---
title: Email security and phishing questions on cyber insurance applications
url: "https://insuranceposture.com/questions/email-security"
section: Email security and phishing
questions: 11
updated: 2026-08-24
---

# Email security and phishing: what cyber insurance applications ask

Mail filtering, attachment detonation, SPF, DKIM, DMARC, external tagging, legacy authentication, and phishing simulation practice.

## 11 questions in this section

- [Is inbound email security (SEG) deployed with sandbox attachment detonation?](https://insuranceposture.com/questions/email-security/inbound-email-security-deployed-sandbox-attachment-detonation) (verifiable from your tenant)
- [Does the Applicant employ a sandboxing solution for investigating suspicious emails/attachments?](https://insuranceposture.com/questions/email-security/applicant-employ-sandboxing-solution-investigating-suspicious-emails-attachments) (verifiable from your tenant)
- [Does the Applicant have a report-phishing email add-in enabled for all email users?](https://insuranceposture.com/questions/email-security/applicant-report-phishing-email-add-enabled-email-users) (verifiable from your tenant)
- [Does the Applicant employ SPF, DKIM, and DMARC?](https://insuranceposture.com/questions/email-security/applicant-employ-spf-dkim-dmarc) (verifiable from your tenant)
- [Are phishing simulations conducted for all employees, with click rate tracking?](https://insuranceposture.com/questions/email-security/phishing-simulations-conducted-employees-click-rate-tracking) (partly verifiable from your tenant)
- [How does the Applicant handle repeat offenders/clickers in phishing simulations?](https://insuranceposture.com/questions/email-security/applicant-handle-repeat-offenders-clickers-phishing-simulations) (attested, not tenant-verifiable)
- [Are employees with financial/accounting responsibility given social engineering and phishing training?](https://insuranceposture.com/questions/email-security/employees-financial-accounting-responsibility-given-social-engineering-phishing-training) (attested, not tenant-verifiable)
- [Which inbound email security product / Secure Email Gateway (SEG) does the Applicant use?](https://insuranceposture.com/questions/email-security/inbound-email-security-product-secure-email-gateway-applicant) (attested, not tenant-verifiable)
- [Are external emails tagged as originating from an external source?](https://insuranceposture.com/questions/email-security/external-emails-tagged-as-originating-from-external-source) (verifiable from your tenant)
- [Is legacy email authentication (IMAP, POP, basic authentication) disabled?](https://insuranceposture.com/questions/email-security/legacy-email-authentication-disabled) (verifiable from your tenant)
- [Is email filtering in place for inbound mail?](https://insuranceposture.com/questions/email-security/email-filtering-place-inbound-mail) (verifiable from your tenant)

Full index: https://insuranceposture.com/questions

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.