QUANTROPIC · Courses
Course

AI Risk Management for Cybersecurity Experts

Run AI risk management as a repeatable process: identify, assess, treat and monitor the risks of AI systems with NIST AI RMF, ISO/IEC 23894 and 42001 and the EU AI Act, and fit it into your ISMS and enterprise risk register.

8 modules 32 lessons 40 videos · 175 min 65 quiz questions Personal coach Cerby Updated 5 Oct 2026 · sources to Oct 2026

Minimum requirements: Basic risk management skills

Enrol in the course Sign in

Already enrolled or invited by your organisation? Sign in to start.

AI Risk Management for Cybersecurity Experts
What makes this course different

Learn with Cerby, your personal coach

Most online courses are the same for everyone. This one is not. Cerby, your AI coach, works through the course with you: he answers on the spot, notices where you struggle, and connects every topic to your own organisation.

Ask about any cardStuck on a concept, a control or a framework? Ask on the card you are reading. Cerby knows the whole course and takes you to the exact video, diagram or check that helps.
He gets to know youYour role, your goal, the time you have. He notices which topics click and which do not, and remembers it from session to session.
He teaches by askingInstead of handing out answers, Cerby asks, gives hints and short practice questions, and brings back the questions you missed when it is time to review them.
Made for your organisationWhat you write in the worksheets about your own systems, Cerby uses to make every explanation concrete for your situation, and it ends up in your action plan.
What Cerby knows about you is yours: he tells you on request, and you can reset it at any time.

Classic IT risk management assumes deterministic systems. AI systems are probabilistic, depend on data that can be poisoned or go stale, drift without a code change and arrive through a supply chain of models and datasets. The frameworks now expect a dedicated answer: NIST AI RMF, ISO/IEC 23894 and 42001, and Article 9 of the EU AI Act for high-risk systems. This course turns those expectations into a process you can run and evidence, building on the AI Security for Cybersecurity Experts course.

What you will learn

  • Explain how AI risk differs from classic IT risk and relate NIST AI RMF's Govern, Map, Measure and Manage to the risk steps you already run under ISO/IEC 27005
  • Estimate likelihood and impact for AI-specific harms, set risk criteria and acceptance, and measure model risk with tests and metrics
  • Identify risk sources from the model attack surface and per algorithm family across the AI lifecycle
  • Relate NIST AI RMF, ISO/IEC 23894, ISO/IEC 42001 and the EU AI Act risk-based approach to each other and to your ISMS
  • Treat risks with standardised AI security controls and keep the evidence an assessor will ask for
  • Monitor drift, third-party and general-purpose model risk with KRIs, and report to the board and to regulators
  • Build an AI risk register and a treatment plan for one real AI system of your organisation

Who it is for

CISOs, risk managers, ISMS and compliance leads, security architects and auditors who must make AI risk a managed, evidenced part of enterprise risk management. The AI Security for Cybersecurity Experts course is the recommended foundation; no machine learning background is required.

What the course covers

1 AI Risk as a Discipline4 lessons
2 Risk Likelihood and Impact for AI4 lessons
3 Model Attack Surface and Risk Sources4 lessons
4 Risk Identification by Algorithm Family4 lessons
5 Reference Frameworks and Standards4 lessons
6 AI Security Controls for Risk Treatment4 lessons
7 Monitoring, Drift and Third-Party Model Risk4 lessons
8 AI Risk Register, Treatment Plan and Reporting4 lessons