Cyber Insurance Now Asks About Phishing Training. Here's What They Want.

Renewed a cyber insurance policy lately? Then you've seen the new questions about phishing. Insurers no longer stop at "Do you have antivirus?" They want to know if you test and train your employees.

What insurers are asking

The exact questions vary by carrier. Most cyber insurance applications now include some version of these:

• Do you conduct regular phishing awareness training?
• How often do you run phishing simulations?
• What percentage of employees have completed security awareness training?
• Can you provide documentation of your phishing program?
• Do you have a process for employees to report suspicious emails?

A "no" doesn't disqualify you on its own. It can raise your premium by 10-30%, or trigger exclusions that leave you unprotected when you need coverage most.

What documentation they accept

Insurers don't need an elaborate security framework. They want evidence of something consistent:

• Campaign frequency. Proof that you run simulations regularly (monthly or quarterly).
• Participation rates. Evidence that most employees are included in testing.
• Click rate trends. Data showing improvement over time.
• Training completion. Records of employees completing security awareness training.

How to generate compliance reports

PhishPlease exports PDF reports with all four of these metrics. Attach them to your renewal application or email them to your broker.

Each report shows simulation dates, employee participation, click rates by campaign and department, training enrollment and completion status. That is the data insurers request.

Timeline: how fast can you get compliant?

You can go from nothing to a documented phishing program within a week:

1. Day 1: Sign up and import employees (CSV or manual entry).
2. Day 1-2: Send your first simulation campaign.
3. Day 3-5: Results come in. Training starts automatically for anyone who clicked.
4. Day 5-7: Export your first compliance report.

By your next renewal, you'll have months of data that show an active, documented program.

The cost math

PhishPlease costs $89.99/month for up to 30 users. If documenting a phishing program cuts your premium by 10%, the tool can pay for itself. Many SMBs see premium reductions of 15-25% after they start regular phishing training.