AEES Executive Certificate in Cybersecurity of organisations

The capabilities the assessment attests if you pass.

• Stop an immediate risk
• Alert without spreading the trap
• Hold continuity
• Warn those who must act
• Refuse an urgent transfer
• Close the incident

This is the European Commission’s classification of skills, competences, qualifications and occupations. This certificate is linked to it through the skills below. Each link opens the official record.

• cyber security http://data.europa.eu/esco/skill/8088750d-8388-4170-a76f-48354c469c44
• ICT security legislation http://data.europa.eu/esco/skill/7814e88f-c133-4c3b-b27f-857afa145d42
• risk management http://data.europa.eu/esco/skill/6eff134b-e34f-4d6e-a6e8-5e47cf2228d0

Scientific readings related to this certificate.

• Financial Risk Management and Explainable, Trustworthy, Responsible AI 2022 · Finance, risk and ESG
• Machine Learning for Financial Risk Management: A Survey 2020 · Finance, risk and ESG

1. Module 1: Useful threat Modern security teams and business managers live inside a storm of alerts, rumors, and half-true warnings. A few of these signals matter immediately. Many do not. The challenge of this module is to help you decide, fast and calmly, which is which. You will learn a practical way to separate a useful threat from paralyzing noise. The method combines asset context, basic technical checks that any professional can request or perform, and authoritative external information. It aims to cut through uncertainty and move you to first actions that stabilize the situation while preserving evidence and continuity.
2. AEES Executive Certificate in Cybersecurity of Organisations, Module 2: First Move Your first move decides how much data leaves your organisation and how much damage spreads. In this module you will learn to act fast on containment, not on investigation. You will focus on cutting the attacker’s path out, blocking fraudulent payments, shifting to safe communications, and protecting continuity. Diagnosis and deep forensics come later. Here you must stop the bleeding. Many teams lose time by debating root cause or by forwarding malicious content to wider groups. Others overreact and shut down critical systems, which creates more harm than the attack itself. This module helps you find the practical middle ground. You will use decisive actions that stop exfiltration and fraud, use minimal viable isolation that keeps the business alive, and trigger the right alerts to those who must act now.
3. Evidence In most incidents, what you do in the first hour decides what you can prove later. Systems must keep running, but you also need a reliable trace that shows what happened. This module shows you how to preserve that trace without contaminating production or creating doubt about the integrity of your material. You will learn the practical side of evidence handling in an organisational setting. That means choosing what to capture first, isolating risk without destroying volatile data, documenting each action, and preparing clean handovers to internal stakeholders or external responders. You will rely on repeatable steps, simple tools, and clear decision points.
4. Module 4: Alert In a live incident, seconds matter. Alerts trigger action. If they are late, vague, or addressed to the wrong crowd, they waste time, cause confusion, and sometimes spread the very trap you try to stop. This module shows you how to alert with precision, to the smallest circle that can act, using content and channels that reduce harm and support quick decisions. Alerting is not about telling everyone what you know. It is about giving a targeted set of people the minimum information they need to act now, through a channel they can trust, while protecting evidence and business continuity. You will practice how to decide who must receive the alert, what to say, what not to include, and how to escalate in a controlled way.
5. AEES Executive Certificate in Cybersecurity of Organisations, Module 5 of 6: Payment. Refuse an urgent transfer that does not hold Urgent transfer fraud exploits speed, authority, and isolation. Attackers pretend to be executives, suppliers, or banks and push for immediate payment outside normal checks. The method is simple. Create pressure, remove verification, and move money to a controlled account. Once sent, recovery is uncertain and time critical. Your role is not to prove a crime beyond doubt. Your role is to interrupt the path to an irreversible transfer when the request does not hold up to basic scrutiny. This module trains you to pause and refuse when needed, without freezing your organisation. You will learn what a credible payment request looks like, which controls must be present before releasing funds, and how to communicate a refusal even to senior leaders. You will also learn how to alert without spreading the trap, how to keep projects moving while you verify, and how to document and close the incident so that lessons are applied.
6. Module 6 of 6: After You have contained the incident, restored continuity, and notified the right people. The real value of your work now depends on how you finish. Closure is not a date on a ticket. It is a decision that risk has been driven down to an agreed level, that systems and people can operate safely again, and that durable changes are in place to stop a similar trap from working next time. In this module you move from response to improvement. You will confirm eradication, validate recovery, and organise the post-incident review. You will capture facts and evidence, clarify what happened and why, and turn those findings into specific controls. You will also address your external footprint so the same attacker or a copycat cannot reuse the lure, the spoofed domain, or the pathway that worked once.