NetMinder Security

Insurance and compliance

Do cyber insurers require security awareness training?

Updated

Short answer

Many cyber insurers ask about security awareness training, and some ask specifically about phishing simulations and how often staff fail them. Requirements vary by insurer, form and policy size: some applications ask several detailed training questions, others ask none. Answer every question accurately, because insurers rely on the application, and keep records that prove what you said.

Is security awareness training required for cyber insurance?

There is no single industry rule. Each insurer writes its own application, and the questions change between products, policy sizes and years.

What is clear from published forms is that training comes up often, alongside multi-factor authentication, backups and patching. Some insurers go further and say training affects whether they will renew.

What do cyber insurance applications actually ask about training?

Here are examples from publicly available forms. They show the range, from a single checkbox to specific questions about simulation results.

  • Ridge Canada Cyber Solutions, large risk application (v2.2, 07-23): asks whether employee cybersecurity awareness training happens at least annually, whether it includes phishing simulation exercises, and whether employees who fail get additional training.
  • AIG CyberEdge ransomware supplemental questionnaire (AIG Australia, March 2021): asks the applicant to tick whether it trains staff at least annually, runs simulated phishing at least annually, and whether fewer than 15% of employees were successfully phished on the last test.
  • CFC cyber application for private enterprise (Canada): includes "Employee Awareness Training" in a checklist of controls the applicant has in place, defined as programs that can focus on identifying phishing emails.
  • Risk-Can Underwriting Managers, small to medium enterprise application (2025): asks about multi-factor authentication and other controls but contains no question about awareness training.

Can a lack of training affect renewal or coverage?

It can with some insurers. Cowbell's guidance on preparing an application says that if you do not have a security training program in place, it will require you to deploy one for renewal.

Insurers explain the interest by pointing to their claims data. Coalition, for example, says over half of all cyber insurance claims originate in the inbox, citing its 2024 Cyber Claims Report.

Read the policy itself as well as the application. Conditions, exclusions and warranties are where coverage is actually decided, and they differ between insurers.

Why does answering accurately matter so much?

The application is part of the basis for the policy. The Ridge application, for example, states that underwriters will rely on the statements made and that any coverage issued based on the form will be void if it contains falsehoods, misrepresentations or omissions.

That means a "yes" to a training question should describe what really happens, not what is planned. If training is annual, say annual. If simulations started last month, say so in the comments field rather than implying a long history.

What records should a business keep to back up its answers?

Keep evidence that matches the questions you answered. If a form asks about annual training, simulations and follow up for people who fail, you want a record of each.

  • Who was enrolled and who completed training, with dates.
  • How many phishing simulations were sent and when.
  • Click rate and report rate for each simulation or period.
  • What follow up training was given to people who clicked.
  • A report covering the policy period, ready to send to your broker.

How can MSPs help clients with cyber insurance applications?

MSPs usually know the answers to the technical questions better than the client does. Offer to review the application with the client before it goes to the broker, and flag any answer you cannot support with evidence.

Do not fill in or sign the application for the client. The business is the applicant and is responsible for its answers. Your role is to explain what is in place and provide the records.

NetMinder produces a branded cyber insurance report PDF for any date range, showing who was trained, simulations sent, click and report rates, and completion, which MSPs can give clients to support these answers.

Sources

  1. Ridge Canada Cyber Solutions: Cyber application, large risk, RLEA (07-23) v2.2 (PDF)
  2. AIG: CyberEdge ransomware supplemental questionnaire, March 2021 (PDF)
  3. CFC: Cyber application, private enterprise, Canada (PDF)
  4. Risk-Can Underwriting Managers: Small to medium enterprise cyber insurance application (PDF)
  5. Cowbell: Recommendations to prepare a cyber insurance application (PDF)
  6. Coalition: Security awareness training (blog, citing its 2024 Cyber Claims Report)

Common questions

Do all cyber insurers require phishing simulations?

No. Some applications ask directly about phishing simulations, such as the Ridge Canada large risk form and AIG's CyberEdge ransomware supplemental. Others only ask about training in general, and some small business forms do not ask about training at all. Check the specific application you are completing.

How often do insurers expect security awareness training?

Forms that ask about frequency commonly use "at least annually" as the benchmark, as both the Ridge and AIG forms do. Many businesses run shorter monthly simulations as well, which also gives them more data to report.

Does security awareness training lower cyber insurance premiums?

It may with some insurers, but there is no general rule and insurers rarely publish how individual answers affect price. Ask your broker how the specific insurer treats training before assuming a discount.

What happens if I answer yes to a training question and it is not true?

Insurers rely on application answers when issuing a policy. Some forms, such as the Ridge Canada large risk application, state that coverage will be void if the application contains falsehoods, misrepresentations or omissions. Answer accurately and use the comments field to explain anything partial.

What phishing click rate do insurers look for?

Most forms do not set one. AIG's CyberEdge ransomware supplemental is an example that does ask whether fewer than 15% of employees were successfully phished on the last test. Other insurers may use different thresholds or none.

Read next

Phishing basicsHow often should you run phishing simulations?For most small businesses, once a month is a sensible default: one short practice email per person, with a quick lesson for anyone who clicks. Official guidance from the NCSC, the Canadian Centre for Cyber Security and NIST does not set a fixed frequency. Monthly is a practical choice because it builds a habit, gives a usable trend and stays light enough that staff do not resent it.For MSPsWhat security awareness metrics should MSPs show clients in QBRs?In a QBR, show a small set of security awareness metrics as trends over time: phishing click rate, report rate, training completion, repeat clickers and coverage (the share of staff enrolled). Pair each number with one sentence on what it means and one action for next quarter. Owners care about direction and evidence, not dashboards full of detail.Phishing basicsWhat is a phishing simulation?A phishing simulation is a harmless practice email, built to look like a real scam, that an organization sends to its own staff. It shows who clicks, who reports it and who ignores it, then gives a short lesson to anyone who falls for it. The aim is practice and feedback, not punishment, so people get better at spotting and reporting real phishing.For MSPsHow do MSPs sell security awareness training to small business clients?MSPs sell security awareness training most easily by tying it to something the client already has to deal with: a cyber insurance application, a compliance rule such as the FTC Safeguards Rule, or a recent phishing scare. Package it inside your managed plan or as a simple per user add-on, run it for the client with little effort on their side, and show results in every review.

Run this for every client.

NetMinder runs monthly practice emails, short lessons and insurer-ready reports under your brand.

Book a demoSee pricing