Cybersecurity & AI Risk Management for IT Professionals

Define risk as the likelihood a vulnerability is exploited by a threat; manage assets—including people—by testing patches, backing up data, and choosing reliable hosts to reduce cyber risk.

Define risk management as eliminating as much risk as possible and limiting risks, including insider attacks, by identifying threats, evaluating asset value, and implementing cost-saving countermeasures for a secure environment.

Understand scope of cyber risk management, including data, storage, hardware, files, and human assets, and learn the four roles: risk manager, risk management specialist, subject matter expert, and risk owner.

Identify and mitigate threats from black hat criminals, hacktivists, nation states, and internal actors to reduce risk across the organization.

learn the steps of risk management, from identifying and prioritizing risks to choosing treatment options such as mitigate, avoid, accept, or transfer, and finally monitoring risk.

Assess risk by evaluating likelihood and impact, using qualitative and quantitative approaches, then multiply to rate events like phishing and server flooding to prioritize mitigation.

Assess Tech Solutions and build a real-time risk register in this interactive workshop for IT managers, mapping assets, threats, likelihood, impact, and mitigations for GDPR-ready risk management.

Identify and scope assets, assess threats and vulnerabilities, apply risk controls, and monitor risk through periodic reviews to align with the organization’s risk appetite.

Mitigate risk by applying countermeasures and safeguards to reduce the likelihood of threats. Use redundancy like data centers to counter DDoS and incentives like pay raises to reduce talent loss.

Learn how risk avoidance eliminates risk entirely, unlike mitigation which reduces likelihood; examine practical limits with Windows 11 versus Linux, anti-malware controls, and banning personal devices for sensitive data.

Risk transference outsources risk to a third party when internal mitigation is cost-prohibitive or lacking manpower or skills, such as insuring a flooded data center.

Assess why a company accepts risks when mitigation costs exceed asset value. Learn how risk owners decide to accept or reject risks, rarely, even for Windows 11 vulnerabilities.

Monitor risk continuously as threats evolve from flooding driven by rising rainfall to increasingly sophisticated phishing and sextortion, highlighting risk monitoring as the final step in risk management.

Translate cyber risk into monetary value using quantitative risk analysis and FAIR. Compare qualitative and quantitative methods, then apply CRQ in practice with a real-world FAIR workshop.

Contrast qualitative, semi-quantitative, and quantitative risk analysis, attaching monetary values to risks for boardroom decisions. Use actual dollar losses to prioritize risks and align with the C-suite.

Learn FAIR, the open standard for cyber risk quantification, decomposing risk into LEF and LM with TEF and vulnerability to yield probabilistic loss ranges via Monte Carlo simulations.

Learn to perform end-to-end cyber risk quantification using a scoping-first approach, Monte Carlo simulations, ALE, and CFO-ready briefing, covering threat frequency, vulnerability, primary and secondary losses, and decision support.

Perform a real-life FAIR analysis of credential stuffing risk for a mid-sized SaaS firm, using a completed worksheet and Monte Carlo simulations to quantify PII exposure for 500,000 customers.

Explore AI risk management in cybersecurity, compare NIST and EU AI Act frameworks, and identify, assess, and govern AI risks with a hands-on policy workshop and downloadable template.

Artificial intelligence acts as both defender and attacker in cybersecurity, highlighting new risk categories, governance gaps, and the need for dedicated artificial intelligence risk frameworks.

Explore the NIST AI Risk Management Framework overview and learn its four core functions—govern, map, measure, and manage—plus seven characteristics of trustworthy AI to guide practical adoption.

Explore the EU AI Act, its extraterritorial reach, four risk tiers, high-risk compliance, and penalties, and see how GP AI models align with NIST AI RMF for IT risk management.

Examine ai-powered threats, from deepfakes and ai-driven phishing to ransomware. Learn defense and risk management strategies: update risk registers, threat modeling, ai-specific incident response playbooks, and continuous monitoring.

Implement an AI governance framework to govern AI adoption, defining the AI risk policy, roles, data classification, risk assessment, and compliance mapping in a six-phase program to curb shadow AI.

Classify data into personal, confidential, internal company, and public categories to reflect sensitivity and access needs. Apply access controls and view-only restrictions for super confidential data.

Explore six security controls—logical, physical, administrative, detective, preventative, and corrective—to protect assets and reduce risk, with examples like passwords, firewalls, backups, and alarms.

Explore third party cyber risk management and supply chain attacks, with real-world examples like SolarWinds and Target, and distinguish inherent risk from residual risk in vendor security.

Identify third-party vendors and classify them by inherent risk, then use questionnaires to assess residual risk under ISO 27 001 and NIST. Prioritize high and medium risks and monitor continuously.

Analyze supply chain attack case studies—SolarWinds, Log4j, and MoveIt—to learn continuous monitoring, third‑party risk, and SBOMs, emphasizing trusted vendor risk, dependency visibility, and rapid response.

Explore how to identify vulnerabilities and implement vulnerability management to reduce risks, and learn pin testing and ethical hacking, including terminology and working with third-party providers.

Explore vulnerability management by distinguishing vulnerabilities from risk, learning how to identify, assess, and report security weaknesses, and explore methods to find vulnerabilities, including CVE details and ethical hacking.

Explore ethical hacking and penetration testing, including red, blue, and purple teams, and understand offensive versus defensive security. Learn pen test stages and box testing types: black, gray, and white.

Learn how ISO 31000 guides a comprehensive risk management program. Explore the principles, framework, and process, including integration, inclusion, customization, and continuous improvement for risk assessment, communication, and monitoring.

Explore ISO 27001 and 27005 risk requirements, including risk assessment and treatment, the statement of applicability, and how to integrate controls across organizational, people, physical, and technological domains.

Communicate risk severity clearly to executives to secure funding and empowerment, avoiding jargon and overwhelming detail, as illustrated by the Target breach case.

Translate technical cybersecurity risks into business language by focusing on consequences. Use the 15-example resource to show executives how risks affect revenue, information security, and operations.

Learn to present cybersecurity risks in executive-friendly formats, answering top risks, severity, mitigations, and leadership needs using table, heat map, and PowerPoint styles.

Deliver risk briefings with a four-minute update: provide context, highlight top risks, outline mitigation steps, and use visuals to translate risk into executive language and a clear call to action.