KhubabAhmed

Khubab Ahmed is a penetration tester and security researcher based in Islamabad, Pakistan. He holds the PNPT (Practical Network Penetration Tester) and PJPT certifications from TCM Security, along with a BS in Cyber Security from FAST-NUCES. He works as a VAPT Engineer at SNSKIES and teaches Digital Forensics and Cybersecurity as an Instructor at FAST-NUCES.

He holds over 21 certifications. The most significant are the PNPT (Practical Network Penetration Tester, TCM Security, August 2026) and the PJPT (Practical Junior Penetration Tester, TCM Security, December 2025). Others include the External Pentest Playbook, OSINT Fundamentals, Windows and Linux Privilege Escalation from TCM Security, advanced digital forensics certifications from Belkasoft, Junior Penetration Tester from TryHackMe, and Microsoft Certified Azure Fundamentals.

He holds a BS in Cyber Security from FAST-NUCES (National University of Computer and Emerging Sciences), completed between 2021 and 2025, and is currently reading for an MS in Cyber Security at Air University. This formal education sits alongside practical certifications including the PNPT and PJPT.

He offers penetration testing across networks, web applications and Active Directory, red team operations and adversary simulation, vulnerability assessment with CVSS-scored reporting, malware analysis and reverse engineering, digital forensics and incident response, and original security research. Engagements typically run from one to six weeks depending on scope.

The PNPT (Practical Network Penetration Tester) from TCM Security is a fully hands-on certification. The exam gives five days to perform a complete external and internal network penetration test including Active Directory exploitation, then two days to produce a professional client-facing report, followed by a live debrief. It assesses real engagement methodology rather than multiple-choice knowledge.

You can reach him through the contact form on this site, by email at contact@khubabahmed.com, or via LinkedIn at linkedin.com/in/khubabbahmed. Every engagement starts with a scoping conversation to define objectives, rules of engagement, in-scope targets, and success criteria before any testing begins.

Engagements follow a four-stage process. Scoping defines objectives, rules of engagement and in-scope targets. Reconnaissance covers passive OSINT and active enumeration to map the attack surface. Exploitation involves controlled, evidence-based exploitation to measure real-world impact. Reporting delivers CVSS-scored findings, proof-of-concept evidence, an executive summary, and a prioritised remediation roadmap. The approach aligns with PTES and OWASP standards.

Preserve evidence before you clean anything up. Do not wipe or rebuild affected machines, because that destroys the forensic artefacts needed to establish what happened and how far the attacker reached. Isolate affected systems from the network rather than powering them off, since shutting down loses volatile memory. Then capture memory and disk images, rotate credentials from a known-clean device, and begin timeline reconstruction. Khubab Ahmed provides DFIR support covering incident triage, memory and disk acquisition, timeline reconstruction, and a court-ready investigation report.

A vulnerability assessment identifies and catalogues weaknesses, usually with automated scanning plus manual verification, and tells you what could theoretically be exploited. A penetration test goes further by actually exploiting those weaknesses in a controlled way to prove real-world impact, chaining findings together to show how far an attacker could genuinely reach. An assessment answers what is wrong. A penetration test answers what an attacker could actually do about it. Khubab Ahmed offers both, and the right choice depends on whether you need coverage or proof.

Timelines depend on scope. A vulnerability assessment typically runs one to two weeks, a penetration test one to four weeks, and a full red team engagement two to six weeks. Malware analysis is usually three to seven days, and incident response begins immediately. Cost scales with the number of in-scope targets, the depth of testing, and whether a re-test is included. Every engagement starts with a free scoping conversation that produces a fixed quote before any work begins, so there are no open-ended bills.

Most security frameworks either require or strongly expect independent testing. ISO 27001, SOC 2, PCI DSS, and Cyber Essentials Plus all involve some form of technical verification, and clients increasingly ask for a recent pentest report during vendor due diligence. Reports are written with two audiences in mind: an executive summary an auditor or client can read directly, and technical detail with CVSS scoring and proof-of-concept evidence your engineers can act on.

Yes, all three, and testing them together usually reveals more than testing them in isolation. A foothold in a web application often becomes a route into the internal network, and from there into Active Directory. Khubab Ahmed is PNPT certified specifically in full-scope external and internal network testing with Active Directory exploitation, and holds separate credentials in Windows and Linux privilege escalation.

Yes. Khubab Ahmed is based in Islamabad, Pakistan, and works with clients worldwide. Penetration testing, vulnerability assessment, malware analysis, and security research are all delivered remotely as standard. Scoping calls and debriefs are scheduled to suit your timezone, and reporting and communication are in English.