The Cyber-Insurance Evidence Small Businesses Actually Need from Security Awareness Training

The Cyber-Insurance Evidence Small Businesses Actually Need from Security Awareness Training

Short answer: when a cyber-insurance application asks whether your employees receive security awareness training, the carrier wants proof, not a promise. Five records answer every version of the question: who is enrolled, who completed training and when, your phishing simulation history, your reporting-rate trend, and a dated summary of what runs each month. If you can produce those in minutes, applications, renewals, and the worst day of your year all get easier.

The reason carriers ask is in their own claims data. Coalition, one of the largest cyber insurers, reports that over half of all cyber insurance claims originate in the inbox — and its 2026 claims report puts business email compromise and funds transfer fraud together at 58% of observed incidents. These are attacks on people, not firewalls, which is why the application asks about the people.

Why carriers ask about training

Coalition’s 2026 Cyber Claims Report (drawn from more than 100,000 policyholders) found business email compromise claims up 15% year over year with an average loss of $27,000, and funds transfer fraud averaging $141,000 per claim. In the report’s words, these attacks “are still powered by social engineering, which targets the individual.” Insurers price what they pay out, so insurance and IT advisories list security awareness training and phishing simulations among the controls applications commonly ask about — and advise keeping the records that prove it.

The five records to have ready

• 1. Enrollment coverage. A list showing every employee is in the program — including the person who started last week. Coverage gaps are the first thing that makes a “yes” on an application look shaky.
• 2. Completion records. Named, dated completion reports for training assignments. “We did training last year” is a sentence; a dated export is evidence.
• 3. Phishing simulation history. When simulations ran, who received them, and the results over time. A monthly cadence reads very differently from a single simulation the week before the application.
• 4. The reporting-rate trend. The share of employees who report suspicious messages instead of ignoring them. It is the clearest sign of a working program — and it matters after an incident too: Coalition notes the sooner suspicious activity is reported, the more likely stolen funds can be recovered.
• 5. A dated program summary. One page saying what runs, how often, and since when. It turns four exports into a story an underwriter can file.

When you’ll be asked

Three moments. At application, where a typical question reads “Do employees receive security awareness training?” — insurance advisories recommend having training dates, attendance, and simulation results ready before you answer. At renewal, where last year’s answers get re-checked. And after an incident, when documentation is pulled together quickly. Answer applications accurately and keep the records that back each answer — your policy terms and your broker govern what any of it means for coverage, so bring the evidence and let them do their job.

Annual training technically answers the question. Monthly practice keeps the answer true.

Advisories commonly describe annual training plus a phishing simulation as the baseline insurers expect. But peer-reviewed research shows the effect of phishing training fades within roughly six months without reinforcement — so a business that trains every January is, by the research, unprotected by summer even though the application box is checked. Monthly practice closes that gap and produces a continuous evidence trail: twelve months of completions and simulations instead of one certificate.

What to do this quarter

• Enroll everyone, and turn on automatic enrollment so new hires are covered in week one.
• Run a phishing simulation monthly — practice, coaching at the click, no blame. Employees who are coached instead of shamed report more and hide less.
• Export and file the completion and simulation reports each quarter, somewhere your office manager can find them without IT.
• Put a reminder one month before your renewal date to pull the five records. The audit takes minutes when the program runs itself.

Where Hook Security fits

Hook was built for businesses that don’t have an IT team to run this. Autopilot runs the monthly training and simulation cadence for you, new employees are enrolled automatically, the Training Moment coaches at the exact second someone clicks, and the reporting is the insurance evidence: named completion records, simulation history, and reporting-rate trends on one exportable page. Every feature is included in every plan. If you are running a program for the first time, start with the guide for businesses with fewer than 100 people.

Frequently asked questions

Is security awareness training legally required to get cyber insurance?

No law requires it. But applications commonly ask about it, the answer can affect pricing and terms, and your answers need to be accurate — which is exactly why the records matter. Your broker can tell you how a specific carrier weighs it.

How often do employees need to train to satisfy insurers?

Advisories describe at least annual training plus a phishing simulation as the common baseline. The research case for monthly practice is separate and stronger: training effects fade within months, and monthly cadence means your records are always current — no scramble before a renewal.

What counts as proof of training?

Named completion records with dates, phishing simulation results over time, and enrollment coverage. Screenshots assembled the night before a renewal are the weakest version; platform-generated exports with dates and names are the strong one.

Sources

Coalition: 2026 Cyber Claims Report announcement — BEC/FTF share of incidents, average losses, social-engineering framing, early-reporting note.

Coalition: Security awareness training for policyholders — “over half of all cyber insurance claims originate in the inbox.”

JLB USA: Cyber insurance requirements in 2026 — sample application question and the records to keep ready.

Reinheimer et al., USENIX SOUPS 2020 — phishing-training effects fade within months without reinforcement.

Keep reading

• The best security awareness training for small business — how to pick a platform in the first place.
• The under-100-employees program guide — running a real program without an IT team.
• Audit your program in 30 minutes — includes the five-minute evidence question.
• Cyber insurance and SAT for MSPs — the same topic from the MSP’s side of the table.
• See Hook in action — an interactive phishing simulation demo, from the inbox to the Training Moment.