Postgraduate Diploma in Threat Modeling, Pen-Testing and Vulnerability Management
Online 800 h Postgraduate Diploma in Threat Modeling, Pen-Testing and Vulnerability Management. 8 modules covering ISO/IEC 27001, NIST SP 800-115 (technical security testing) and OWASP ZAP. Assigned tutor and open enrolment.
Postgraduate Diploma in Threat Modeling, Pen-Testing and Vulnerability Management — studying from Malta
Malta is developing a niche in digital and software-intensive technologies, including connected mobility and vehicle-related software. The island's strong information technology and telecommunications base provides a natural foundation for work on advanced driver assistance, vehicle data and embedded software. Opportunities tend to arise with software houses, technology consultancies and multinational companies with engineering centres on the island. Professionals working in this area benefit from familiarity with functional safety standards and the software development practices used across the automotive value chain.
Fees for Malta: €1,290 (Euro), with instalments and employer sponsorship available.
Relevant bodies in Malta
Typical roles
Questions from Malta
Who regulates engineering practice and vehicle safety relevant to ADAS in Malta?
Engineering as a profession in Malta is regulated through the Chamber of Engineers (KSU) under the Engineering Profession Act, which governs the use of the title 'engineer'. Vehicle type approval and roadworthiness are handled by Transport Malta, and EU-level vehicle regulations apply. A SEIUM qualification is a private one and is not accredited by a national body, so its recognition depends on employers or the relevant authority.
Which Maltese employers could use ADAS or software-defined vehicle skills?
Demand in Malta is mainly from software, electronics and digital engineering firms, some serving automotive clients abroad, along with vehicle service and fleet operators. Large autonomous-vehicle deployment is not a major local sector, so roles are often remote or international. Employers will assess your portfolio, experience and any formal credentials, so present the qualification alongside concrete project work.
Can I study this at my own pace from Malta, and what language and workload should I expect?
Yes. Programmes are 100% online and taught in English, with an assigned technical tutor and a final project. No student visa is needed to study from home. Time zone is usually not a barrier since you study asynchronously, but confirm the schedule with the institute. Plan around your working hours, and ask about instalment payments and employer sponsorship.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Develop threat models using STRIDE and attack trees.
Plan authorised security tests following recognised methodologies.
Assess the security of web applications against the OWASP Top 10.
Review the hardening of systems and networks.
Prioritise vulnerabilities using CVSS and business context.
Design a vulnerability and patch management programme.
Write technical and executive reports on results.
Who it's for
- Cybersecurity analyst looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Security auditor looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Vulnerability management manager looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Application security engineer looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Cybersecurity consultant looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Technology risk analyst looking to specialise in Threat Modeling, Pen-Testing and Vulnerability Management.
- Engineering or science graduates seeking to enter cybersecurity consulting.
What you'll work with
- ISO/IEC 27001
- NIST SP 800-115 (technical security testing)
- OWASP Testing Guide
- ISO/IEC 29147 (vulnerability disclosure)
- ISO/IEC 30111 (vulnerability handling)
- CVSS v3.1 (FIRST)
- National Security Scheme (Esquema Nacional de Seguridad, RD 311/2022)
8 modules · 800 h
1.1Assets, threats and exposure surface1.2Confidentiality, integrity and availability1.3Vulnerability lifecycle1.4Reference frameworks: NIST CSF and ISO/IEC 270011.5Professional ethics and written authorisation1.6Rules of engagement and audit scope1.7Legal liability and data protection1.8Blue team and red team roles1.9Security metrics for management1.10Workshop: asset inventory of an SME
2.1Objectives of threat modelling2.2Data flow diagrams and trust boundaries2.3STRIDE methodology2.4Attack trees and prioritisation2.5PASTA and risk-oriented modelling2.6Modelling cloud architectures2.7Modelling industrial systems2.8Integration into the secure development lifecycle2.9Modelling and documentation tools2.10Practice: threat model of a web application
3.1Types of testing: black box, grey box and white box3.2OWASP Testing Guide methodology3.3PTES and OSSTMM as frameworks3.4Test planning and scope3.5Controlled laboratory environments3.6Evidence collection and traceability3.7Risk management during testing3.8Client coordination and escalation3.9Quality control of work3.10Case study: authorised test plan
4.1OWASP Top 10 and its interpretation4.2Authentication and session management4.3Access control and authorisation4.4Input validation and output encoding4.5REST API security4.6Secure server configuration4.7Static and dynamic code analysis4.8Third-party dependency review4.9Mitigation measures and verification4.10Laboratory: audit of a practice application
5.1Segmentation and secure network architecture5.2Operating system hardening5.3Identity management and secure Active Directory5.4Secure cloud configuration5.5Event logging and monitoring5.6Detection of weak configurations5.7Backups and resilience5.8Network incident response5.9Verification of defensive controls5.10Laboratory: hardening review of a server
6.1Vulnerability management programme6.2Vulnerability scanners and their tuning6.3CVE, CWE and public databases6.4CVSS scoring and risk context6.5Prioritisation based on known exploitability6.6Patch management and change windows6.7Exceptions and accepted risk6.8Metrics: remediation time and coverage6.9Responsible vulnerability disclosure6.10Practice: prioritised remediation plan
7.1Structure of an audit report7.2Executive summary for management7.3Technical description of findings7.4Evidence and reproducibility7.5Remediation recommendations7.6Verification of fixes7.7Presenting results to the client7.8Report confidentiality7.9Common reporting errors7.10Workshop: writing a complete report
8.1Scope definition and authorisation8.2System threat modelling8.3Test plan and laboratory environment8.4Controlled test execution8.5Analysis and prioritisation of findings8.6Vulnerability management plan8.7Proposal of defensive measures8.8Executive and technical report8.9Dissertation and presentation8.10Final review with the tutor
How you'll learn
Training 100 % online on the SEIUM campus, with downloadable material, recorded classes and assigned technical tutor. No fixed timetables: the student progresses at their own pace within the intake, making it possible to combine with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is OWASP ZAP, Nessus, OpenVAS, Microsoft Threat Modeling Tool, Wireshark, in free, academic or evaluation versions. Tests are studied using real procedures in isolated virtual laboratories, authorised audits of practice applications and vulnerability management exercises. Assessment is continuous per module, plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Develop threat models using STRIDE and attack trees.
Plan authorised security tests following recognised methodologies.
Assess the security of web applications against the OWASP Top 10.
Review the hardening of systems and networks.
Prioritise vulnerabilities using CVSS and business context.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours spread over 6 to 8 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
The programme works with OWASP ZAP, Nessus, OpenVAS, Microsoft Threat Modeling Tool, Wireshark. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
A SEIUM own diploma upon passing the continuous assessment and the integrative project. This is in-house training, not an official Ministry qualification.
Yes. Modules passed in a course or diploma in the same area are credited towards the advanced programme. Check the credit transfer policy when you enrol.
Related programmes
Postgraduate Diploma in On-board Calibration and Self-Calibration (Intrinsic/Extrinsic)
Online 800-hour Postgraduate Diploma in On-board Calibration and Self-Calibration (intrinsic/extrinsic). 8 modules covering ISO 26262:2018, ISO 21448:2022 (SOTIF) and Kalibr. Assigned tutor and open enrolment.
Postgraduate Diploma in MPC and Real-Time Optimal Control for AD
Online 800-hour Postgraduate Diploma in MPC and Real-Time Optimal Control for AD. 8 modules covering ISO 26262:2018, ISO 11270:2014 and acados. Assigned tutor and open enrolment.
Postgraduate Diploma in Hierarchical Learning and Transferable Policies
Online 800-hour Postgraduate Diploma in Hierarchical Learning and Transferable Policies. 8 modules covering ISO/PAS 8800:2024, ISO 21448:2022 (SOTIF) and PyTorch. Assigned tutor and open enrolment.
More in Autonomous, ADAS & Software-Defined Vehicle
All Autonomous, ADAS & Software-Defined Vehicle programmes → · How to apply · Fees & financing · Scholarships