Course in Cyber Risk Models for Infrastructure
Online 300-hour course in cyber risk models for infrastructure. 6 modules covering Directive (EU) 2022/2555 (NIS2), IEC 62443 (industrial cybersecurity) and RiskLens (FAIR). Assigned tutor and enrolment open.
Course in Cyber Risk Models for Infrastructure — studying from South Africa
South Africa has one of the more developed insurance and financial services sectors on the continent, with major insurers and reinsurers headquartered in Johannesburg and Cape Town. Actuarial and risk analysis skills are in demand for pricing, reserving and risk management. The Financial Sector Conduct Authority and the Prudential Authority regulate the sector, and insurers rely on data-driven models to meet capital and solvency requirements. Engineers with statistics and data skills are increasingly recruited into these roles.
Fees for South Africa: R 10 200 (South African rand), with instalments and employer sponsorship available.
Relevant bodies in South Africa
Typical roles
Questions from South Africa
Will a SEIUM qualification be recognised by the professional bodies in South Africa for this area?
SEIUM qualifications are private qualifications, not official state degrees, and they are not accredited by any South African body. Actuarial work in South Africa is overseen by the Actuarial Society of South Africa (ASSA), whose professional credentials follow their own examination and regulatory routes. Recognition of a SEIUM qualification is decided by employers or the relevant body, so verify this directly with them before enrolling.
How might this qualification be used by employers in South Africa in insurance and risk roles?
Insurers, banks and risk consultancies look for strong data, modelling and risk skills. A private qualification may support your profile, particularly alongside relevant experience, but it will not replace formal professional credentials where these are required. Whether a particular employer values it is up to them, so it is worth asking hiring managers in your target field how they would view it.
Can I study this programme alongside full-time work from South Africa, and is there a time zone or language issue?
Yes, the programme is delivered fully online and in English, so no student visa is needed to study from home. Master's programmes require 1,900 hours, postgraduate diplomas 800 hours and specialist courses 300 hours. Each student is assigned a technical tutor, fees can be paid in instalments, and employer sponsorship is possible. Ask SEIUM about the time-zone and weekly workload expectations before committing.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Define what is modelled in infrastructure cyber risk.
Characterise threats and vulnerabilities of industrial control systems.
Model the frequency and severity of cyber risk.
Analyse accumulation, contagion and systemic risk.
Apply the models to underwriting and claims management.
Validate models and align them with cybersecurity regulation.
Develop a cyber risk model for a critical infrastructure.
Who it's for
- Cyber risk modeller wishing to specialise in Cyber Risk Models in Infrastructure.
- Industrial cybersecurity analyst wishing to specialise in Cyber Risk Models in Infrastructure.
- Infrastructure cyber risk underwriter wishing to specialise in Cyber Risk Models in Infrastructure.
- Technology risk actuary wishing to specialise in Cyber Risk Models in Infrastructure.
- Cyber claims manager wishing to specialise in Cyber Risk Models in Infrastructure.
- Systemic risk consultant wishing to specialise in Cyber Risk Models in Infrastructure.
- Engineering or science graduates seeking to enter energy and utilities.
What you'll work with
- Directive (EU) 2022/2555 (NIS2)
- IEC 62443 (industrial cybersecurity)
- ISO/IEC 27005 (information security risk management)
- Law 8/2011 (critical infrastructure protection)
- NIST Cybersecurity Framework 2.0
- FAIR standard (quantitative information risk analysis)
6 modules · 300 h
1.1Critical infrastructure and essential services1.2Operational technology versus information technology1.3Assets: controllers, PLCs, industrial network and management systems1.4Scenarios: encryption, process manipulation and denial of service1.5Physical consequences of a digital incident1.6Dependencies on suppliers and cloud services1.7Accumulation: one provider across many insureds1.8Difference from the cyber risk of an office business1.9Data sources: public incidents, reports and internal data1.10Workshop: scenario tree for a water treatment plant
2.1Types of attacker and their motivation2.2Attack chain and cut-off points2.3Typical vulnerabilities in industrial environments2.4Network segmentation and remote maintenance access2.5Obsolescence of control systems and limited patching2.6Human factor: social engineering and operational errors2.7Security maturity: reference frameworks and levels2.8Externally observable indicators for underwriting2.9Technical questionnaires and their real value2.10Practice: maturity assessment of an operator
3.1Scarcity of historical data and its consequences3.2Frequency by scenario and by asset type3.3Severity: own damage, interruption and liability3.4Service interruption: cost per hour and recovery ramp3.5Physical damage and repair of industrial equipment3.6Response costs: forensics, negotiation and restoration3.7Administrative penalties and their treatment3.8Heavy-tailed distributions and extreme events3.9Structured expert judgement and its documentation3.10Practice: loss distribution for an industrial scenario
4.1Events affecting many insureds at once4.2Dependence on common software and cloud providers4.3Contagion modelling in dependency networks4.4Footprint scenarios: failure of a key provider4.5Accumulation limits and portfolio management4.6Correlation with other risks: electrical and supply4.7Systemic stress testing4.8Cyber war and state act exclusions4.9Market capacity and the role of reinsurance4.10Practice: estimating the footprint of a provider failure
5.1Structure of an industrial cyber risk policy5.2Own damage, interruption, liability and response5.3Waiting periods, limits and sublimits5.4Technical requirements as a condition of cover5.5Underwriting: minimum information and verification5.6Pricing: exposure, maturity and dominant scenario5.7Incident management: response providers and deadlines5.8Quantifying interruption in an industrial environment5.9Recovery against suppliers and manufacturers5.10Case study: incident in an electricity distribution network
6.1Model validation with scarce data6.2Sensitivity analysis of key assumptions6.3Documentation and independent review6.4European cybersecurity regulation for essential services6.5Notification obligations and their effect on claims6.6Supervisory expectations on cyber risk6.7Communicating uncertainty to management6.8Updating the model in response to new threats6.9Sector collaboration and information sharing6.10Final project: cyber risk model for an infrastructure
How you'll learn
100 % online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetable: students progress at their own pace within the intake, making it easy to combine with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is RiskLens (FAIR), Python (NumPy, SciPy), Shodan, SecurityScorecard, MITRE ATT&CK Navigator, in free, academic or evaluation versions. Tests are studied using real procedures for quantifying cyber-attack scenarios, exposure surface analysis and contagion modelling between infrastructures. Assessment is continuous per module plus the final integrating project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Define what is modelled in infrastructure cyber risk.
Characterise threats and vulnerabilities of industrial control systems.
Model the frequency and severity of cyber risk.
Analyse accumulation, contagion and systemic risk.
Apply the models to underwriting and claims management.
Where this takes you
Requirements
- No prior qualification required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 300 hours spread over 3 to 5 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
You work with RiskLens (FAIR), Python (NumPy, SciPy), Shodan, SecurityScorecard, MITRE ATT&CK Navigator. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
SEIUM's own diploma upon passing the continuous assessment and the integrating project. It is in-house training, not an official qualification from the Ministry.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the higher programme. Check the recognition policy when you enrol.
Related programmes
Corporate Criminal Liability in Insurance Course
Online 300-hour course in corporate criminal liability in insurance. 6 modules covering the Criminal Code, Article 31 bis (criminal liability of legal persons), UNE 19601 (criminal…
Course in Crypto-Assets and Transport Insurance
Online course of 300 h in crypto-assets and transport insurance. 6 modules covering Regulation (EU) 2023/1114 (markets in crypto-assets, MiCA), Regulation (EU) 2023/1113 (information accompanying transfers…
Course in Actuarial Frequency and Severity Models
Online 300-hour course in actuarial frequency and severity models. 6 modules covering Directive 2009/138/EC (Solvency II), Delegated Regulation (EU) 2015/35 and R (fitdistrplus, actuar). Assigned tutor…
More in Insurance, Risk & Actuarial Data
All Insurance, Risk & Actuarial Data programmes → · How to apply · Fees & financing · Scholarships