Co-founder, CryptoGen Nepal
Find the gaps before someone else does.
I'm Nirmal Dahal, a cybersecurity consultant. I test systems the way attackers do, build the monitoring that catches them, and help teams prove it to auditors. Ten years in, on both sides of security, and available for remote engagements.
About me
Ten years across offence, defence and the classroom.
Nirmal DahalCo-founder, CryptoGen Nepal
I started as a web application penetration tester in 2016, testing for banks and payment providers. In 2019 I co-founded CryptoGen Nepal, where I lead the technical work across testing, security operations and audit. I also teach at Softwarica College and help run Pentester Nepal, a security community of more than 6,000 members.
- Co-founder, CryptoGen Nepal · since 2019
- Part-time lecturer, Softwarica College of IT & E-commerce · since 2022
- Community leader, Pentester Nepal · since 2017
Services
Where I can help.
- Penetration testingWeb, API, mobile, network and cloud testing from an attacker's point of view.How it works : Penetration testing
- Security operationsDetection engineering, SIEM, incident handling and malware analysis.How it works : Security operations
- GRC advisoryInformation system audits, ISO/IEC 27001 and security strategy.How it works : GRC advisory
- Agentic AI securitySecuring AI agents and LLM features, and automating the security work itself.How it works : Agentic AI security
- Training and speakingSecurity awareness, technical workshops and conference talks.How it works : Training and speaking
Hacktivities
The moments that stand out.
Plus 36 talks, trainings and panels delivered.
Selected work
Work you can check.
- Training and exercise2025National Cyber Drill, March 2025A four-day national exercise for engineers, officers and directors from about 30 government agencies, held 20 to 23 March 2025 (2082 BS).Read the case note
- Vulnerability research2017 to 2021CVE-2021-3258: stored XSS in a Question2Answer pluginQuestion2Answer (Q2A) is an open-source platform for question-and-answer communities. Sites extend it with plugins such as Q2A Ultimate SEO.Read the case note
- Malware analysis2022 to 2023Analysing the “Nepali Girl” Android trojanAn Android app spread across Nepal as APK links in messaging apps. Victims who installed it lost control of their phones, and the campaign was linked to money taken from bank accounts.Read the case note
- Security research2018GHDB-ID 4997: finding exposed application secretsMisconfigured deployments sometimes publish their environment files, exposing application keys and debug settings to anyone with a search engine.Read the case note
In the media
On TV, podcasts and the tech press.
Sushant PradhanMay 2023Video
Cyber Security, World of Hacking: Sushant Pradhan Podcast
A wide-ranging conversation on IoT security, zero-click attacks, AI in security, bug bounty, man-in-the-middle attacks, scam calls and staying safe online.
Kantipur TVDecember 2024Video
Ransomware Attack on Passport System: SAROKAR
After the Department of Passports was compromised and related scams rose, I joined Kantipur TV's Sarokar with Bijay Limbu (VAIRAV Tech) and SP Deepak Awosti (Cyber Bureau) to explain the risks to the public.
TechPanaFebruary 2023Video
'Nepali Girl' Trojan Analysis: TechPana
Our analysis of Nepali Girl, an Android trojan spread through WhatsApp that stole personal data and is believed to have drained crores from bank accounts.
Certifications
Credentials across offence, defence and audit.
- ISONov 2024ISO/IEC 27001:2022 Lead Auditor
- EC-CouncilMar 2021Certified Ethical Hacker (Master)
- APIsec UniversityOct 2025Certified API Security Analyst
- Cyber Warfare LabsApr 2025Certified Multi-Cloud Red Teaming Analyst
- Cyber Warfare LabsJun 2025Certified Multi-Cloud Blue Team Analyst
- SISA InfosecJul 2020Certified PCI Security Implementer
Recommendations
What people I've worked with say.
“I had the privilege of working with Nirmal. He led a comprehensive security audit that uncovered critical vulnerabilities and delivered a clear remediation roadmap…”
Aslam Ali on LinkedIn (opens in a new tab)Former Head of SOC, eSewa“I worked with Nirmal as a security vendor across several audit engagements. He identified and helped remediate high-risk vulnerabilities and ensured alignment with standards like ISO 27001. Top-tier expertise, recognized globally.”
Abhisek Bhattarai on LinkedIn (opens in a new tab)Former ISO, IME Khalti“I highly recommend Nirmal as a cybersecurity leader who combines deep technical expertise with exceptional client engagement. He's incredibly knowledgeable, generous with his time, and a true asset to any team.”
Samme Newton on LinkedIn (opens in a new tab)Head of SOC, Defence Logic“Nirmal has gone on to co-found CryptoGen Nepal and establish himself as one of the country's leading cybersecurity visionaries, earning global recognition for his expertise in offensive and defensive security as well as GRC.”
Hugh Shepherd Jr. on LinkedIn (opens in a new tab)Principal Consultant, HSJR Global Solutions“I've always been impressed by his profound expertise in cybersecurity, leadership qualities, and dedication to the community. He is the one who initiated the cybersecurity culture and community in Nepal.”
Kailash Bohara on LinkedIn (opens in a new tab)Security Engineer, Cedar Gate“Nirmal was a mentor to me when I started my cybersecurity journey. Whether it's red teaming or advanced exploitation techniques, he consistently demonstrates a strong grasp of both the technical and strategic sides of offensive security.”
Srijan Kafle on LinkedIn (opens in a new tab)Detection Engineer, ThreatDefence“I had the pleasure of working closely with Nirmal on several security projects. He is exceptionally skilled, has a great appetite to learn, and is a team player.”
Sakshyam Shah on LinkedIn (opens in a new tab)Software Engineer, TeleportWriting
Research and write-ups.
- 18 Apr 2026 · 6 min readFrom PyCon JP 2024 speaker to PyCon JP 2026 organiserHow Python shaped my offensive security work, what I presented at PyCon JP 2024 in Tokyo, and how it led to joining the PyCon JP 2026 organising team.#PyCon#pyconjp#cybersecurityRead the post
- 12 Jul 2022 · 2 min readLeveraging SQL injection to execute XSS by evading CSPHow a SQL injection was used to get past a content security policy (CSP) and execute XSS, starting with a short introduction to how CSP works.#csp bypass#sqlinjectionRead the post
- 9 Sep 2023 · 4 min readHardware hacking: bridging the cybersecurity gapHow a childhood spent repairing electronics led me to hardware hacking, and why hardware skills matter for closing gaps in cybersecurity.Read the post
Let's scope it together.
Tell me what you need to protect and by when. I'll reply with whether I can help and how I'd approach it.