Does Your Cyber Insurance Require Phishing Simulations? (2026 Requirements)

Short answer: increasingly, yes — and "we do annual training" is no longer the answer that passes.

Cyber insurance underwriting has changed from a light questionnaire into something closer to a security audit. 2026 renewal forms that used to ask a dozen questions now run to 80 or more, and carriers want documentation, not assurances: screenshots, policies, logs, and proof that controls are actually running. Human error is why they care — it was a factor in the large majority of breaches, and social engineering drives the biggest share of claims by loss value. So underwriters now look hard at the human layer.

What carriers actually expect

Across 2026 carrier requirements, the pattern is consistent:

• Phishing simulations run on a schedule — quarterly at minimum, monthly for stronger terms — not a one-time exercise.
• Documented training completion, typically at or above a 90% threshold across departments.
• Trend data over time — ideally six or more months of simulation results showing click and report rates moving in the right direction.
• Timestamps and scope for every campaign, so the evidence is auditable.
• Remedial training for repeat clickers, tracked.

The consequence of not having this isn't just a higher premium. A growing number of 2026 policies carry coverage exclusions — if a breach traces to a gap you attested to controlling but couldn't document, the claim can be denied. That turns a paperwork gap into an uninsured loss.

Why this doubles as compliance

The same simulation logs that satisfy an underwriter also support audit readiness across frameworks. SOC 2, HIPAA's workforce-training safeguards, PCI-DSS Requirement 12.6, ISO 27001, and the NIST CSF all call for documented awareness activity. Build the evidence pack once and it works for insurance and regulators — the data that proves ROI to your leadership is the same data that satisfies everyone else.

What to do if renewal is within six months

Start now, not 30 days out. Underwriters want history:

1. Begin monthly simulations immediately so you accumulate trend data before renewal.
2. Document each campaign — date, scope, results — as you go, rather than reconstructing it later.
3. Track completion and push toward the 90% mark.
4. Assign remedial training to repeat clickers and log it.
5. Assemble the evidence pack incrementally, adding a report each month.

The organizations that treat this as a year-round program, not a renewal-week scramble, get better terms and avoid the denials.

The practical bar

You don't need an enterprise platform to clear it. You need simulations that actually run, completion tracking, and exportable logs with timestamps. That's the whole ask — and it's exactly what a lightweight simulation tool provides without the enterprise contract.

Renewal coming up? PhishSim AI runs the simulations, tracks completion, and exports the timestamped logs your underwriter wants — start building trend data today. See plans →