I Just Finished Teaching Cybersecurity in Nigeria for 12 Weeks. Here Is What I Learned
What 12 Weeks of Teaching Cybersecurity in Aba Taught Me
The people behind the journey — Cybersecurity Class B, TechRise 3.0, Abia Cohort 3.0.A few months ago I stood in front of a room of students in Aba, Abia State, with a whiteboard, a Kali Linux machine, and a plan to teach cybersecurity from zero to DevSecOps in 12 weeks.
Some of them had never used a terminal before.
By Week 8, they were recovering deleted files from forensic disk images, reading raw memory dumps with Volatility 3, and writing incident reports that referenced NDPC notification timelines.
I want to write about what that experience was actually like, because most “I taught a bootcamp” posts are highlight reels. This one is not.
A few months ago I stood in front of a room of students in Aba, Abia State, with a whiteboard, a Kali Linux machine, and a plan to teach cybersecurity from zero to DevSecOps in 12 weeks.
Some of them had never used a terminal before.
By Week 8, they were recovering deleted files from forensic disk images, reading raw memory dumps with Volatility 3, and writing incident reports that referenced NDPC notification timelines.
I want to write about what that experience was actually like, because most “I taught a bootcamp” posts are highlight reels. This one is not.
The reason I Said Yes
When the opportunity came to facilitate TechRise 3.0 for Abia Cohort 3.0, I knew the curriculum was ambitious. Twelve weeks. Three phases. Offensive security, blue team defence, and DevSecOps, delivered to students with varying technical backgrounds, in a city where reliable internet is not guaranteed, on machines that ranged from brand-new laptops to machines that wheezed under Docker.
I said yes because I believed something that most people in the security industry quietly assume is not true: that you can teach practical, enterprise-level cybersecurity outside of a Western tech hub.
Turns out you can. The challenge is different than you expect.
When the opportunity came to facilitate TechRise 3.0 for Abia Cohort 3.0, I knew the curriculum was ambitious. Twelve weeks. Three phases. Offensive security, blue team defence, and DevSecOps, delivered to students with varying technical backgrounds, in a city where reliable internet is not guaranteed, on machines that ranged from brand-new laptops to machines that wheezed under Docker.
I said yes because I believed something that most people in the security industry quietly assume is not true: that you can teach practical, enterprise-level cybersecurity outside of a Western tech hub.
Turns out you can. The challenge is different than you expect.
The Thing Nobody Tells You About Teaching Security
The hardest part of teaching cybersecurity is not the tools.
It is not Metasploit, or Splunk SPL, or configuring Wazuh Docker with SSL certificates that inexplicably generate as directories instead of files. Those are fixable problems.
The hardest part is making the threat feel real to someone who has never experienced a breach.
When I stood in front of the class in Week 2 and said “an attacker can run a brute force tool that tries 47 passwords in 19 seconds,” I could see it land differently for different students. Some leaned forward. Others nodded politely.
So I built a story everyone could relate to.
The hardest part of teaching cybersecurity is not the tools.
It is not Metasploit, or Splunk SPL, or configuring Wazuh Docker with SSL certificates that inexplicably generate as directories instead of files. Those are fixable problems.
The hardest part is making the threat feel real to someone who has never experienced a breach.
When I stood in front of the class in Week 2 and said “an attacker can run a brute force tool that tries 47 passwords in 19 seconds,” I could see it land differently for different students. Some leaned forward. Others nodded politely.
So I built a story everyone could relate to.
The Decision That Changed Everything (PayliteNG)
About three weeks before the cohort started, I made a decision that I think defined the entire programme: instead of using generic, Western-facing examples, I would build a continuous fictional investigation set inside a Nigerian fintech company.
I called it PayliteNG.
PayliteNG is a payment processing company based in Aba. Two hundred thousand customers. PHP and MySQL on Apache. And on the night of January 13th, a threat actor running through a Tor exit node began hammering their SSH service at 3:47 in the morning.
Every week, students encountered a different piece of the same attack.
Week 3 — they analysed the auth.log and found 47 failed SSH attempts from 185.220.101.47.
Week 4 — they exploited the same vsftpd 2.3.4 backdoor the attacker used.
Week 6 — they built the Splunk rules that would have fired an alert at 03:47:20 AM.
Week 8 — they recovered the deleted backdoor script from a disk image using icat.
By Week 8, when I asked a student “what would you tell the CEO about this breach?” they did not hesitate. They knew the timeline. They knew the attacker’s IP. They knew which regulatory body needed to be notified and within how many hours.
That is what happens when the scenario feels real.
About three weeks before the cohort started, I made a decision that I think defined the entire programme: instead of using generic, Western-facing examples, I would build a continuous fictional investigation set inside a Nigerian fintech company.
I called it PayliteNG.
PayliteNG is a payment processing company based in Aba. Two hundred thousand customers. PHP and MySQL on Apache. And on the night of January 13th, a threat actor running through a Tor exit node began hammering their SSH service at 3:47 in the morning.
Every week, students encountered a different piece of the same attack.
Week 3 — they analysed the auth.log and found 47 failed SSH attempts from 185.220.101.47.
Week 4 — they exploited the same vsftpd 2.3.4 backdoor the attacker used.
Week 6 — they built the Splunk rules that would have fired an alert at 03:47:20 AM.
Week 8 — they recovered the deleted backdoor script from a disk image using icat.
By Week 8, when I asked a student “what would you tell the CEO about this breach?” they did not hesitate. They knew the timeline. They knew the attacker’s IP. They knew which regulatory body needed to be notified and within how many hours.
That is what happens when the scenario feels real.
What Actually Worked
Connecting every tool to a consequence.
When I taught Splunk in Week 6, I did not say “Splunk is a SIEM that aggregates logs.” I said: “PayliteNG’s attack ran for 7 days because nobody was reading the logs. With the Splunk rule you are about to write, that same attack would have generated an alert in 5 seconds.”
When I taught NDPC breach notification requirements, I showed them the exact timeline: attack started January 13, discovered January 20, 72-hour deadline passed January 15. The company was exposed to a fine of up to ₦10 million before any lawyer was even called.
Numbers land differently when they are in naira and attached to a scenario the student already knows.
Building things that break and then fixing them.
Some of the best learning in the cohort happened when something did not work.
When the Wazuh SSL certificate generator created a directory instead of a file and I walked through diagnosing and fixing it live students learned something that no documentation covers: how an experienced person thinks through an unexpected error. Methodically. Without panic. Checking one thing at a time.
That is not in any curriculum. But it might be the most valuable thing I taught.
Local context above everything else.
Every example I used was Nigerian. The companies in the threat modelling exercises were Nigerian. The attack scenarios referenced Nigerian regulatory bodies. The fintech breach was set in Aba.
This sounds obvious but it is surprisingly rare in technical education, even in Nigeria. Most of what exists is imported material with imported examples. The moment you switch the context to something familiar, the engagement changes completely.
Connecting every tool to a consequence.
When I taught Splunk in Week 6, I did not say “Splunk is a SIEM that aggregates logs.” I said: “PayliteNG’s attack ran for 7 days because nobody was reading the logs. With the Splunk rule you are about to write, that same attack would have generated an alert in 5 seconds.”
When I taught NDPC breach notification requirements, I showed them the exact timeline: attack started January 13, discovered January 20, 72-hour deadline passed January 15. The company was exposed to a fine of up to ₦10 million before any lawyer was even called.
Numbers land differently when they are in naira and attached to a scenario the student already knows.
Building things that break and then fixing them.
Some of the best learning in the cohort happened when something did not work.
When the Wazuh SSL certificate generator created a directory instead of a file and I walked through diagnosing and fixing it live students learned something that no documentation covers: how an experienced person thinks through an unexpected error. Methodically. Without panic. Checking one thing at a time.
That is not in any curriculum. But it might be the most valuable thing I taught.
Local context above everything else.
Every example I used was Nigerian. The companies in the threat modelling exercises were Nigerian. The attack scenarios referenced Nigerian regulatory bodies. The fintech breach was set in Aba.
This sounds obvious but it is surprisingly rare in technical education, even in Nigeria. Most of what exists is imported material with imported examples. The moment you switch the context to something familiar, the engagement changes completely.
What I Would Do Differently
More time on documentation.
Students became comfortable with tools faster than they became comfortable with writing about what those tools found. Writing a clean incident report, explaining a technical finding in plain English to a non-technical stakeholder, structuring a penetration test report so that the most critical issue is visible in the first paragraph , these are skills that take time and practice.
I would dedicate at least one full day per phase specifically to written communication. Not as a soft skill add-on. As a core technical requirement.
Because in the real world, a penetration test that finds a CVSS 10.0 vulnerability but produces a report nobody can read is only half the job.
Starting the portfolio conversation earlier.
I had this conversation with students in the final weeks: “Everything you have built in this cohort is portfolio material. Your Splunk rules, your Snort configuration, your forensics reports , all of it.”
I should have said that in Week 1.
Students who understood from the beginning that they were building a portfolio , not just completing exercises engaged differently. They documented more carefully. They asked better questions. They pushed further.
More student-generated scenarios.
The PayliteNG storyline worked because it felt real. But the most memorable moments came when students started asking “what if the attacker had done something different instead?” and we explored it live.
I want more of that in future cohorts. Less me presenting scenarios. More students interrogating them.
More time on documentation.
Students became comfortable with tools faster than they became comfortable with writing about what those tools found. Writing a clean incident report, explaining a technical finding in plain English to a non-technical stakeholder, structuring a penetration test report so that the most critical issue is visible in the first paragraph , these are skills that take time and practice.
I would dedicate at least one full day per phase specifically to written communication. Not as a soft skill add-on. As a core technical requirement.
Because in the real world, a penetration test that finds a CVSS 10.0 vulnerability but produces a report nobody can read is only half the job.
Starting the portfolio conversation earlier.
I had this conversation with students in the final weeks: “Everything you have built in this cohort is portfolio material. Your Splunk rules, your Snort configuration, your forensics reports , all of it.”
I should have said that in Week 1.
Students who understood from the beginning that they were building a portfolio , not just completing exercises engaged differently. They documented more carefully. They asked better questions. They pushed further.
More student-generated scenarios.
The PayliteNG storyline worked because it felt real. But the most memorable moments came when students started asking “what if the attacker had done something different instead?” and we explored it live.
I want more of that in future cohorts. Less me presenting scenarios. More students interrogating them.
What the Students Walked Away With
By the end of 12 weeks, students in this cohort could:
Build a complete detection stack using Splunk, Wazuh, Snort 3.0, and Suricata from scratch, on a single laptop, and explain what each layer detects and why.
Write five Snort 3.0 rules from memory that detect the most common attack techniques seen in Nigerian fintech breaches.
Perform a forensic investigation on a disk image, listing deleted files, recovering them, building a timeline, and documenting the chain of custody.
Write a professional incident report that references MITRE ATT&CK technique IDs, OWASP categories, CVSS scores, and the regulatory obligations of the organisation under NDPC and CBN guidelines.
Build a GitHub Actions security pipeline that automatically blocks deployments containing hardcoded secrets, vulnerable code, outdated libraries, and misconfigured Docker images.
This is not a junior course. These are employable, demonstrable skills.
By the end of 12 weeks, students in this cohort could:
Build a complete detection stack using Splunk, Wazuh, Snort 3.0, and Suricata from scratch, on a single laptop, and explain what each layer detects and why.
Write five Snort 3.0 rules from memory that detect the most common attack techniques seen in Nigerian fintech breaches.
Perform a forensic investigation on a disk image, listing deleted files, recovering them, building a timeline, and documenting the chain of custody.
Write a professional incident report that references MITRE ATT&CK technique IDs, OWASP categories, CVSS scores, and the regulatory obligations of the organisation under NDPC and CBN guidelines.
Build a GitHub Actions security pipeline that automatically blocks deployments containing hardcoded secrets, vulnerable code, outdated libraries, and misconfigured Docker images.
This is not a junior course. These are employable, demonstrable skills.
The Honest Part
Teaching is harder than I expected.
Not the technical content,I know the material. The hard part is the responsibility. When a student is struggling and you can see it, and you have over 50 other students in the room also needing attention, and you have two hours left in the session, you make decisions about where to spend your time and energy, and those decisions have consequences.
I made some good calls. I made some bad ones.
There were sessions I wish I had structured differently. There were moments where I moved too fast, where a concept did not land the way I thought it would, where the lab environment fought me at the worst possible time.
But I also watched a student who had never opened a terminal in their life successfully recover a deleted file from a forensic disk image in Week 8 and understand not just execute, but understand why it was significant.
That happened because the setup was right, the scenario was real, and the tools were in their hands from week one.
That is what I will carry forward.
Teaching is harder than I expected.
Not the technical content,I know the material. The hard part is the responsibility. When a student is struggling and you can see it, and you have over 50 other students in the room also needing attention, and you have two hours left in the session, you make decisions about where to spend your time and energy, and those decisions have consequences.
I made some good calls. I made some bad ones.
There were sessions I wish I had structured differently. There were moments where I moved too fast, where a concept did not land the way I thought it would, where the lab environment fought me at the worst possible time.
But I also watched a student who had never opened a terminal in their life successfully recover a deleted file from a forensic disk image in Week 8 and understand not just execute, but understand why it was significant.
That happened because the setup was right, the scenario was real, and the tools were in their hands from week one.
That is what I will carry forward.
What Comes Next
Graduation dayThe cohort ends. The learning does not.
I am starting a 30-day post-cohort challenge , working through every project and assignment from the programme myself, documenting everything publicly on GitHub, writing about it here and on LinkedIn, and turning the experience of teaching this cohort into a portfolio that represents what I actually know and can do.
If you are in cybersecurity in Nigeria, whether you are a student, a practitioner, or someone hiring, I would like to connect.
There is a generation of technical talent in this country that is more capable than the industry currently knows. I have spent the last 12 weeks watching it in a room in Aba.
Follow the 30-Day Post-Cohort Challenge:
GitHub: https://github.com/Miahnation
LinkedIn: https://www.linkedin.com/in/akorita-nehemiah-21aab8223
Medium: https://medium.com/@nehemiahakorita
Akorita-Ifeanyichukwu Nehemiah
Cybersecurity Professional · Educator · Facilitator, TechRise 3.0
Aba, Abia State, Nigeria
Graduation day
The cohort ends. The learning does not.
I am starting a 30-day post-cohort challenge , working through every project and assignment from the programme myself, documenting everything publicly on GitHub, writing about it here and on LinkedIn, and turning the experience of teaching this cohort into a portfolio that represents what I actually know and can do.
If you are in cybersecurity in Nigeria, whether you are a student, a practitioner, or someone hiring, I would like to connect.
There is a generation of technical talent in this country that is more capable than the industry currently knows. I have spent the last 12 weeks watching it in a room in Aba.
Follow the 30-Day Post-Cohort Challenge:
GitHub: https://github.com/Miahnation
LinkedIn: https://www.linkedin.com/in/akorita-nehemiah-21aab8223
Medium: https://medium.com/@nehemiahakorita
Akorita-Ifeanyichukwu Nehemiah
Cybersecurity Professional · Educator · Facilitator, TechRise 3.0
Aba, Abia State, Nigeria
Comments
Post a Comment