Underwriting the Human Layer
Technology powers modern business, but people determine whether it stays secure. With around 95% of cyber incidents involving human error, the human attack surface is not a footnote to the risk - it is much of the risk. This course goes inside human-layer cyber exposure: how behaviour, habits and training shape real loss outcomes, and how insurers can evaluate those factors to underwrite better.
Price the risk that sits with an insured's people
Human-layer risk is hard to see in a submission and easy to underprice. This course gives you a way to reason about it, and an honest read on what current questionnaires do and do not tell you.
- Identify and differentiate internal and external cyber threats, and the role human behaviour plays in creating vulnerability.
- Evaluate how security awareness and ongoing training reduce human-layer risk, and identify best practice for a sustainable programme.
- Assess how cyber insurers evaluate human-layer risk today, and the strengths and limits of current underwriting questionnaires.
What the course covers
Five self-paced lessons, about two hours in total. A final assessment, earns the certificate of completion.
01 The human attack surface
Why most incidents involve human error, and what that means for how you read a risk.
02 Internal and external threats
Telling the two apart, and the behaviours that open the door to each.
03 What good training actually looks like
Security awareness programmes that change behaviour, and the ones that only tick a box.
04 Evaluating the human layer in underwriting
How insurers assess this today, and where the current questionnaires fall short.
05 From training to loss outcomes
Connecting programme quality to the losses that do and do not happen.
For the desk that has to judge a security culture
Written for insurance professionals rather than security trainers: the goal is a defensible underwriting view, not a curriculum design.
Underwriters
You want to move past a yes/no training question and actually assess the human layer.
Brokers
You want to present an insured's security culture in a way that earns better terms.
Risk managers
You are building or defending a training programme and want to know how insurers read it.
About this certificate course
No. This is a certificate course, which is shorter than a certification. You earn a certificate of completion, not a certification credential.
There is a final assessment. It confirms you are ready for the certificate of completion.
No. It is a one-off purchase, with no renewal and no maintenance fee, and your certificate of completion does not expire.
No. Underwriters get the most direct use from it, but brokers presenting a risk and risk managers defending a programme are working the same question from the other side.
Most incidents start with a person, not a system
About two hours on human-layer cyber risk and how to evaluate it in underwriting. A certificate course.