Global Learning for Operational Leaders
Classroom
14 sessions
Scroll for more
Online / Live
14 sessions
Scroll for more
Introduction
Course overview
Boards and executives increasingly want cyber risk expressed in financial terms so they can compare it with other risks and make informed investment decisions. Traditional heat maps rarely provide that clarity.
This Aractech course explains cyber risk quantification approaches, scenario definition, estimating frequency and loss magnitude, Monte Carlo analysis, using quantification to prioritise controls and insurance, and communicating results. Participants quantify cyber risk scenarios with spreadsheet models.
The course bridges cybersecurity, risk management and finance.
What you will achieve
Learning objectives
- Explain the limits of qualitative cyber risk ratings
- Define cyber risk scenarios
- Estimate frequency and loss magnitude
- Apply Monte Carlo simulation
- Use quantification for investment and insurance decisions
- Communicate quantified risk to leadership
Who should attend
Target audience
- Cyber risk managers
- Information security managers
- Enterprise risk managers
- Finance professionals
- Insurance and risk transfer specialists
- Auditors
Methodology
Learning approach
- Concept sessions
- Spreadsheet modelling
- Scenario workshops
- Case studies
- Presentation practice
Complete course outline
Five focused days of learning and application
The timings provided are estimates and may vary depending on the number of participants and the discussions taking place during the sessions. They are indicative only and do not constitute a binding commitment.
Day 1
Quantifying Cyber Risk
- Why quantify
- Heat map limitations
- Approaches
- Key concepts
- Coffee break
- Key concepts (continued)
- Data sources
- Exercise: Current risk register review
Day 2
Scenarios
- Scenario definition
- Assets and threats
- Loss events
- Scope
- Coffee break
- Scope (continued)
- Prioritising scenarios
- Workshop: Scenario definition
Day 3
Estimation
- Frequency estimation
- Loss magnitude
- Calibrated estimates
- Expert judgement
- Coffee break
- Expert judgement (continued)
- Ranges
- Exercise: Estimating losses
Day 4
Simulation and Decisions
- Monte Carlo basics
- Loss exceedance curves
- Control value analysis
- Coffee break
- Control value analysis (continued)
- Insurance decisions
- Lab: Monte Carlo model
Day 5
Communication
- Board reporting
- Integrating with ERM
- Limitations
- Programme development
- Coffee break
- Programme development (continued)
- Case study: Quantification in practice
- Capstone: Quantified risk report
FAQ
Frequently asked questions
What does Cyber Risk Quantification (IMCS-028) cover?
This course covers IT Management and Cyber Security through a structured five-day outline focused on practical application, discussion, and implementation planning.
When is the next available session?
The next scheduled session starts on 2 - 6 November 2026. See the course schedules section for the available dates and delivery formats.
Who should attend this course?
Cyber risk managers, Information security managers, Enterprise risk managers
Is bilingual course delivery available?
Yes. All course materials and presentations are provided in English, while bilingual explanation and discussion support may be available depending on the selected location and trainer availability. For example, when attending a course in Istanbul, you may request a Turkish-speaking trainer to explain the English course content in Turkish. Arabic explanation support may also be requested at this location. Other languages are available in selected cities. You can choose your preferred language support as an optional preference during registration.
How can I register for a session?
Use any Register button next to the available course dates to open the participant registration page and submit your booking request for the selected session.
Is this course available online as well as classroom-based?
Check the course schedules section for currently published classroom and Online / Live sessions.
Where are classroom sessions delivered?
Current classroom venues include Barcelona, London, Paris, Frankfurt, Rome, Kuala lumpur, Geneva.
How long is the training programme?
The programme runs for five days from 09:00 to 14:00, which gives 25 contact hours, including a daily 30-minute break (22.5 hours of instruction).
Quick request
Send quick request
Send a fast enquiry about this course and the academy team will get back to you.
Get a quotation
Request a formal quotation
Choose an available date and venue, add your participants, and we will email a formal quotation for Cyber Risk Quantification to your business address.