Certificate in Ethical Hacking and Information Security
The Certificate in Ethical Hacking and Information Security equips learners with practical skills in identifying, assessing, and responding to cybersecurity threats. Students learn to think like hackers in order to defend networks and systems against cyber attacks. The programme covers penetration testing, vulnerability assessment, network security, web security, and cyber forensics, providing hands-on training in the same techniques used by malicious hackers but with the intention of securing rather than exploiting systems.
The short answer
- What it costs
- Up to Ksh 150,000 a year at a private one.The detail
- Who can get in
- A KCSE mean grade of D+ or above. There is another way in without it.The detail
- How long, and when
- Takes 6 months, full-time, evening, weekend, with 0 months of attachment. Next intake January 2027, at 4 institutions.The detail
- Where it leads
- 8 careers in the catalogue. The least exposed to AI is Cloud Security Engineer, at 14 out of 100.The detail
The programme
What you study, how long it takes, and how it is delivered.
Overview
Students develop competencies in information security fundamentals, desktop and server security, data security, network security, communication security, web security, and vulnerability assessment and penetration testing (VAPT). The curriculum covers protection from server attacks, information security management systems, cyber law, cyber forensics, cyber terrorism, and identity theft. A practical project consolidates learning through real-world security assessment exercises.
Kenya's cybersecurity landscape has evolved rapidly with the increasing digitisation of government services, financial systems, and business operations. The Kenya Computer Incident Response Team (CIRT) and the Communications Authority of Kenya have highlighted growing cyber threats including ransomware, phishing, and data breaches. The National Kenya Cybersecurity Strategy and the Data Protection Act 2019 have created regulatory demand for cybersecurity professionals. Organisations across banking, telecommunications, government, and healthcare require personnel skilled in ethical hacking and information security.
The programme is delivered through a combination of classroom instruction and intensive laboratory practice. Students work with industry-standard security tools in controlled lab environments, conducting penetration tests, vulnerability scans, and security audits. Teaching methods include hands-on lab exercises, capture-the-flag competitions, case studies of real cyber attacks, and project-based learning. The programme is offered during the day, evening, and weekends to accommodate diverse learner schedules.
Graduates find employment as junior security analysts, penetration testing assistants, cybersecurity technicians, or IT security support officers in organisations across various sectors. The certificate also provides a pathway to diploma programmes in ethical hacking and information security. Industry certifications such as CEH (Certified Ethical Hacker) and CompTIA Security+ complement the academic certificate and enhance employability.
This programme is ideal for KCSE graduates interested in cybersecurity, IT professionals seeking to specialise in security, and individuals working in network administration or system administration who wish to add ethical hacking skills. No prior security experience is required, though basic computer literacy and networking knowledge are beneficial.
What you study
10 subjects- Information Security Fundamentals
- Desktop and Server Security
- Network Security
- Web Security
- Vulnerability Assessment and Penetration Testing (VAPT)
- Data Security
- Communication Security
- Cyber Forensics
- Cyber Law and Compliance
- Information Security Management Systems
Modules
8 in the programmeIntroduction to Information Security
Year 1Semester 13 creditsCore
Foundational concepts of information security including the CIA triad, security threats and vulnerabilities, history of hacking, security policies, and the cybersecurity landscape in Kenya and globally.
Desktop and Server Security
Year 1Semester 13 creditsCore
Security of desktop and server environments covering operating system hardening, access control, patch management, malware protection, and securing Windows and Linux systems.
Data Security
Year 1Semester 13 creditsCore
Data security principles including encryption, data classification, data loss prevention, database security, backup and recovery, and data privacy compliance under the Kenya Data Protection Act.
Network Security
Year 1Semester 13 creditsCore
Network security fundamentals covering firewalls, intrusion detection and prevention systems, network protocols, VPNs, network segmentation, and securing network infrastructure against attacks.
Communication and Web Security
Year 1Semester 23 creditsCore
Communication security and web application security covering SSL/TLS, email security, web vulnerabilities (OWASP Top 10), SQL injection, cross-site scripting, and securing web applications.
Vulnerability Assessment and Penetration Testing
Year 1Semester 23 creditsCore
Vulnerability assessment and penetration testing (VAPT) methodologies covering reconnaissance, scanning, exploitation, post-exploitation, and reporting, with hands-on lab exercises using industry-standard tools.
Protection from Server Attacks and Security Management
Year 1Semester 23 creditsCore
Server attack prevention strategies and information security management systems covering ISO 27001, security governance, risk management, incident response, and building security programmes for organisations.
Cyber Law, Forensics and Project
Year 1Semester 23 creditsCore
Cyber law and compliance in Kenya, cyber forensics fundamentals including digital evidence collection and analysis, combined with a capstone security assessment project applying all learned competencies.
Specialisations
Penetration Testing
Focus on offensive security techniques including vulnerability assessment, exploitation, and security testing of networks and applications.
Security Operations
Focus on defensive security including security monitoring, incident response, and managing security controls in organisational environments.
Digital Forensics
Focus on digital evidence collection, analysis, and cyber forensics for incident investigation and legal proceedings.
A day as a student
A typical day combines morning lectures on security concepts or attack methodologies with intensive afternoon lab sessions where students practise penetration testing, vulnerability scanning, and security auditing in controlled environments. Capture-the-flag exercises, security tool tutorials, and real-world attack case studies form core learning activities, with students building practical defensive and offensive security skills.
The trade-offs
| In its favour | Against it |
|---|---|
| Cybersecurity is one of the fastest-growing fields globally, with high demand and competitive salaries in Kenya and internationally. | Cybersecurity knowledge requires continuous updating as threats, tools, and technologies evolve rapidly. |
| Hands-on, lab-based training using industry-standard tools produces practical, job-ready skills. | The programme is offered at only one institution in Kenya, limiting geographic accessibility. |
| Industry certifications (CEH, Security+) can be pursued alongside the programme to enhance employability. | Senior cybersecurity roles typically require diploma or degree-level qualifications plus industry certifications. |
What it costs
Tuition at both ends of the market, and how to pay for it.
What it costs, and where
Against 191 technology coursesAnnual tuition in Kenyan shillings, rounded. The upright tick is the median for this field, so a bar sitting entirely to its right is an expensive programme by the standards of its own subject.
The fine print
Private: Riara 150K, Visualdo 90K/yr (riara.ac.ke, visualdo.ac.ke). Public: none found.
HELB loans and NGCDF bursaries are available for eligible Kenyan students enrolled in certificate programmes at chartered universities.
Funding options
HELB Loan
NGCDF Bursary
Scholarships
2 recordedHELB Loan
LoanKsh 40,000Kenyan
Kenyan students enrolled in certificate programmes at chartered universities
NGCDF Bursary
BursaryKenyan
Kenyan students from respective constituencies pursuing certificate-level studies
Scholarships you could apply for
8 usable where it is taught- KCB Foundation Scholarship
Closes 31 March 2027FullKCB Bank
Full tuition + stipend
- Safaricom Foundation ICT Scholarship
Closes 30 June 2027FullSafaricom Foundation
Full tuition + internship
- HELB Undergraduate Scholarship
Closes 31 July 2027PartialHigher Education Loans Board
KES 40,000 to 60,000 per year
- County Government Scholarships
Varies by countyPartialCounty Governments
KES 50,000 to 200,000 per year
- Mastercard Foundation Scholars Program
Varies by partner universityFullMastercard Foundation
Full university education
- Moringa School Craftbyte Scholarship
QuarterlyFullMoringa School
Full software development course
- Strathmore University Financial Aid
Before semester startsPartialStrathmore University
Up to 50% tuition
- USIU-Africa Merit Scholarship
Before admissionPartialUSIU-Africa
50 to 100% tuition
Getting in
The grades, the alternatives, and who accredits the award.
What you need
KCSE or equivalent, suitable for college students taking Computer Science or IT courses, and practicing IT professionals. Basic computer literacy is required.
When it next starts
Taught at 4 institutionsIncluding Riara University, Africa International University, Strathmore University.
Including Riara University, Strathmore University, United States International University Africa.
Including Riara University, Africa International University, Strathmore University.
How you are assessed
3 componentsPractical Lab Assessments
Practical assessment40% of the mark
Hands-on lab assessments evaluating competencies in using security tools, conducting vulnerability scans, and performing penetration testing exercises.
End of Semester Examinations
Written examination30% of the mark
Written examinations at the end of each semester covering theoretical concepts, security principles, and cyber law.
Capstone Security Project
Project30% of the mark
Final project conducting a comprehensive security assessment of a simulated or real system, demonstrating penetration testing and reporting competencies.
Accreditation
Commission for University Education
AcademicRequired
Riara University is chartered by CUE. The programme is offered in partnership with Appin Technology Lab of India.
Riara University is chartered by the Commission for University Education (CUE). The programme is offered in partnership with Appin Technology Lab of India. Industry certifications from EC-Council (CEH) and CompTIA (Security+) complement the academic certificate.
Where it leads
The roles it opens, and what you leave with.
Where graduates go
4 rolesJunior Security Analyst
High demandKsh 35,000 to Ksh 120,000
Monitors security systems, analyses security alerts, assists in incident response, and supports vulnerability management activities in organisation security operations centres.
Penetration Testing Assistant
Moderate demandKsh 30,000 to Ksh 100,000
Assists senior penetration testers in conducting security assessments, running vulnerability scans, and preparing security assessment reports for clients.
Cybersecurity Technician
High demandKsh 28,000 to Ksh 90,000
Implements and maintains security controls including firewalls, antivirus systems, access controls, and security monitoring tools for organisations.
IT Security Support Officer
Moderate demandKsh 25,000 to Ksh 80,000
Provides security support to IT teams including user access management, security policy enforcement, security awareness training, and basic incident response.
Graduate outcomes
Graduates find employment as junior security analysts, penetration testing assistants, and cybersecurity technicians, with opportunities for freelance security assessment work and progression to diploma programmes.
Where these fields lead
8 careers- Cloud Security EngineerTechnology14Low exposure
- Industrial Robotics ProgrammerTechnology14Low exposure
- Embedded Firmware EngineerTechnology15Low exposure
- Embedded Linux DeveloperTechnology15Low exposure
- Site Reliability EngineerTechnology15Low exposure
- Applied Cryptography EngineerTechnology16Low exposure
- Database Reliability EngineerTechnology16Low exposure
- Edge Computing EngineerTechnology16Low exposure
Tools you will learn
Kali Linux
SoftwarePrimary
Wireshark
SoftwarePrimary
Metasploit
Software
Nmap
Software
Certifications
Industry links
Common misconceptions
Ethical hacking teaches you to break the law.
Ethical hacking teaches defensive security by understanding attack techniques, with all practice conducted in controlled, authorised environments. The programme includes cyber law and compliance modules.
You need to be a programming expert to study ethical hacking.
While programming knowledge is beneficial, the programme teaches security fundamentals from scratch. Basic computer literacy and networking knowledge are sufficient to begin.
Cybersecurity jobs are only in large corporations.
Cybersecurity skills are in demand across SMEs, government agencies, NGOs, financial institutions, and freelance security assessment work.
A 6-month certificate is too short for meaningful cybersecurity training.
The intensive, lab-based format covers 12 specialised units with hands-on practice, producing job-ready skills for entry-level security roles. Industry certifications can be pursued alongside.