EC-Council — the organization behind the Certified Ethical Hacker credential — announced on October 21 that it has acquired Cyber Insurance Academy, the credentialing body for the cyber and AI insurance industries. Financial terms were not disclosed. The Academy keeps its brand and its leadership and becomes an EC-Council Company, and its flagship Certified Cyber Insurance Specialist designation has been rebuilt for the AI era as CCIS v2.
For brokers, this is not an abstract education story. The CCIS is the credential a growing share of the people who sell, price and settle cyber cover already hold — and the company that now owns it built its name certifying hackers. What changes for the brokers who carry the designation, and for the ones deciding whether it is worth carrying?
What EC-Council actually bought
Cyber Insurance Academy, a Delaware company, trains brokers, underwriters, claims professionals and risk managers, and describes itself as built by the industry, for the industry. Its programs are accredited by the Chartered Insurance Institute, ANZIIF, RIBO and NIBA, and approved for continuing education in more than 45 U.S. states. It continues under Guy Simkin, its co-founder and CEO, and Asaf Armoni, co-founder, CTO and COO.
EC-Council, founded in 2001, says it has certified more than 400,000 professionals across 174 countries, holds ISO/IEC 17024 accreditation, and is recognized by the U.S. Department of Defense under Directive 8140. The release announcing the deal names the gap it is buying into directly: the professionals who assess, price, place and manage cyber and AI risk rarely come from a technology background, while people with deep technical expertise seldom work in the language of insurance. EC-Council, by its own account, chose to join an organization already closing that gap from inside the industry rather than entering from outside.
What changes in CCIS v2
The rebuilt designation threads AI through the whole credential rather than bolting it on. Per the Academy, Version 2 of the CCIS covers AI across all ten of its modules — how AI is changing the technology, the underwriting and pricing, the policy wording, and the claims — with new coverage of AI-driven threats, AI governance and the exposures AI creates across insurance portfolios.
The shape of the credential itself is unchanged in the ways that matter to a working broker:
- About 40 hours, self-paced and online, followed by a proctored exam — the Academy’s own guidance is three to four months at roughly three hours a week, with twelve months of access.
- Taught from zero. No technical background or prerequisites; the technology modules assume you can read a policy, not a packet capture.
- Worth up to 50 CE/CPD credits, claimed through your own regulator.
- Two clocks to keep it. The certification renews yearly for a maintenance fee, and every third year a CE checkpoint applies: 60 credits, at least 20 of them earned at the Academy.
The shelf around the flagship is widening at the same time. The Academy also lists AIF — AI Fluency for Cyber Insurance, a certificate course of about six to eight hours aimed at brokers, underwriters and claims — and CAIIP, a Certified AI Insurance Practitioner credential marked as coming in 2026, whose courses are already available and count toward the certification when it opens. Under EC-Council, the Academy says cyber insurance remains its core focus while it expands into AI risk, emerging technology risk — its examples are autonomous systems and quantum computing — and role-based technology education, delivered partly as enterprise programs for carriers, brokers and MGAs.
Why this lands on brokers
Simkin’s framing in the release is the bluntest version: “Every insurance professional is now a technology risk professional, whether they realize it or not.” Bavisi, EC-Council’s founder and group CEO, puts the acquisition’s purpose in one phrase — building “the technology fluency the insurance industry increasingly needs.”
Translated into placement terms: the broker’s side of a cyber submission increasingly involves a client’s AI exposure — what the client runs, what it governs, and which line the exposure lands on when something fails, the same question that decides whether a cyber policy responds when a vendor’s platform goes down, as we covered in today’s piece on vendor-outage coverage. A credential rebuilt around exactly those questions is aimed at the person asking them in the room. And because the Academy sells team-wide programs with manager dashboards and CE reporting, brokerages and MGAs can now be sold fluency as a floor standard, not an individual’s elective — which is how a designation turns into table stakes.
What to watch
- Whether CCIS v2 stays insurance-shaped. The Academy’s value is that it teaches technology in the language of wordings and exposures. EC-Council’s home turf is deep technical certification. The release insists the insurance focus is the point; the course catalogue over the next year will prove or disprove it.
- CAIIP’s opening. A second, AI-specific practitioner credential would split the signal — brokers will have to decide which letters a client actually reads.
- Pricing and terms under new ownership. The deal’s terms were not disclosed, and the Academy’s pitch leans on clear prices published up front. Whether that survives the acquisition is a fact to check, not a fear to print.
The deal’s logic, at least, is legible from both sides: a technical-certification giant bought the insurance industry’s own school instead of building a rival — the same specialist-book logic we wrote up this morning, applied to education — and the school gets its new owner’s threat research and global reach. For brokers, the takeaway is narrower and more useful — the credential many of you already list after your name now has an AI syllabus and a much larger owner, and the fluency it certifies is becoming the price of sitting in the cyber conversation at all.