Cyber insurance underwriting has changed dramatically over the past three years. What used to be a simple questionnaire with minimal verification has evolved into a rigorous, evidence-based review process that closely resembles a security audit. For 2026 renewals, insurers expect documented proof that your organization actively manages human-layer risk through phishing simulations, behavioral training, and incident response testing, not just technical controls like firewalls and antivirus. Here is exactly what you need to prepare, what controls insurers are mandating, and how to build an evidence pack that secures favorable terms.
How Has the Cyber Insurance Landscape Changed?
Insurers paid out record claims in 2023 and 2024, driven largely by ransomware attacks that originated with phishing emails, according to Gallagher's Cyber Insurance Market Report. The Coalition 2025 Cyber Claims Report found that social engineering, including phishing and business email compromise, accounted for the largest share of claims by total loss value. In response, underwriters have significantly tightened their requirements and verification processes. Organizations that cannot demonstrate robust phishing defenses now face premium increases of 30 to 100 percent, higher deductibles, reduced coverage limits, or outright coverage denials. The message is clear: insurers want to see that you are actively reducing the likelihood of a phishing-initiated breach through measurable, documented programs, not just hoping your perimeter defenses will catch it.
What Are the Core Cyber Insurance Requirements for 2026?
While each insurer has its own questionnaire and underwriting model, the following five controls appear on virtually every 2026 renewal application. These are no longer optional nice-to-haves; they are hard requirements that can make or break your renewal:
- Multi-factor authentication (MFA): Enforced across all remote access, email, and privileged accounts. SMS-based MFA is increasingly flagged as insufficient due to SIM-swapping and SS7 vulnerabilities; insurers prefer authenticator apps, hardware security keys (FIDO2), or biometric verification. Some carriers now require MFA on all accounts, not just privileged ones.
- Endpoint detection and response (EDR): Deployed on all endpoints, including servers, workstations, and laptops, with 24/7 monitoring capability through either an internal security operations center or a managed detection and response (MDR) service. Basic antivirus alone no longer satisfies underwriter requirements.
- Security awareness training: Regular, documented training for all employees, not just new hires during onboarding. Insurers want to see completion rates above 90 percent, training frequency of at least quarterly, and evidence that training content is updated to reflect current threat patterns. Annual compliance-only training is explicitly flagged as insufficient by most major carriers.
- Phishing simulation programs: This is the newest hard requirement and the one that has changed most dramatically since 2024. Insurers now ask specifically for simulation frequency (monthly preferred), organization-wide click-rate trends over the past 12 months, evidence that simulation results are used to trigger targeted remedial training for high-risk employees, and reporting that shows sustained improvement rather than point-in-time snapshots.
- Incident response plan: A documented, tested IR plan with defined roles and responsibilities, internal and external communication procedures, recovery time objectives for critical systems, and evidence of the most recent tabletop exercise or live drill. Plans that have not been tested within the past 12 months are often flagged as a risk factor.
What Should You Include in a Cyber Insurance Evidence Pack?
An evidence pack is the collection of reports, logs, and documentation you submit to your insurer at renewal time. Think of it as a compliance audit package specifically designed for your underwriter. A strong evidence pack for 2026 should include the following documents, organized chronologically and with executive summaries for each section:
- Phishing simulation summary reports showing campaign frequency (monthly or more often), organization-wide click rates, credential-submission rates, phishing report rates, and trend lines demonstrating consistent improvement over the past 12 months. Include department-level breakdowns showing that high-risk teams receive additional testing.
- Training completion reports with dates, module names, per-employee completion status, and quiz scores. Highlight that completion rates exceed the 90 percent threshold and that content is refreshed at least quarterly.
- MFA deployment coverage reports from your identity provider showing the percentage of accounts protected and the authentication methods in use (app-based, hardware key, etc.).
- EDR coverage and alert-response metrics from your security operations team, including mean time to detect and mean time to respond for the past quarter.
- A copy of your incident response plan with the date of the most recent tabletop exercise, a brief summary of the exercise scenario, and any improvements made as a result of the exercise findings.
How Does Phishing Simulation Data Impact Insurance Premiums?
Insurers are increasingly using phishing simulation data as a direct, quantitative input to premium calculations rather than relying solely on self-reported questionnaire answers. Organizations that can demonstrate a sustained click rate below 5 percent, combined with monthly or biweekly simulation cadence and documented remedial training for repeat clickers, are seeing premium reductions of 10 to 25 percent compared to organizations without a simulation program, according to data from Coalition and industry broker reports. Some insurers have begun offering preferred rates specifically for companies that use adaptive or spaced-repetition simulation models, recognizing that these approaches produce more durable behavioral change than static template-based testing. The key insight for budget holders is that the cost of a phishing simulation platform, typically $12 to $32 per user per year, is often recovered multiple times over through premium savings alone, before you even factor in breach-cost avoidance.
When Should You Start Preparing for Your Cyber Insurance Renewal?
If your renewal is in the next six months, the time to act is now, not 30 days before your policy expires. Begin running monthly phishing simulations immediately so you have at least six months of trend data to present. Document every campaign with timestamps, scope, and results. Ensure your training completion rates are above the 90 percent threshold across all departments. Build your evidence pack incrementally, adding new reports each month, rather than scrambling to assemble everything at renewal time. Schedule your IR tabletop exercise at least 60 days before renewal so the results are fresh. The organizations that treat cyber insurance requirements as a year-round program, rather than a last-minute checkbox exercise, consistently secure the best terms, the lowest premiums, and the broadest coverage, while organizations that cannot produce evidence face increasingly punitive renewal terms or lose coverage entirely.