Course in Cyber Risk Models for Infrastructure
Online 300-hour course in cyber risk models for infrastructure. 6 modules covering Directive (EU) 2022/2555 (NIS2), IEC 62443 (industrial cybersecurity) and RiskLens (FAIR). Assigned tutor and enrolment open.
Course in Cyber Risk Models for Infrastructure — studying from the United Kingdom
Insurance and risk analysis are important sectors in the United Kingdom, with London's market, the City of London and Edinburgh's financial services hub employing large numbers of actuaries, risk analysts and data specialists. Engineering knowledge is increasingly valuable in assessing risk for vehicles, infrastructure, energy and emerging technologies. Insurers and reinsurers use modelling, catastrophe analysis and telematics data. Regulation by the Prudential Regulation Authority and the Financial Conduct Authority shapes professional practice in this area.
Fees for the United Kingdom: £455 (Pound sterling), with instalments and employer sponsorship available.
Relevant bodies in the United Kingdom
Typical roles
Questions from the United Kingdom
Which UK bodies relate to actuarial and risk qualifications, and does SEIUM's training count towards their exams?
In the UK, actuarial professional status is governed by the Institute and Faculty of Actuaries, which runs its own examinations and accreditation. SEIUM's training is not accredited by the IFoA or any national body, and it does not confer exemptions from those exams unless the IFoA itself decides so. Confirm exemption policies directly with the IFoA before enrolling.
Do UK insurers and risk firms hire people with private online engineering or data qualifications?
UK insurers and risk consultancies recruit on the basis of skills, experience and recognised credentials. A private qualification may support an application where it demonstrates applied data or risk modelling, but employers decide its value case by case. Practical project work often carries more weight, so present your final project clearly on your CV and in interviews.
How much study time is needed, and can I pay for it in instalments while working in the UK?
Programmes range from 300 hours for specialist courses to 1,900 hours for master's programmes, all delivered online in English. You are assigned a technical tutor for support. Fees are payable in instalments, and employer sponsorship is possible. Plan weekly study hours realistically, as the total hours are substantial for a part-time learner.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Define what is modelled in infrastructure cyber risk.
Characterise threats and vulnerabilities of industrial control systems.
Model the frequency and severity of cyber risk.
Analyse accumulation, contagion and systemic risk.
Apply the models to underwriting and claims management.
Validate models and align them with cybersecurity regulation.
Develop a cyber risk model for a critical infrastructure.
Who it's for
- Cyber risk modeller wishing to specialise in Cyber Risk Models in Infrastructure.
- Industrial cybersecurity analyst wishing to specialise in Cyber Risk Models in Infrastructure.
- Infrastructure cyber risk underwriter wishing to specialise in Cyber Risk Models in Infrastructure.
- Technology risk actuary wishing to specialise in Cyber Risk Models in Infrastructure.
- Cyber claims manager wishing to specialise in Cyber Risk Models in Infrastructure.
- Systemic risk consultant wishing to specialise in Cyber Risk Models in Infrastructure.
- Engineering or science graduates seeking to enter energy and utilities.
What you'll work with
- Directive (EU) 2022/2555 (NIS2)
- IEC 62443 (industrial cybersecurity)
- ISO/IEC 27005 (information security risk management)
- Law 8/2011 (critical infrastructure protection)
- NIST Cybersecurity Framework 2.0
- FAIR standard (quantitative information risk analysis)
6 modules · 300 h
1.1Critical infrastructure and essential services1.2Operational technology versus information technology1.3Assets: controllers, PLCs, industrial network and management systems1.4Scenarios: encryption, process manipulation and denial of service1.5Physical consequences of a digital incident1.6Dependencies on suppliers and cloud services1.7Accumulation: one provider across many insureds1.8Difference from the cyber risk of an office business1.9Data sources: public incidents, reports and internal data1.10Workshop: scenario tree for a water treatment plant
2.1Types of attacker and their motivation2.2Attack chain and cut-off points2.3Typical vulnerabilities in industrial environments2.4Network segmentation and remote maintenance access2.5Obsolescence of control systems and limited patching2.6Human factor: social engineering and operational errors2.7Security maturity: reference frameworks and levels2.8Externally observable indicators for underwriting2.9Technical questionnaires and their real value2.10Practice: maturity assessment of an operator
3.1Scarcity of historical data and its consequences3.2Frequency by scenario and by asset type3.3Severity: own damage, interruption and liability3.4Service interruption: cost per hour and recovery ramp3.5Physical damage and repair of industrial equipment3.6Response costs: forensics, negotiation and restoration3.7Administrative penalties and their treatment3.8Heavy-tailed distributions and extreme events3.9Structured expert judgement and its documentation3.10Practice: loss distribution for an industrial scenario
4.1Events affecting many insureds at once4.2Dependence on common software and cloud providers4.3Contagion modelling in dependency networks4.4Footprint scenarios: failure of a key provider4.5Accumulation limits and portfolio management4.6Correlation with other risks: electrical and supply4.7Systemic stress testing4.8Cyber war and state act exclusions4.9Market capacity and the role of reinsurance4.10Practice: estimating the footprint of a provider failure
5.1Structure of an industrial cyber risk policy5.2Own damage, interruption, liability and response5.3Waiting periods, limits and sublimits5.4Technical requirements as a condition of cover5.5Underwriting: minimum information and verification5.6Pricing: exposure, maturity and dominant scenario5.7Incident management: response providers and deadlines5.8Quantifying interruption in an industrial environment5.9Recovery against suppliers and manufacturers5.10Case study: incident in an electricity distribution network
6.1Model validation with scarce data6.2Sensitivity analysis of key assumptions6.3Documentation and independent review6.4European cybersecurity regulation for essential services6.5Notification obligations and their effect on claims6.6Supervisory expectations on cyber risk6.7Communicating uncertainty to management6.8Updating the model in response to new threats6.9Sector collaboration and information sharing6.10Final project: cyber risk model for an infrastructure
How you'll learn
100 % online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetable: students progress at their own pace within the intake, making it easy to combine with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is RiskLens (FAIR), Python (NumPy, SciPy), Shodan, SecurityScorecard, MITRE ATT&CK Navigator, in free, academic or evaluation versions. Tests are studied using real procedures for quantifying cyber-attack scenarios, exposure surface analysis and contagion modelling between infrastructures. Assessment is continuous per module plus the final integrating project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Define what is modelled in infrastructure cyber risk.
Characterise threats and vulnerabilities of industrial control systems.
Model the frequency and severity of cyber risk.
Analyse accumulation, contagion and systemic risk.
Apply the models to underwriting and claims management.
Where this takes you
Requirements
- No prior qualification required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 300 hours spread over 3 to 5 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
You work with RiskLens (FAIR), Python (NumPy, SciPy), Shodan, SecurityScorecard, MITRE ATT&CK Navigator. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
SEIUM's own diploma upon passing the continuous assessment and the integrating project. It is in-house training, not an official qualification from the Ministry.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the higher programme. Check the recognition policy when you enrol.
Related programmes
Retrocession and Risk Transfer Course
Online 300-hour course in retrocession and risk transfer. 6 modules covering Directive 2009/138/EC (Solvency II), Delegated Regulation (EU) 2015/35 (risk-mitigation techniques and counterparty risk) and Verisk…
Remote Loss Assessment in Mobility Insurance Course
Online 300-hour course in remote loss assessment in mobility insurance. 6 modules covering Ley 50/1980 de Contrato de Seguro (art. 38, loss assessment), Real Decreto Legislativo…
Course in Reinsurance Integration with IoT and Big Data
Online course of 300 h in reinsurance integration with IoT and Big Data. 6 modules covering Regulation (EU) 2023/2854 (Data Act), Regulation (EU) 2016/679 (GDPR) and…
More in Insurance, Risk & Actuarial Data
All Insurance, Risk & Actuarial Data programmes → · How to apply · Fees & financing · Scholarships