What Evidence Do Cyber Insurers Want From Small Businesses? A Security Awareness Training Checklist (2026)
What Evidence Do Cyber Insurers Want From Small Businesses? A Security Awareness Training Checklist (2026)
Cyber insurers want proof, not a checkbox. For a small business, the security awareness training evidence that holds up at application and renewal is five things: a one-page program description, a phishing simulation log, training completion records, a reporting-rate trend, and a written payment-verification procedure. Keep them in one folder and update it monthly.
That folder takes about an hour to set up. Not having it can cost you a clean renewal. Here is what goes in it, why each piece matters to an underwriter, and what to leave out.
Why do cyber insurers care so much about employee training?
Because email is where most claims start. In Coalition's 2025 Cyber Claims Report, business email compromise (BEC) and funds transfer fraud (FTF) made up 60% of the carrier's 2024 claims. BEC claim severity rose 23% year over year, and 29% of BEC events turned into funds transfer fraud.
The breach data says the same thing from another angle. The Verizon 2025 Data Breach Investigations Report found the human element involved in roughly 60% of breaches, and ransomware present in 88% of breaches at small and midsize businesses. The median ransom paid fell to $115,000.
And the FBI's Internet Crime Complaint Center logged 21,442 BEC complaints in 2024, with close to $2.8 billion in reported losses, as summarized by Nacha. An underwriter reading those numbers wants to know one thing about your people: will they spot a manipulation attempt and say something before money moves?
What does a cyber insurance application actually ask about training?
Less than you might expect, which is the trap. Applications vary by carrier and by policy size. As one public example, the CFC cyber application lists “Employee Awareness Training” as a control, defined as “Training programmes designed to increase employees' security awareness,” alongside questions on multi-factor authentication for all email accounts and daily offline backups.
A checkbox is easy to tick. The harder moment comes later: a renewal questionnaire that asks how often training runs, a broker who wants details for a better market, or an incident where the carrier reviews what your application said. Every answer you give is a statement about your business. The evidence folder is how you make sure each one is true and easy to show.
The five pieces of evidence a small business should keep
1. A one-page program description
One page, plain language. Who is enrolled (all employees, including owners and new hires), how often training and phishing simulations run, which topics the year covers (phishing, payment fraud, passwords, data handling), and who runs the program: you, your MSP, or a vendor. Date it, and update it when anything changes. This is the document your broker can attach to an application without editing.
2. A phishing simulation log
A simple record of every simulation: the send date, number of recipients, the theme or manipulation tactic used (urgency, authority, a fake invoice), and how many people reported it versus clicked. Twelve monthly rows tell an underwriter far more than a single snapshot. A trend shows the program is real and running.
3. Training completion records
Module-level completion with dates, exported from your training platform. Two details matter most: completion across the whole company, not just volunteers, and new hires invited within their first week. Gaps here are the easiest thing for anyone reviewing the program to spot, and the easiest to fix before renewal.
4. A reporting-rate trend
This is the number most small businesses skip and the one that best reflects real protection. Your suspicious email reporting rate is the share of simulation recipients who report the message instead of ignoring or clicking it. A rising reporting rate means more people are raising their hand when something looks wrong. That is what stops a real BEC attempt. Clicks are useful diagnostic data. Reports are the outcome. Our guide on how to get employees to report phishing emails covers how to move this number.
5. A written payment-verification procedure
Given that BEC and funds transfer fraud drove 60% of Coalition's 2024 claims, this may be the most valuable page in the folder. Write down the rule: any new payee or change to banking details is confirmed by a call to a number already on file, never one from the email; payments above a set amount need a second approver. Then make sure training covers it, and note the date everyone acknowledged it.
How often should a small business run training and simulations?
There is no single carrier rule, and you should check your own policy and talk to your broker. Monthly is a defensible cadence because it produces the trend line the folder needs. Quality matters as much as frequency: a 2025 Marsh McLennan study that compared control self-assessments with claims data found that realistic phishing simulations and regularly updated content delivered more benefit than generic, frequent awareness programs. A yearly video ticks the box. It does not produce evidence that behavior changed.
What should you leave out of the evidence folder?
Lists of people who clicked, and any per-person score. The carrier needs proof that the program runs and that the company is improving, not a ranking of employees. Naming and shaming also backfires: people who expect punishment stop reporting, and reports are what stop real attacks. We cover the research in should you punish employees who fail phishing simulations. Keep the folder at the company and team level.
What if an MSP runs your security awareness program?
Then the folder is a reasonable thing to ask for. Request the five items once a quarter, and again a month before renewal. A good MSP already produces them for quarterly reviews. If yours is building this into its service, our guide to cyber insurance and security awareness training for MSPs shows the provider side of the same checklist.
Hook Security is a security awareness training and phishing simulation platform built for MSPs and SMBs. Its monthly simulations and short video courses are built to grow your reporting rate, and the program records are there when the application asks. See how it fits on our security awareness training for cyber insurance page.
Frequently asked questions
Does cyber insurance require security awareness training?
Many cyber applications ask about it, and some list it as a control alongside MFA and backups. Whether it is required for your policy depends on the carrier, the coverage and your size. Ask your broker which controls your carrier treats as mandatory.
Will security awareness training lower my cyber insurance premium?
No one can promise that. Pricing is carrier-specific. What a documented program does is let you answer application questions with evidence, which supports a cleaner underwriting conversation and protects you from answers you cannot back up.
What counts as proof of security awareness training?
Dated records, not a statement. A program description, a log of phishing simulations with report and click counts, training completion exports, a reporting-rate trend over time, and a written payment-verification procedure that employees have acknowledged.
Is an annual training video enough for cyber insurance?
It may satisfy a yes-or-no question, but it produces no trend. A monthly program with realistic simulations gives you twelve data points a year and matches what the 2025 Marsh McLennan findings point to: realistic practice beats generic repetition.
Who should keep the evidence folder?
Whoever owns the insurance relationship, usually the owner, office manager or finance lead. If an MSP runs the program, the MSP produces the records and the business keeps the copy.
Keep reading
Best security awareness training for small business (2026): how the main platforms compare for SMBs.
Security awareness training for cyber insurance: how Hook supports insurance-ready programs.
Sources
Coalition, 2025 Cyber Claims Report (May 2025)
Verizon, 2025 Data Breach Investigations Report, Executive Summary
Nacha summary of the FBI IC3 2024 Internet Crime Report (April 2025)
Training courses on this topic
From Hook Security’s security awareness training library.
- 30 minPCI Security Awareness TrainingPCI (Payment Card Industry) compliance training is designed to educate employees on the requirements and best practices for protecting payment card data. Compliance with PCI standards is required by contractual agreements between organizations and payment card brands.
- 30 minGDPR Security Awareness TrainingGDPR compliance training educates employees on the principles, requirements, and best practices for protecting personal data of individuals within the EU and EEA.
- 30 minHIPAA Security Awareness TrainingWelcome to your HIPAA Security Awareness Training for HIPAA covered entities and business associates. Our HIPAA Compliance Training gives employees a HIPAA introduction including how to recognize PHI (protected health information), proper uses and disclosures of PHI, how to keep PHI secure, and how to report a breach of PHI.
Ready to Strengthen Your Security Culture?
See how Hook Security can help protect your organization.