can hold millions of records. This was twenty-four of them, sitting exposed.
Shivam did not stay silent, and he did not exploit it. He followed responsible disclosure and reported the exposure to CERT-In, India’s national cyber security agency. Following his report, the data was taken down.
He understood exactly why it mattered.
“This is the fuel that scam call centres run on,” he says. “When a fraudster already knows your name, address and ID details, his lie becomes believable. Reporting it was not a choice. It was a responsibility.”
When MFA Wasn’t Enough
Individuals are not the only targets. Companies are, too, and many believe they are safe.
In one investigation, Shivam was called in by an enterprise that had been breached despite doing everything right on paper. Strong passwords. Multi-factor authentication on every account. Yet the attackers got in.
His investigation showed they had found a way around MFA itself, targeting the human layer rather than breaking the password.
“Companies believe MFA is a wall,” Shivam says. “It is a lock, and attackers now know how to get a copy of the key. Only a trained employee can spot the trap before clicking.”
A Rare Vantage Point
Few professionals in India have seen the threat landscape from as many angles as Shivam.
Over the years, he has worked on cybersecurity engagements involving some of the country’s most critical institutions, including the Central Bureau of Investigation (CBI), the National Investigation Agency (NIA), the Ministry of Electronics and Information Technology (MeitY), and India Trade Promotion Organisation (ITPO) at Bharat Mandapam.
His expertise spans penetration testing, threat hunting, incident investigation, SIEM architecture on platforms such as Securonix, Gurucul and Elastic, Managed SOC, and compliance frameworks including ISO 27001, ISO 27701, SOC 2, CERT-In guidelines and India’s Digital Personal Data Protection (DPDP) Act. He is a CISA-certified professional.
He is also building a cybersecurity product that delivers phishing simulation and awareness training in Indian regional languages, built to carry cyber safety beyond English-speaking metros.
It is this combination, the hacker’s mindset, the investigator’s instinct and the auditor’s discipline, that sets his training apart.
The Scam-Proof Framework
Every case taught Shivam the same lesson: scams follow a script. So he wrote a counter-script.
His Scam-Proof Framework rests on three pillars:
- Recognise – Every scam runs on the same four levers: urgency, fear, authority and secrecy. Learn to spot them, and the script loses its power.
- Verify – Pause. Check through an independent, official channel before you click, pay or share anything.
- Report – Know exactly where to report, so one alert person protects thousands of others.
His sessions do not rely on slides and theory. Participants work through real-world scam messages, calls and phishing pages modelled on campaigns seen in the wild, the same ones Shivam once hunted.
Building India’s Human Firewall
Based in Vadodara, Shivam now conducts cybersecurity workshops for colleges and awareness and DPDP training for corporate teams.
For students, his sessions open a door into one of the fastest-growing careers in the country, taught by someone who has done the work, not just studied it. For organisations, he strengthens the one layer no firewall can protect.
“Every company spends on firewalls,” he says. “Very few spend on the person sitting in front of the laptop. That person is your real firewall.”
As digital payments reach every town and village in India, so do the fraudsters. Shivam’s goal is for awareness to travel just as fast, from metro boardrooms to Tier 2 and Tier 3 campuses.
He puts it simply.
“A scammer does not win because of technology. He wins because of our hurry. Teach people to pause for ten seconds, and most of these crimes fail.”
