E|CIH EC-Council Certified Incident Handler
EC-Council’s incident handling and response programme: preparing for, dealing with and eradicating threats across the incident lifecycle - planning, containment, evidence gathering, forensic analysis and post-incident activity. Written for mid to senior professionals with at least a year of experience, and for the claims people who need to read an incident properly.
- EC-Council Awarded by
- 100 questions, 3 hours Exam
- 3 days, 24 hours Training
- 22 scenario-based labs Practical
What holding it changes
- Read an incident report properly Know what each phase should have produced, and notice when something is missing.
- Challenge a response invoice Understand what the work involved, so the cost is assessable rather than accepted.
- Spot the decisions that drive the loss Containment timing, evidence handling and notification choices all move the final number.
- Work with responders as a peer Hold the technical conversation during a live incident instead of waiting for the summary.
Why this certification
Incident response as it actually runs,
not as it is summarised afterwards.
- The full incident lifecycle: preparation, containment, eradication, recovery
- Evidence gathering and forensic analysis, and why the order matters
- Malware, email, network, web, cloud, insider and endpoint incidents, each handled on its own terms
- A claims handling or coverage course - it is the technical side
- A Cyber Insurance Academy certification - it is awarded by EC-Council
- An entry-level programme: EC-Council asks for a year in cybersecurity
This programme includes
- EC-Council E|CIH training, 3 days and 24 hours of class time
- 10 modules across the incident lifecycle
- 22 scenario-based labs in a simulated environment
- EC-Council examination: 100 questions, 3 hours, multiple choice
- Enrolment and scheduling handled by Cyber Insurance Academy
What the programme covers
Ten modules following an incident from first response through to the specific classes of incident a responder meets. Module names are EC-Council's own.
Programme modules
Introduction to Incident Handling and Response Module 1
Incident Handling and Response Process Module 2
First Response Module 3
Handling and Responding to Malware Incidents Module 4
Handling and Responding to Email Security Incidents Module 5
Handling and Responding to Network Security Incidents Module 6
Handling and Responding to Web Application Security Incidents Module 7
Handling and Responding to Cloud Security Incidents Module 8
Handling and Responding to Insider Threats Module 9
Handling and Responding to Endpoint Security Incidents Module 10
About this programme
EC-Council asks for a minimum of one year of experience as a cybersecurity professional. If you are coming from claims rather than security, talk to us first - we will tell you honestly whether to start here or with one of our own courses.
No. E|CIH is awarded by EC-Council. We deliver it alongside our own certifications, and enrolment goes through us.
Pricing depends on cohort, format and group size, so it is quoted rather than listed. Contact us and we will come back with a figure and available dates.
Ask us when you enquire. CE treatment for partner certifications depends on your regulator and is confirmed case by case rather than assumed.
Ours teach the insurance side of a cyber claim - coverage, wordings, quantum and disputes. E|CIH teaches the response itself. They complement each other; neither replaces the other.
Putting a team through it?
Partner programmes run as scheduled cohorts. Tell us how many people and when, and we will build it around your team.
- Group places and scheduled cohort dates
- Invoicing, purchase orders and VAT handled centrally
- Progress reporting you can hand to compliance
- Runs alongside your team's CIA certifications
Ask us about dates and pricing
This programme is delivered with EC-Council and enrolled through Cyber Insurance Academy. Tell us a little about where you are and we will come back with dates, pricing and an honest view of whether it is the right next credential for you.