Cyber Insurance and Human Risk: What Insurers Now Expect

For most of its short history, cyber insurance was priced on technology questions: firewall vendor, antivirus coverage, backup schedule, revenue band. That era is over. The questionnaires have changed because the claims have changed — and the claims point squarely at people.

In Coalition's 2026 Cyber Claims Report, drawn from claims across more than 100,000 policyholders between January and December 2025, business email compromise and funds transfer fraud together accounted for 58% of all claims. Not zero-days. Not unpatched servers. Emails that persuaded someone to pay the wrong account. The Verizon DBIR tells the same story from the breach side: 62% of breaches involved the human element.

Insurers read these reports more carefully than anyone, because they pay for the outcomes. The result is that the human layer — training, simulation, verification procedures, reporting behavior — has moved from a soft section of the application to the part that shapes pricing, sub-limits, and exclusions. This article walks through what the claims data says, what underwriters now ask, and the evidence worth assembling before your next renewal.

The claims data that changed the questionnaire

Underwriting follows losses. Here is where the losses actually came from in 2025, from Coalition's policyholder claims data and the FBI's complaint statistics:

Two details in Coalition's data deserve more attention than the headlines. First, business email compromise is a gateway, not just a loss category: 52% of funds transfer fraud claims originated as a BEC, with an average loss of $112,000. An attacker reading a finance inbox for three weeks is not a contained incident — it is the reconnaissance phase of a larger one. Second, while ransomware generated the most costly claims and initial ransom demands surged 47% year over year to an average above $1 million, a record 86% of businesses refused to pay — and how ransomware gets in is itself overwhelmingly a people problem, through phishing, stolen credentials, and MFA fatigue.

For an underwriter, the conclusion is unavoidable. The technology questions still matter, but the majority of the money goes out the door through categories where the decisive control is a person's behavior in the thirty seconds after a convincing email or call arrives.

What underwriters now ask about your workforce

Application forms vary by carrier, but the human-layer questions have converged. Expect to answer, in writing:

• Multi-factor authentication — not just "do you have MFA" but where: email, remote access, privileged accounts, backups. Number matching or phishing-resistant methods earn more credit than bare push notifications, because insurers have paid claims where push approvals were fatigued out of employees.
• Security awareness training — whether it exists, how often it runs, and whether it is tested. "Annual training: yes" is the weakest possible answer; carriers increasingly ask for simulation frequency and results.
• Payment verification procedures — whether changes to vendor bank details or urgent payment requests require out-of-band verification against a known contact. For social engineering coverage, some policies make following this procedure a condition of the coverage itself.
• Email authentication and controls — SPF, DKIM, DMARC, and flagging of external senders.
• Incident response — whether a plan exists, when it was last tested, and whether employees know how to report a suspected compromise quickly.

Answer these carelessly and the cost is not just price. An application is a representation: if a claim investigation finds that the "quarterly phishing simulations" you attested to never ran, you have handed the carrier an argument against paying. The safe posture is to answer from evidence you can produce — which, usefully, is the same evidence that makes the program work.

An underwriter cannot price what you cannot show. A measured, falling failure rate is underwriting evidence; a training completion certificate is an attendance record.

Read the social engineering sub-limit before you need it

The most expensive policy surprise in this category is discovering, mid-incident, that the loss which drove you to buy the policy is barely covered. Social engineering and funds transfer fraud are frequently handled through a separate endorsement with its own sub-limit — commonly a fraction of the headline limit. A company carrying a $5 million cyber policy can find that a $400,000 fraudulent transfer, exactly the kind of loss Coalition's data says is most common, falls under a $100,000 or $250,000 sub-limit.

Three things to check in the wording with your broker: the sub-limit itself, whether coverage is conditional on a verification procedure having been followed, and how the policy treats a transfer authorized by a legitimate employee who was deceived — the precise scenario in 71% of funds transfer fraud claims. None of this is legal advice; it is a prompt to have the conversation with your broker and counsel while it is still cheap to have.

Building the renewal file: evidence that moves the conversation

The practical opportunity is that insurers reward what they can verify. A renewal file built on measurement does two jobs at once: it reduces the risk and it documents the reduction. Assemble it over the policy year, not the week before renewal.

1. Baseline and trend your phishing failure rate. Run realistic, unannounced phishing simulations across the workforce and keep the quarterly numbers. Industry benchmarks give your trend context: in KnowBe4's 2026 Phishing by Industry Benchmarking Report, organizations start at a 33.2% phish-prone rate before training, falling to 20.1% after 90 days and 4.2% after a year of sustained simulation and training.
2. Track the report rate, not just the failure rate. Employees who report suspicious messages are a detection control an underwriter can understand — early reports are how BEC gets caught before it matures into a six-figure transfer.
3. Document MFA coverage honestly. Where it is enforced, which methods, and how you handle push fatigue. If you have moved privileged accounts to phishing-resistant methods, say so — it maps directly to claim categories.
4. Write down the payment verification procedure. One page: what triggers verification, who verifies, against which channel. Train finance on it, test it in a simulation, and date both.
5. Quantify human risk per department. A composite human risk score — built from simulation results, training discipline, and reporting behavior — turns "we do awareness" into a distribution an underwriter can read. If you are new to the approach, start with how to calculate a human risk score.
6. Date your incident response tests. A tabletop exercise with a social engineering scenario, run and documented, answers two application questions at once.

Treat the file as a living artifact. When the market hardens or a carrier tightens terms, the organizations that negotiate successfully are the ones holding twelve months of behavioral data, not a signed attestation.

Insurability and security are the same work

There is a temptation to treat insurance requirements as compliance theater — boxes to tick so the premium stays flat. The claims data argues the opposite. The controls underwriters probe hardest are the ones that address 58% of actual claims. Building them properly does not just improve your terms; it shrinks the probability you ever test the policy. The premium discount is a side effect. The point is that the loss distribution insurers are pricing is, to a measurable degree, the behavior of your workforce — and unlike the threat landscape, that distribution is one you can move.

Sources

• 2026 Cyber Claims Report — Coalition, March 2026; claims data from 100,000+ policyholders, Jan 1–Dec 31 2025. Used for: 58% BEC+FTF share of claims; 71% of FTF claims from social engineering; 52% of FTF claims originating as BEC ($112K average loss); $141K average FTF loss; $269K average ransomware loss; +47% initial ransom demands (average above $1M); 86% refusing to pay.
• FBI IC3 Internet Crime Report 2025 — FBI Internet Crime Complaint Center, April 2026. Used for: $3.046B reported BEC losses across 24,768 complaints.
• Verizon Data Breach Investigations Report — Verizon, 2026 edition. Used for: 62% of breaches involving the human element.
• Phishing by Industry Benchmarking Report — KnowBe4, 2026 edition. Used for: 33.2% baseline → 20.1% at 90 days → 4.2% at 12 months phish-prone rates.