For Teachers

Teach vulnerability assessment from theory to practice, free. OpenVAPT gives you ready course plans, printable worksheets with answer keys, a marking rubric and a simulated practice server chosen by each student's seed. All of it works offline, and the practice labs are simulated in memory rather than run against a real machine. It is free, pre-release and used 100% at your own risk.

What teaching allows, and what stays excluded, is set by Teaching With OpenVAPT. Please read it before your first class. It covers who may teach, school lab machines, online classes, assessment, students under 18 and how students accept the terms.

Jump to Course Plans

Four-week, eight-week and fourteen-week plans mapped to the 36 Academy modules.

Jump to Worksheets and Keys

A printable worksheet and a teacher answer key for every module.

Jump to Practice Labs

Each student's seed gives a different simulated server, with an answer key for you.

Jump to Marking Rubric

Six weighted criteria for a student's assessment report, structured after NIST SP 800-115.

Before Your First Class

Read Teaching With OpenVAPT and the EULA, and follow the teacher's checklist in the teaching terms.
Brief students on the law and ethics first: assessing a system without authorisation is an offence in most countries (for example the Computer Fraud and Abuse Act in the United States, the Computer Misuse Act 1990 in the United Kingdom and the Computer Crimes Act 1997 in Malaysia). The Academy's module F2 covers this.
Decide where students work: the website and your projector demo only, the built-in simulated lab, or isolated lab machines your institution owns or controls and has authorised. Never a third party's system. A student may also run OpenVAPT on a computer the student personally owns or controls, but that is the student's own Own Use, not part of your class: do not run it on a student's machine for them or make it a requirement.
Every student who downloads or runs OpenVAPT reads and accepts the acknowledgements personally. You may not accept for them, and you may not tell them to use --accept-terms. Students under 18 may download or run OpenVAPT only after a parent or guardian has accepted the EULA for them; otherwise they use only the website Academy and watch your demonstration.
OpenVAPT is pre-release software (see Release Channels). It may be wrong or unstable. Use it only on isolated lab machines, 100% at your own risk, and remember that a clean report does not prove a system is secure.

Course Plans

Four-Week Introduction to Vulnerability Assessment · 4 Sessions of 2 Hours

From what VAPT is, and the law around it, to running and reading a first assessment on the simulated lab. For: Diploma, first-year degree or upper secondary students with basic Linux (students under 18 need a parent's or guardian's acceptance before downloading).

Week	Topic	Academy Modules	Activity
1	Security Basics, Ethics and the Law	F1, F2	Discuss computer misuse law in the students' own country and authorisation; students accept the acknowledgements personally and run openvapt demo.
2	Vulnerabilities and Ratings	F3, P10	Read three findings in the demo report and explain their CVE, CWE and CVSS.
3	Server and Network Exposure	P1, P3	Practice lab: each student scans their own seeded practice server and lists the five most serious findings.
4	Reporting	A1, A3	Write a one-page assessment report of the practice server, marked with the rubric.

Offline copy: openvapt teach course intro-4

Eight-Week Vulnerability Assessment Course · 8 Sessions of 3 Hours

A full assessment cycle: plan, discover, analyse, report, remediate and verify, across servers, networks, TLS and web applications. For: Degree or professional certificate students.

Week	Topic	Academy Modules	Activity
1	Foundations, Ethics and Scope	F1, F2	Rules of engagement exercise: write the scope and authorisation for an assessment of a school lab machine.
2	Vulnerabilities, CVE, CWE and CVSS	F3, P10	Score three findings with the CVSS v3.1 calculator and compare with OpenVAPT's vectors.
3	Linux Hardening, SSH, Access Control and Logging	P1, P2, P7, P15, P16	Worksheets P1 and P15; practice lab triage of host findings, then ask what the logs would show.
4	Network Exposure, Firewalls and Data Services	P3, P12, P8	Map listening services against firewall rules for the practice server (NET-FW-006).
5	TLS and Web Security	P4, P5, P6	Explain each failed web check on the practice server and its fix.
6	Services, Application Stacks and CMS	P11, P13, P14, P9	Write the corrected systemd unit and Tomcat settings for the vulnerable lab.
7	Remediation and Verification	A2	Compare vulnerable and hardened lab reports with openvapt diff; plan remediation by effort.
8	Reporting and Presentation	A3, A4	Submit a full assessment report of the practice server, marked with the rubric; optional: design a new check.

Offline copy: openvapt teach course course-8

Fourteen-Week Semester Course · 14 Weeks, 1 Lecture and 1 Lab Session per Week

Every Academy module in depth, with weekly practice labs, a mid-semester test and a final assessment project on an institution lab machine. For: Undergraduate cyber security or IT programmes.

Week	Topic	Academy Modules	Activity
1	Security Basics	F1	Glossary quiz; set up the institution's isolated lab virtual machines.
2	VAPT, Ethics and the Law	F2	Case study discussion on unauthorised access; students accept the acknowledgements personally.
3	Vulnerabilities and Scoring	F3	CVSS scoring exercise.
4	Linux Server Hardening, Kernel, Boot, Logging and Time	P1, P17, P16, P21, P22	Practice lab with a personal seed; kernel, filesystem and boot findings explained; list the findings an investigator would miss without logs.
5	SSH, Identity, Privilege and Access Control	P2, P7, P15	Harden SSH on an isolated institution lab virtual machine the teacher has authorised, and verify with a targeted re-scan.
6	Network Exposure and Firewall Policy	P3, P12	Firewall rule review against listening sockets.
7	Mid-Semester Test	F1, F2, F3, P1, P2, P3, P7, P12	Printed worksheet questions; teacher answer keys.
8	TLS and Certificates	P4	Inspect the lab's TLS findings and explain each fix.
9	Web Headers, Cookies and Exposure	P5, P6	Practice lab web findings.
10	Data Services, Mail, DNS and Containers	P8, P19, P9, A5	Data service, mail and DNS configuration review.
11	Web Servers, Services, Application Stacks and CMS	P18, P11, P13, P14, A6, P20, P24, P25	Fix the vulnerable lab's nginx, Apache, systemd, Tomcat, Node.js, Django and WordPress settings on paper.
12	Vulnerability Management	P10, P23	Prioritise known exploited vulnerabilities.
13	Running, Fixing and Verifying an Assessment	A1, A2	Final project: assess an institution lab virtual machine with the teacher's authorisation.
14	Reporting and Building Checks	A3, A4, A7, A8	Submit the final report, marked with the rubric; present findings.

Offline copy: openvapt teach course semester-14

Printable Handouts, Worksheets and Answer Keys

Every module page prints as a handout: the browser's Print command drops the navigation, notices, quiz feedback and buttons and keeps the theory, key terms, lab steps, questions, references and the credit line. Each module also has a student worksheet and a teacher answer key. Generate Markdown files offline with openvapt teach worksheet P2 --out p2.md (add --answers for the key).

Module	Read First	Minutes	Handout	Worksheet	Answer Key
F1: Security Basics	None	15	Print the Module	Worksheet	Answer Key
F2: What VAPT Is, and Doing It Legally	F1	20	Print the Module	Worksheet	Answer Key
F3: Vulnerabilities, CVE, CWE and CVSS	F1, F2	20	Print the Module	Worksheet	Answer Key
P1: Linux Server Hardening	F1, F3	30	Print the Module	Worksheet	Answer Key
P2: SSH Security	P1	15	Print the Module	Worksheet	Answer Key
P3: Network Exposure and Firewalls	F1, F3	20	Print the Module	Worksheet	Answer Key
P4: TLS, Certificates and HTTPS	P3	20	Print the Module	Worksheet	Answer Key
P5: Web Security Headers and Cookies	F3	20	Print the Module	Worksheet	Answer Key
P6: Information Exposure and Misconfiguration	P5	25	Print the Module	Worksheet	Answer Key
P7: Identity, Passwords and Privilege	P1	25	Print the Module	Worksheet	Answer Key
P8: Data Services: Databases, File Shares, DNS and Mail	P3	30	Print the Module	Worksheet	Answer Key
P9: Containers and Kubernetes	P1	25	Print the Module	Worksheet	Answer Key
P10: Vulnerability Management: CVE, OSV and Known Exploited Vulnerabilities	F3	25	Print the Module	Worksheet	Answer Key
P11: Service Hardening With systemd	P1	25	Print the Module	Worksheet	Answer Key
P12: Firewall Policy Versus What Is Listening	P3	20	Print the Module	Worksheet	Answer Key
P13: Application Servers: Tomcat, Node.js and Python	P6	30	Print the Module	Worksheet	Answer Key
P14: CMS Hardening in Depth: WordPress, Joomla and Drupal	P6	25	Print the Module	Worksheet	Answer Key
P15: Access Control: Accounts, Sudo and Logins	P2, P7	25	Print the Module	Worksheet	Answer Key
P16: Logging, Auditing and Time	P1, P15	20	Print the Module	Worksheet	Answer Key
P17: Kernel, Filesystem and Boot Hardening	P1	35	Print the Module	Worksheet	Answer Key
P18: Web Server Hardening: nginx and Apache	P4, P5	30	Print the Module	Worksheet	Answer Key
P19: Database, Mail and DNS Hardening	P8	30	Print the Module	Worksheet	Answer Key
P20: Secrets, Cron and Account Hygiene	P7, P15	20	Print the Module	Worksheet	Answer Key
P21: Audit Logging and Monitoring Depth	P16	30	Print the Module	Worksheet	Answer Key
P22: Authentication Policy and Package Hygiene	P7, P15	35	Print the Module	Worksheet	Answer Key
P23: Test Design for Security Checks	F3	25	Print the Module	Worksheet	Answer Key
P24: Securing Self-Hosted AI Services	F2, F3	25	Print the Module	Worksheet	Answer Key
P25: Availability Without Load Testing	F3	20	Print the Module	Worksheet	Answer Key
A1: Running an Assessment	F2, F3	20	Print the Module	Worksheet	Answer Key
A2: Remediation and Verification	A1	20	Print the Module	Worksheet	Answer Key
A3: Reporting and Communication	A2	15	Print the Module	Worksheet	Answer Key
A4: Building Your Own Check	A1	30	Print the Module	Worksheet	Answer Key
A5: Container Runtime Hardening Depth	P9, P20	35	Print the Module	Worksheet	Answer Key
A6: Application Framework and CMS Configuration	P13, P14	35	Print the Module	Worksheet	Answer Key
A7: Security Testing in Agile Teams and CI	A2	25	Print the Module	Worksheet	Answer Key
A8: Tracing Findings to Security Requirements	A2	20	Print the Module	Worksheet	Answer Key

Copying and Adapting Materials

You may copy, adapt, shorten and translate the modules, quizzes, worksheets, rubric and course plans for your own students, free of charge, under Teaching With OpenVAPT. You may not sell them or present them as approved, certified or endorsed by OpenVAPT. Every copy or adaptation must:

Credit the source: "Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3."
Carry this notice: "OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk."
Say clearly where you changed the material.

The material was built by AI Cybersecurity Engineers and may contain mistakes. Check it before you teach it.

Please cite OpenVAPT in handouts, slides and course pages. Ready-to-copy credit lines and references are on How to Cite OpenVAPT, and the full guide is Citing OpenVAPT.

Classroom Use Terms

The short version of Teaching With OpenVAPT (TEACHING.md), which governs if anything here differs:

Free for teaching. Schools, colleges, universities and individual teachers may use, copy, adapt, shorten and translate the Academy and this toolkit for their own students, at no cost.
Credit required. Every copy or adaptation carries the Teaching Credit above and says where it was changed.
No selling, no endorsement. You may not sell the materials or present them as approved, certified or endorsed by OpenVAPT. Charging students a normal course fee is not selling the materials.
Students accept the terms themselves. Nobody accepts the acknowledgements for a student. Students under 18 need a parent's or guardian's acceptance before they download or run the tool.
Only authorised machines. The simulated lab, or isolated machines your institution owns or controls and has authorised. Never a third party's system.
Pre-release, as is. The material was built by AI Cybersecurity Engineers, may contain mistakes, and is used 100% at your own risk. Check it before you teach it.

Practice Labs: A Different Server for Every Student

A practice server is the simulated vulnerable lab with some weaknesses fixed. The seed decides which ones, check by check, so every student is likely to assess a different server, which makes copying a neighbour's report much harder. The same seed gives the same server in the same version of OpenVAPT. The practice lab is simulated in memory and is not run against a real machine.

Student

openvapt demo --lab practice --seed <student-number> --out my-report

The student reads the report, verifies each finding, rates it, writes fixes and submits an assessment report, marked with the rubric below.

Teacher

openvapt teach answers --seed <student-number>

Prints the list of weaknesses planted on that student's simulated server, with severity and category, as a Markdown table for marking.

Limitation: the answer key is computed by the same public code every student has, so any student can print the answer key for their own seed or anyone else's. Treat practice labs as learning exercises, not secure exams. For graded work, combine them with written questions, the student's own evidence and a short oral explanation of findings. The key lists what the lab planted; it is not proof that a report is complete or correct.

Marking Rubric

For a student's assessment report of a practice server or an authorised lab machine. Structured after the reporting guidance of NIST SP 800-115: scope and method, findings with evidence, risk, remediation and verification, limitations. Offline copy: openvapt teach rubric

Criterion	Weight	Excellent	Good	Satisfactory	Needs Work
Scope, Authorisation and Method	15%	States the exact target, written authorisation, rules of engagement, tools, date and method.	States target, authorisation and method with minor gaps.	Mentions target and tool but not authorisation or method.	No scope or authorisation.
Findings and Evidence	25%	Every significant finding is described with its evidence, affected item and check id; false positives are identified and justified.	Most findings have evidence; few errors.	Findings listed with little evidence.	Findings copied without evidence or understanding.
Risk Rating and Prioritisation	20%	Severity and CVSS are explained and adjusted for context; findings are ordered by risk and effort.	Severity used correctly with some context.	Severity copied without explanation.	No prioritisation.
Remediation and Verification	20%	Each fix is specific, safe (with rollback) and paired with a verification step; quick wins identified.	Fixes are correct but verification is partial.	Generic fixes with no verification.	Missing or unsafe fixes.
Limitations and Honesty	10%	Clearly states what was not tested and why a clean result is not proof of security.	States main limitations.	Limitations mentioned briefly.	Claims the system is secure.
Communication	10%	Executive summary a manager can act on; clear structure, correct terms, cited sources.	Clear with minor issues.	Hard to follow in places.	Unstructured.

Lab Recipe

Three ways to give students something to assess, from no setup to a full lab, each labelled by what exists today.

ExistsNo Setup

Simulated Lab: `openvapt demo`

Two servers live in memory inside the tool: one deliberately misconfigured, one hardened. Nothing is installed, listened on or written except the report folder you name.

openvapt demo --out demo-report
openvapt demo --lab hardened --out demo-hardened
openvapt diff demo-report demo-hardened

Classroom use: project the vulnerable report, pick three findings, and ask what the hardened report shows for each.

ExistsOne Server per Student

Practice Lab With a Seed

The practice lab is the vulnerable server with a seed-chosen set of weaknesses fixed, so each student assesses a different server. The teacher prints the planted weaknesses for any seed.

openvapt demo --lab practice --seed 42 --out s42
openvapt teach answers --seed 42

Still simulated in memory; see the limitation below about answer keys being public.

PlannedNot Yet Available

Lab Image for Virtual Machines

A ready-made Linux virtual machine image with the same misconfigurations as the simulated vulnerable server, so a class can assess, fix and re-scan a real machine on an isolated lab network.

This is planned work and does not exist yet. Until it does, build your own: install a supported Linux on an isolated virtual machine your institution owns, apply the settings each failed demo check describes, snapshot it, and let students harden it and scan again.

Setting Up a Lab

No setup: the website Academy and openvapt demo run on any computer and touch nothing.
Institution lab: isolated virtual machines on infrastructure your institution owns or controls, on a lab network with no route to production or third-party systems. Snapshot each machine so students can harden it and start again.
Before scanning a lab machine: record the authorisation, run openvapt scan --dry-run to preview every file, command and request, then scan with sudo openvapt scan --out report.
Install: build from source (recommended for teaching how the tool works) or use the installer on the Download page.

Questions

See the FAQ, or open an issue on GitHub, the only public channel. OpenVAPT is an academic project built by AI Cybersecurity Engineers and has no duty to provide support. It is not affiliated with, and is not endorsed by, any institution or any third party named on this page; third-party names, such as NIST, are used only to identify them.

Cite This Work: OpenVAPT. (2026). OpenVAPT: An open academic vulnerability assessment tool (Version 0.1.0-alpha.6) [Computer software]. https://github.com/OpenVAPT/openvapt