My cyber insurance form asks about phishing training and email security. What counts?
Updated October 30, 2026
What counts is filtering that stops scam emails before anyone sees them, plus training that includes everyone on a regular schedule, with a record of who finished it. Some forms also ask about practice phishing emails and email authentication settings, and each part needs its own answer. If you use Microsoft 365, some of this is already switched on, so check what you have before you buy anything.
Steps
- Split the form’s email questions into four parts: filtering, training, practice phishing emails, and email authentication. Answer each one on its own.
- Check your email filtering. Microsoft 365 includes spam, malware, and phishing protection for every cloud mailbox, on by default. Note any separate email security service too.
- Check your email authentication records: SPF, DKIM, and DMARC, which stop criminals sending email that pretends to come from your domain.
- Find the training records: who has had it, when, and whether new hires get it.
- Check whether you run practice phishing emails, and with what tool, since Microsoft’s built-in version needs a higher plan.
- Make sure everyone knows how to report a suspicious email, using Outlook’s Report button, so the ones that get through reach someone.
- Write down what you found, with dates and screenshots. That’s your evidence if the insurer asks.
Details
What these questions are really asking
Email questions on insurance forms fall into four groups, and forms usually ask about each one separately:
- Email filtering. Is incoming email scanned for scams, harmful links, and harmful attachments before it reaches anyone? Microsoft 365’s built-in protection covers all cloud mailboxes (Microsoft: Built-in security features for all cloud mailboxes).
- Security awareness training. Does everyone get training on spotting scam emails, and how often?
- Phishing simulations. Do you send harmless practice scam emails to see who clicks, and follow up with more training? In Microsoft 365, the built-in Attack simulation training requires Microsoft 365 E5 or Defender for Office 365 Plan 2 (Microsoft: Get started with Attack simulation training). Many businesses use a separate training service instead.
- Email authentication. Are SPF, DKIM, and DMARC set up for your domain (Microsoft: How email authentication works)? How do I set up email with my own domain? explains each one.
This isn’t insurance or legal advice, so talk to your broker about how your answers affect your coverage.
Fix the email before you train the people
Work in this order: stop as many scam emails as you can from arriving, make the rest easy to spot and report, and then train. Filtering and authentication remove many fakes before anyone has to judge them. A visible Report button turns “delete it quietly” into a habit that warns everyone else: in current Outlook, people select the message, then Report > Report phishing (Microsoft: Report phishing and suspicious emails in Outlook). Training handles what’s left, and forms still ask about it separately, because some scam emails always get through.
What useful training looks like for a small team
Useful training is short, regular, and includes everyone, the owner too. The basics are the warning signs CISA, the U.S. government’s cybersecurity agency, points to: urgent or emotional language, requests for personal or financial information, and email addresses or links that are slightly off. If a message might be real, contact the person or company another way instead of using the link or phone number in the message (CISA: Recognize and Report Phishing). In our experience, short sessions spread through the year stick better than one long session at renewal time.
If the honest answer is “not yet”
Saying “not yet” beats guessing, and training is often one of the quicker gaps to close, because it doesn’t need new equipment. Describe what’s in place, what isn’t, and when you expect to finish, then ask your broker how the insurer treats a partial answer. For the rest of the application, see What does my cyber insurance application want me to have?
For IT PLZ HELP clients, security awareness training, practice phishing emails, and email security setup are part of the service, so these questions have real answers when the application comes around.
Where doing it yourself gets risky
- Training that happened once. A session two years ago with no record is hard to call a yes.
- Leaving people out, such as the owner, part-time staff, or anyone hired since the last session.
- A DMARC record set to monitor only. If it’s set to p=none, other mail systems aren’t asked to block or quarantine fake messages that use your domain. Microsoft describes that setting as a testing step (Microsoft: Set up DMARC).
Signs it’s time for help
Get help if any of these is true. You can check the rest yourself.
- No one has had security training in the past year.
- You aren’t sure what filters your email.
- Your renewal is close, and several answers are still “don’t know.”
Today, write down the date of your team’s last security training and who attended. If you can’t find it, that’s the first gap to close before you sign the application. If you’d like a second set of eyes on your email setup before your renewal, we’re glad to go through it with you.
Book a free 20-minute fit check