Course in Cyber Risk Models for Infrastructure
Online 300-hour course in cyber risk models for infrastructure. 6 modules covering Directive (EU) 2022/2555 (NIS2), IEC 62443 (industrial cybersecurity) and RiskLens (FAIR). Assigned tutor and enrolment open.
Course in Cyber Risk Models for Infrastructure — studying from Australia
Australia has a mature insurance and superannuation sector, with major insurers, reinsurers and financial institutions relying heavily on actuarial analysis and risk modelling. Engineers and data specialists contribute to catastrophe modelling, telematics-based pricing and claims analytics, particularly given the country's exposure to bushfire, flood and cyclone risk. The regulatory environment is shaped by prudential oversight and consumer protection frameworks. Employers include general and life insurers, consultancies, reinsurance firms and government risk agencies.
Fees for Australia: A$868 (AUD), with instalments and employer sponsorship available.
Relevant bodies in Australia
Typical roles
Questions from Australia
Does this programme lead to recognition by the Actuaries Institute or another Australian professional body?
SEIUM qualifications are private and are not accredited by the Actuaries Institute, Engineers Australia or any national body. The Actuaries Institute sets its own examination and membership requirements, which a private qualification does not replace. Recognition for any role is decided by the employer or the relevant body, so confirm their requirements before enrolling.
Which Australian insurers and risk employers might consider this training?
Insurers, reinsurers, banks, consultancies and risk management teams in Australia employ people with data and risk skills. Whether they consider a private engineering qualification relevant depends on the role and their own hiring policy. Your demonstrated skills, portfolio and final project are often what matter most to them.
Is the course manageable while working, and can my employer fund it?
Yes, the programmes are delivered entirely online in English, with an assigned technical tutor, so you can fit study around work from Australia. Fees can be paid in instalments, and employer sponsorship is possible. Check the total hours for your chosen programme and agree a realistic weekly schedule before you start.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Define what is modelled in infrastructure cyber risk.
Characterise threats and vulnerabilities of industrial control systems.
Model the frequency and severity of cyber risk.
Analyse accumulation, contagion and systemic risk.
Apply the models to underwriting and claims management.
Validate models and align them with cybersecurity regulation.
Develop a cyber risk model for a critical infrastructure.
Who it's for
- Cyber risk modeller wishing to specialise in Cyber Risk Models in Infrastructure.
- Industrial cybersecurity analyst wishing to specialise in Cyber Risk Models in Infrastructure.
- Infrastructure cyber risk underwriter wishing to specialise in Cyber Risk Models in Infrastructure.
- Technology risk actuary wishing to specialise in Cyber Risk Models in Infrastructure.
- Cyber claims manager wishing to specialise in Cyber Risk Models in Infrastructure.
- Systemic risk consultant wishing to specialise in Cyber Risk Models in Infrastructure.
- Engineering or science graduates seeking to enter energy and utilities.
What you'll work with
- Directive (EU) 2022/2555 (NIS2)
- IEC 62443 (industrial cybersecurity)
- ISO/IEC 27005 (information security risk management)
- Law 8/2011 (critical infrastructure protection)
- NIST Cybersecurity Framework 2.0
- FAIR standard (quantitative information risk analysis)
6 modules · 300 h
1.1Critical infrastructure and essential services1.2Operational technology versus information technology1.3Assets: controllers, PLCs, industrial network and management systems1.4Scenarios: encryption, process manipulation and denial of service1.5Physical consequences of a digital incident1.6Dependencies on suppliers and cloud services1.7Accumulation: one provider across many insureds1.8Difference from the cyber risk of an office business1.9Data sources: public incidents, reports and internal data1.10Workshop: scenario tree for a water treatment plant
2.1Types of attacker and their motivation2.2Attack chain and cut-off points2.3Typical vulnerabilities in industrial environments2.4Network segmentation and remote maintenance access2.5Obsolescence of control systems and limited patching2.6Human factor: social engineering and operational errors2.7Security maturity: reference frameworks and levels2.8Externally observable indicators for underwriting2.9Technical questionnaires and their real value2.10Practice: maturity assessment of an operator
3.1Scarcity of historical data and its consequences3.2Frequency by scenario and by asset type3.3Severity: own damage, interruption and liability3.4Service interruption: cost per hour and recovery ramp3.5Physical damage and repair of industrial equipment3.6Response costs: forensics, negotiation and restoration3.7Administrative penalties and their treatment3.8Heavy-tailed distributions and extreme events3.9Structured expert judgement and its documentation3.10Practice: loss distribution for an industrial scenario
4.1Events affecting many insureds at once4.2Dependence on common software and cloud providers4.3Contagion modelling in dependency networks4.4Footprint scenarios: failure of a key provider4.5Accumulation limits and portfolio management4.6Correlation with other risks: electrical and supply4.7Systemic stress testing4.8Cyber war and state act exclusions4.9Market capacity and the role of reinsurance4.10Practice: estimating the footprint of a provider failure
5.1Structure of an industrial cyber risk policy5.2Own damage, interruption, liability and response5.3Waiting periods, limits and sublimits5.4Technical requirements as a condition of cover5.5Underwriting: minimum information and verification5.6Pricing: exposure, maturity and dominant scenario5.7Incident management: response providers and deadlines5.8Quantifying interruption in an industrial environment5.9Recovery against suppliers and manufacturers5.10Case study: incident in an electricity distribution network
6.1Model validation with scarce data6.2Sensitivity analysis of key assumptions6.3Documentation and independent review6.4European cybersecurity regulation for essential services6.5Notification obligations and their effect on claims6.6Supervisory expectations on cyber risk6.7Communicating uncertainty to management6.8Updating the model in response to new threats6.9Sector collaboration and information sharing6.10Final project: cyber risk model for an infrastructure
How you'll learn
100 % online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetable: students progress at their own pace within the intake, making it easy to combine with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is RiskLens (FAIR), Python (NumPy, SciPy), Shodan, SecurityScorecard, MITRE ATT&CK Navigator, in free, academic or evaluation versions. Tests are studied using real procedures for quantifying cyber-attack scenarios, exposure surface analysis and contagion modelling between infrastructures. Assessment is continuous per module plus the final integrating project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Define what is modelled in infrastructure cyber risk.
Characterise threats and vulnerabilities of industrial control systems.
Model the frequency and severity of cyber risk.
Analyse accumulation, contagion and systemic risk.
Apply the models to underwriting and claims management.
Where this takes you
Requirements
- No prior qualification required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 300 hours spread over 3 to 5 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
You work with RiskLens (FAIR), Python (NumPy, SciPy), Shodan, SecurityScorecard, MITRE ATT&CK Navigator. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
SEIUM's own diploma upon passing the continuous assessment and the integrating project. It is in-house training, not an official qualification from the Ministry.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the higher programme. Check the recognition policy when you enrol.
Related programmes
ESG Impact Course in Transport Insurance
Online 300-hour course in ESG impact in transport insurance. 6 modules covering Directive (EU) 2022/2464 (CSRD), Delegated Regulation (EU) 2023/2772 (ESRS) and Workiva. Dedicated tutor and…
Course in Regulatory Auditing in Insurance Companies
Online 300 h course in regulatory auditing in insurance companies. 6 modules covering Directive 2009/138/CE (Solvency II), Law 20/2015 (LOSSEAR) and TeamMate+. Assigned tutor and open…
Course in Risk Assessment in Connected Mobility
Online 300-hour course in risk assessment in connected mobility. 6 modules covering UNECE Regulation No. 155 (vehicle cybersecurity), UNECE Regulation No. 156 (software updates) and Vector…
More in Insurance, Risk & Actuarial Data
All Insurance, Risk & Actuarial Data programmes → · How to apply · Fees & financing · Scholarships