Cyber insurers are raising their expectations. Tick-box training isn’t enough to secure coverage or favourable terms. With phishing being the most common cause of claims, insurers want proof that your people can recognise and stop real threats.

Meeting minimum regulatory requirements may satisfy auditors, but it doesn’t guarantee you’ll meet insurer standards.

The UK NCSC’s cyber security guide for SMEs explains that insurers look for evidence of strong controls and trained staff. Coalition’s cyber insurance requirements include ongoing user training as a key control.

Organisations that can demonstrate reduced human risk, supported by measurable phishing resilience, can negotiate better terms and lower premiums. Some insurers even offer discounts or incentives for using approved phishing simulation tools, like Chubb’s Cyber Phishing Awareness Assessment. Chubb’s Cyber Phishing Awareness Assessment.

PSUATstrong> helps organisations meet insurer expectations by: