EC-Council, creator of the Certified Ethical Hacker (CEH) credential, has acquired Cyber Insurance Academy (CIA), the Delaware-based credentialing body whose Certified Cyber Insurance Specialist (CCIS) designation is approved for continuing education in more than 45 US states.
EC-Council has certified more than 400,000 professionals across 174 countries, making it one of the world’s largest cybersecurity credentialing organizations. The acquisition places it directly inside an insurance education market that has long struggled to keep pace with the risks brokers are being asked to place. CIA will continue to operate under its own brand and leadership as an EC-Council company.
CIA has rebuilt its CCIS designation as CCIS v2, adding modules on AI-driven threats, AI governance, and the coverage exposures that AI creates across insurance portfolios. That update reflects a shift already underway in the market. Carriers have begun conditioning coverage on documented AI controls. The Insurance Services Office released generative AI exclusion endorsements in January 2026, and some carriers have introduced AI sublimits. Brokers who cannot speak to those requirements are losing ground in client conversations.
According to IBM’s 2026 Cost of a Data Breach Report, published July 29 and conducted by the Ponemon Institute, one in four malicious breaches were AI-enabled in the period March 2025 to February 2026, a 56% increase year on year. AI-enabled breaches cost organizations an average of $6 million, roughly $1 million above the global breach average.
In a separate report published August 31, Swiss Re noted that large corporates buying average cyber limits of around $120 million in the US may be exposed when severe events occur, given that its own Cyber Claims Database shows an average of 10 losses per year have historically exceeded that benchmark. That combination of rising AI-driven frequency and inadequate limits is precisely the terrain brokers are now expected to navigate.
“The knowledge gap we’ve identified is holding the market back from reaching maturity and making products profitable,” said Guy Simkin, CIA’s co-founder and CEO. “Every insurance professional is now a technology risk professional, whether they realize it or not. Cyber is where we started, not where we stop.”
Simkin will continue leading the organization under EC-Council.
EC-Council gains a dedicated insurance education business with established industry accreditation and relationships across the broker and underwriter community. CIA, in turn, gains access to EC-Council’s technical infrastructure, global network, and ongoing threat intelligence, meaning course material can be updated as threat actors evolve rather than waiting on external content sourcing.
Asaf Armoni, CIA’s co-founder and chief technology officer, framed it in practical terms. “The technologies influencing insurance risk are evolving rapidly, and the industry needs education that evolves with them,” he said. “EC-Council brings the technical depth and scale that allow us to expand our capabilities while staying focused on what insurance professionals need to make informed decisions.”
Beyond CCIS v2, CIA will expand its portfolio into AI risk and emerging technology risk - covering areas such as autonomous systems and quantum computing - as well as role-based technology education designed for non-technical insurance professionals. Programs will be available through self-paced learning, role-based certifications, and enterprise programs for carriers, managing general agents (MGAs), and broker networks.
The acquisition reflects a wider industry shift away from carrier-sponsored training and toward formal, accredited credentials. The cyber insurance skills conversation has evolved considerably since it first surfaced as a concern. Where early efforts focused on getting brokers to understand basic policy structure, the current challenge is preparing the same professionals to advise clients on AI governance, interpret evolving exclusion language, and assess risk that changes faster than any annual renewal cycle can track.
Those advising on how AI-related incidents are covered or excluded need a deeper foundation than what most standard broker training provides. Brokers who hold the CCIS have an accredited credential that fulfills continuing education requirements across more than 45 states, which gives the designation practical value well beyond the course content.
Jay Bavisi, EC-Council’s founder and group CEO, described the rationale for moving into insurance rather than building a parallel product from scratch. “Cyber Insurance Academy brings deep insurance expertise to that equation. Together, we can help build the technology fluency the insurance industry increasingly needs as cyber, AI and emerging technologies reshape the risk landscape.”
The cyber insurance market has grown steadily, but the knowledge gap that has constrained it has not closed at the same pace. Brokers holding the CCIS already fulfill continuing education requirements across more than 45 states. Under EC-Council, the technical content behind that credential will be updated by specialists who track emerging threats directly, rather than sourced externally.
