Topic starter
19/08/2026 4:06 pm
TL;DR: Cyber insurance underwriting is shifting toward measurable human risk reduction, with Verizon reporting the human element in roughly 68% of breaches and the FBI citing more than $2.9 billion in adjusted BEC losses in 2023, according to Living Security Human Risk Management Platform. Renewal evidence now needs outcome data, not just completion rates, because insurers are pricing exposure, control effectiveness, and repeatable intervention.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “How Cyber Insurance Human Risk Management Affects Premiums”.
By the numbers:
- Verizon's 2024 DBIR found the human element involved in roughly 68% of breaches.
- The FBI reported more than $2.9 billion in adjusted losses from business email compromise in 2023.
Key questions
Q: What breaks when cyber insurance relies on training completion instead of human risk outcomes?
A: The insurer cannot tell whether the control changed behaviour or simply recorded attendance.
Q: Why do insurers care about human behaviour in cyber renewals?
A: Because human error is a major path to financially material incidents, especially phishing and business email compromise.
Q: How should security teams measure whether human risk management is actually reducing risk?
A: Use outcome metrics, not just participation data.
Practitioner guidance
- Map renewal evidence to outcome metrics Replace training-completion summaries with evidence of reduced phishing clicks, faster reporting, fewer repeat failures, and lower-risk user populations over time.
- Segment human risk by role and access Break reporting out by business unit, privilege level, and exposed workflows so high-consequence populations such as finance and administrators are visible to underwriters.
- Document baseline, intervention, and outcome Record the starting risk level, the specific intervention applied, the measurement window, and the resulting change so the insurer can follow the logic of the claim.
Bottom line: Cyber insurers are increasingly pricing the quality of human risk reduction rather than the volume of training activity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:40 pm
Human risk has become an underwriting variable, not a training metric. Cyber insurance carriers are responding to the economics of loss, which means they care less about course completion and more about whether risky decisions are falling over time. That changes the evidence standard for security teams and makes behaviour-linked reporting a governance issue, not a communications exercise. The practitioner conclusion is simple: renewal readiness now depends on measurable reduction, not participation counts.
A question worth separating out:
Q: What should organisations include in a cyber insurance evidence pack?
A: Include the baseline risk assessment, the populations covered, the interventions applied, the measurement period, and the resulting trend in human-risk outcomes. Add exception handling, remediation history, and any loss-prevention controls tied to finance, executive, or privileged workflows so the insurer can see how exposure is reduced in practice.
👉 Read our full editorial: Cyber insurance is pricing human risk, not training completion